<?xml version="1.0" encoding="UTF-8"?>
<Benchmark xmlns="http://checklists.nist.gov/xccdf/1.2" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" id="xccdf_org.ssgproject.content_benchmark_FEDORA" resolved="1" xml:lang="en-US" style="SCAP_1.2">
  <status date="2021-05-26">draft</status>
  <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Guide to the Secure Configuration of Fedora</title>
  <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">This guide presents a catalog of security-relevant
configuration settings for Fedora. It is a rendering of
content structured in the eXtensible Configuration Checklist Description Format (XCCDF)
in order to support security automation.  The SCAP content is
is available in the <html:code xmlns:html="http://www.w3.org/1999/xhtml">scap-security-guide</html:code> package which is developed at

    <html:a xmlns:html="http://www.w3.org/1999/xhtml" href="https://www.open-scap.org/security-policies/scap-security-guide">https://www.open-scap.org/security-policies/scap-security-guide</html:a>.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Providing system administrators with such guidance informs them how to securely
configure systems under their control in a variety of network roles. Policy
makers and baseline creators can use this catalog of settings, with its
associated references to higher-level security control catalogs, in order to
assist them in security baseline creation. This guide is a <html:em xmlns:html="http://www.w3.org/1999/xhtml">catalog, not a
checklist</html:em>, and satisfaction of every item is not likely to be possible or
sensible in many operational scenarios. However, the XCCDF format enables
granular selection and adjustment of settings, and their association with OVAL
and OCIL content provides an automated checking capability. Transformations of
this document, and its associated automated checking content, are capable of
providing baselines that meet a diverse set of policy objectives. Some example
XCCDF <html:em xmlns:html="http://www.w3.org/1999/xhtml">Profiles</html:em>, which are selections of items that form checklists and
can be used as baselines, are available with this guide. They can be
processed, in an automated fashion, with tools that support the Security
Content Automation Protocol (SCAP). The DISA STIG, which provides required
settings for US Department of Defense systems, is one example of a baseline
created from this guidance.
</description>
  <notice xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" id="terms_of_use">Do not attempt to implement any of the settings in
this guide without first testing them in a non-operational environment. The
creators of this guidance assume no responsibility whatsoever for its use by
other parties, and makes no guarantees, expressed or implied, about its
quality, reliability, or any other characteristic.
</notice>
  <front-matter xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The SCAP Security Guide Project<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>

    <html:a xmlns:html="http://www.w3.org/1999/xhtml" href="https://www.open-scap.org/security-policies/scap-security-guide">https://www.open-scap.org/security-policies/scap-security-guide</html:a>
</front-matter>
  <rear-matter xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Red Hat and Red Hat Enterprise Linux are either registered
trademarks or trademarks of Red Hat, Inc. in the United States and other
countries. All other names are registered trademarks or trademarks of their
respective companies.
</rear-matter>
  <platform idref="cpe:/o:fedoraproject:fedora:32"/>
  <version update="https://github.com/OpenSCAP/scap-security-guide/releases/latest">0.1.56</version>
  <metadata xmlns:xhtml="http://www.w3.org/1999/xhtml">
        <dc:publisher xmlns:dc="http://purl.org/dc/elements/1.1/">SCAP Security Guide Project</dc:publisher>
        <dc:creator xmlns:dc="http://purl.org/dc/elements/1.1/">SCAP Security Guide Project</dc:creator>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Frank J Cameron (CAM1244) &lt;cameron@ctc.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">0x66656c6978 &lt;0x66656c6978@users.noreply.github.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Jack Adolph &lt;jack.adolph@gmail.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Gabe Alford &lt;redhatrises@gmail.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Firas AlShafei &lt;firas.alshafei@us.abb.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Rodrigo Alvares &lt;ralvares@redhat.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Christopher Anderson &lt;cba@fedoraproject.org&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">angystardust &lt;angystardust@users.noreply.github.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">anixon-rh &lt;55244503+anixon-rh@users.noreply.github.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Chuck Atkins &lt;chuck.atkins@kitware.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Ryan Ballanger &lt;root@rballang-admin-2.fastenal.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Alex Baranowski &lt;alex@euro-linux.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Molly Jo Bault &lt;Molly.Jo.Bault@ballardtech.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Gabriel Becker &lt;ggasparb@redhat.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Alexander Bergmann &lt;abergmann@suse.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Dale Bewley &lt;dale@bewley.net&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Jose Luis BG &lt;bgjoseluis@gmail.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Joseph Bisch &lt;joseph.bisch@gmail.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Jeffrey Blank &lt;blank@eclipse.ncsc.mil&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Olivier Bonhomme &lt;ptitoliv@ptitoliv.net&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Lance Bragstad &lt;lbragstad@gmail.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Ted Brunell &lt;tbrunell@redhat.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Blake Burkhart &lt;blake.burkhart@us.af.mil&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Patrick Callahan &lt;pmc@patrickcallahan.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">George Campbell &lt;gcampbell@palantir.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Nick Carboni &lt;ncarboni@redhat.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">James Cassell &lt;james.cassell@ll.mit.edu&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Frank Caviggia &lt;fcaviggi@ra.iad.redhat.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Eric Christensen &lt;echriste@redhat.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Jayson Cofell &lt;1051437+70k10@users.noreply.github.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Caleb Cooper &lt;coopercd@ornl.gov&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Deric Crago &lt;deric.crago@gmail.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Will Cushen &lt;wcushen@redhat.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">cyarbrough76 &lt;42849651+cyarbrough76@users.noreply.github.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Maura Dailey &lt;maura@eclipse.ncsc.mil&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Klaas Demter &lt;demter@atix.de&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">dhanushkar-wso2 &lt;dhanushkar@wso2.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Andrew DiPrinzio &lt;andrew.diprinzio@jhuapl.edu&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">dom &lt;dominique.blaze@devinci.fr&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Jean-Baptiste Donnette &lt;jean-baptiste.donnette@epita.fr&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">drax &lt;applezip@gmail.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Sebastian Dunne &lt;sdunne@redhat.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">François Duthilleul &lt;francoisduthilleul@gmail.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Greg Elin &lt;gregelin@gitmachines.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">eradot4027 &lt;jrtonmac@gmail.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Alexis Facques &lt;alexis.facques@mythalesgroup.io&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Leah Fisher &lt;lfisher047@gmail.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Alijohn Ghassemlouei &lt;alijohn@secureagc.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">ghylock &lt;ghylock@gmail.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Andrew Gilmore &lt;agilmore2@gmail.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Joshua Glemza &lt;jglemza@nasa.gov&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Nick Gompper &lt;forestgomp@yahoo.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Loren Gordon &lt;lorengordon@users.noreply.github.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Patrik Greco &lt;sikevux@sikevux.se&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Steve Grubb &lt;sgrubb@redhat.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">guangyee &lt;gyee@suse.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Marek Haicman &lt;mhaicman@redhat.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Rebekah Hayes &lt;rhayes@corp.rivierautilities.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Trey Henefield &lt;thenefield@gmail.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Henning Henkel &lt;henning.henkel@helvetia.ch&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">hex2a &lt;hex2a@users.noreply.github.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">John Hooks &lt;jhooks@starscream.pa.jhbcomputers.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Jakub Hrozek &lt;jhrozek@redhat.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">De Huo &lt;De.Huo@windriver.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Robin Price II &lt;robin@redhat.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Yasir Imam &lt;yimam@redhat.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Jiri Jaburek &lt;jjaburek@redhat.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Keith Jackson &lt;keithkjackson@gmail.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Jeremiah Jahn &lt;jeremiah@goodinassociates.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Jakub Jelen &lt;jjelen@redhat.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Jessicahfy &lt;Jessicahfy@users.noreply.github.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Stephan Joerrens &lt;Stephan.Joerrens@fiduciagad.de&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Jono &lt;jono@ubuntu-18.localdomain&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Kai Kang &lt;kai.kang@windriver.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Charles Kernstock &lt;charles.kernstock@ultra-ats.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Yuli Khodorkovskiy &lt;ykhodorkovskiy@tresys.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Nathan Kinder &lt;nkinder@redhat.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Lee Kinser &lt;lee.kinser@gmail.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Evgeny Kolesnikov &lt;ekolesni@redhat.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Peter 'Pessoft' Kolínek &lt;github@pessoft.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Luke Kordell &lt;luke.t.kordell@lmco.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Malte Kraus &lt;malte.kraus@suse.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Seth Kress &lt;seth.kress@dsainc.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">kspargur &lt;kspargur@kspargur.csb&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Amit Kumar &lt;amitkuma@redhat.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Fen Labalme &lt;fen@civicactions.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Ade Lee &lt;alee@redhat.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Christopher Lee &lt;Crleekwc@gmail.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Ian Lee &lt;lee1001@llnl.gov&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Jarrett Lee &lt;jarrettl@umd.edu&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Joseph Lenox &lt;lordofhyphens@gmail.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Jan Lieskovsky &lt;jlieskov@redhat.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Šimon Lukašík &lt;slukasik@redhat.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Milan Lysonek &lt;mlysonek@redhat.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Fredrik Lysén &lt;fredrik@pipemore.se&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Caitlin Macleod &lt;caitelatte@gmail.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Nick Maludy &lt;nmaludy@gmail.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Lokesh Mandvekar &lt;lsm5@fedoraproject.org&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Matus Marhefka &lt;mmarhefk@redhat.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Jamie Lorwey Martin &lt;jlmartin@redhat.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Carlos Matos &lt;cmatos@redhat.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Robert McAllister &lt;rmcallis@redhat.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Michael McConachie &lt;michael@redhat.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Marcus Meissner &lt;meissner@suse.de&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Khary Mendez &lt;kmendez@redhat.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Rodney Mercer &lt;rmercer@harris.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Matt Micene &lt;nzwulfin@gmail.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Brian Millett &lt;bmillett@gmail.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Takuya Mishina &lt;tmishina@jp.ibm.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Mixer9 &lt;35545791+Mixer9@users.noreply.github.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">mmosel &lt;mmosel@kde.example.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Zbynek Moravec &lt;zmoravec@redhat.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Kazuo Moriwaka &lt;moriwaka@users.noreply.github.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Michael Moseley &lt;michael@eclipse.ncsc.mil&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Renaud Métrich &lt;rmetrich@redhat.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Joe Nall &lt;joe@nall.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Neiloy &lt;neiloy@redhat.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Axel Nennker &lt;axel@nennker.de&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Michele Newman &lt;mnewman@redhat.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Sean O'Keeffe &lt;seanokeeffe797@gmail.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Ilya Okomin &lt;ilya.okomin@oracle.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Kaustubh Padegaonkar &lt;theTuxRacer@gmail.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Michael Palmiotto &lt;mpalmiotto@tresys.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Max R.D. Parmer &lt;maxp@trystero.is&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Jan Pazdziora &lt;jpazdziora@redhat.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">pcactr &lt;paul.c.arnold4.ctr@mail.mil&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Kenneth Peeples &lt;kennethwpeeples@gmail.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Nathan Peters &lt;Nathaniel.Peters@ca.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Frank Lin PIAT &lt;fpiat@klabs.be&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Stefan Pietsch &lt;mail.ipv4v6+gh@gmail.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">piggyvenus &lt;piggyvenus@gmail.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Vojtech Polasek &lt;vpolasek@redhat.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Orion Poplawski &lt;orion@nwra.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Nick Poyant &lt;npoyant@redhat.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Martin Preisler &lt;mpreisle@redhat.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Wesley Ceraso Prudencio &lt;wcerasop@redhat.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Raphael Sanchez Prudencio &lt;rsprudencio@redhat.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">T.O. Radzy Radzykewycz &lt;radzy@windriver.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Kenyon Ralph &lt;kenyon@kenyonralph.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Mike Ralph &lt;mralph@redhat.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Federico Ramirez &lt;federico.r.ramirez@oracle.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">rchikov &lt;rumen.chikov@suse.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Rick Renshaw &lt;Richard_Renshaw@xtoenergy.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Chris Reynolds &lt;c.reynolds82@gmail.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">rhayes &lt;rhayes@rivierautilities.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Pat Riehecky &lt;riehecky@fnal.gov&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">rlucente-se-jboss &lt;rlucente@redhat.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Juan Antonio Osorio Robles &lt;jaosorior@redhat.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Matt Rogers &lt;mrogers@redhat.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Jesse Roland &lt;jesse.roland@onyxpoint.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Joshua Roys &lt;roysjosh@gmail.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">rrenshaw &lt;bofh69@yahoo.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Chris Ruffalo &lt;chris.ruffalo@gmail.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Ray Shaw (Cont ARL/CISD) rvshaw &lt;rvshaw@esme.arl.army.mil&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Earl Sampson &lt;ESampson@suse.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Willy Santos &lt;wsantos@redhat.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Gautam Satish &lt;gautams@hpe.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Watson Sato &lt;wsato@redhat.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Satoru SATOH &lt;satoru.satoh@gmail.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Alexander Scheel &lt;ascheel@redhat.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Bryan Schneiders &lt;pschneiders@trisept.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">shaneboulden &lt;shane.boulden@gmail.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Spencer Shimko &lt;sshimko@tresys.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Mark Shoger &lt;mshoger@redhat.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Thomas Sjögren &lt;konstruktoid@users.noreply.github.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Francisco Slavin &lt;fslavin@tresys.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">David Smith &lt;dsmith@eclipse.ncsc.mil&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Kevin Spargur &lt;kspargur@redhat.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Kenneth Stailey &lt;kstailey.lists@gmail.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Leland Steinke &lt;leland.j.steinke.ctr@mail.mil&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Justin Stephenson &lt;jstephen@redhat.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Brian Stinson &lt;brian@bstinson.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Jake Stookey &lt;jakestookey@gmail.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Jonathan Sturges &lt;jsturges@redhat.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">teacup-on-rockingchair &lt;strandjata@gmail.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Ian Tewksbury &lt;itewk@redhat.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Philippe Thierry &lt;phil@reseau-libre.net&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Derek Thurston &lt;thegrit@gmail.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">tianzhenjia &lt;jiatianzhen@cmss.chinamobile.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Greg Tinsley &lt;gtinsley@redhat.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Paul Tittle &lt;ptittle@cmf.nrl.navy.mil&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">tomas.hudik &lt;tomas.hudik@embedit.cz&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Jeb Trayer &lt;jeb.d.trayer@uscg.mil&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Brian Turek &lt;brian.turek@gmail.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Matěj Týč &lt;matyc@redhat.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">VadimDor &lt;29509093+VadimDor@users.noreply.github.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Samuel Warren &lt;swarren@redhat.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Shawn Wells &lt;shawn@shawndwells.io&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Daniel E. White &lt;linuxdan@users.noreply.github.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Bernhard M. Wiedemann &lt;bwiedemann@suse.de&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Roy Williams &lt;roywilli@roywilli.redhat.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Willumpie &lt;willumpie@xs4all.nl&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Rob Wilmoth &lt;rwilmoth@redhat.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Lucas Yamanishi &lt;lucas.yamanishi@onyxpoint.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Xirui Yang &lt;xirui.yang@oracle.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">yarunachalam &lt;yarunachalam@suse.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Kevin Zimmerman &lt;kevin.zimmerman@kitware.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Jan Černý &lt;jcerny@redhat.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Michal Šrubař &lt;msrubar@redhat.com&gt;</dc:contributor>
        <dc:source xmlns:dc="http://purl.org/dc/elements/1.1/">https://github.com/OpenSCAP/scap-security-guide/releases/latest</dc:source>
      </metadata>
  <model system="urn:xccdf:scoring:default"/>
  <Profile id="xccdf_org.ssgproject.content_profile_ospp">
    <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" override="true">OSPP - Protection Profile for General Purpose Operating Systems</title>
    <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" override="true">This profile reflects mandatory configuration controls identified in the
NIAP Configuration Annex to the Protection Profile for General Purpose
Operating Systems (Protection Profile Version 4.2).

As Fedora OS is moving target, this profile does not guarantee to provide
security levels required from US National Security Systems. Main goal of
the profile is to provide Fedora developers with hardened environment
similar to the one mandated by US National Security Systems.</description>
    <select idref="xccdf_org.ssgproject.content_rule_accounts_password_minlen_login_defs" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_accounts_password_pam_dcredit" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_accounts_password_pam_lcredit" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_accounts_password_pam_minlen" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_accounts_password_pam_ocredit" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_accounts_password_pam_retry" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_accounts_password_pam_ucredit" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_deny" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_deny_root" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_interval" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_unlock_time" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_accounts_tmout" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_chmod" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_chown" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fchmod" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fchmodat" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fchown" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fchownat" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fremovexattr" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fsetxattr" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_lchown" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_lremovexattr" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_lsetxattr" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_removexattr" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_setxattr" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_etc_group_open" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_etc_group_open_by_handle_at" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_etc_group_openat" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_etc_gshadow_open" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_etc_gshadow_open_by_handle_at" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_etc_gshadow_openat" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_etc_passwd_open" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_etc_passwd_open_by_handle_at" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_etc_passwd_openat" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_etc_shadow_open" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_etc_shadow_open_by_handle_at" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_etc_shadow_openat" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_execution_chcon" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_execution_restorecon" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_execution_semanage" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_execution_setsebool" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_execution_seunshare" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_file_deletion_events_rename" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_file_deletion_events_renameat" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_file_deletion_events_rmdir" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_file_deletion_events_unlink" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_file_deletion_events_unlinkat" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_immutable" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_kernel_module_loading_delete" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_kernel_module_loading_init" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_login_events_faillock" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_login_events_lastlog" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_login_events_tallylog" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_mac_modification" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_at" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_chage" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_chsh" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_crontab" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_gpasswd" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_mount" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_newgidmap" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_newgrp" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_newuidmap" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_passwd" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_pt_chown" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_ssh_keysign" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_su" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_sudo" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_sudoedit" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_umount" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_unix_chkpwd" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_userhelper" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_usernetctl" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_session_events" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_sysadmin_actions" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_chmod" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_chown" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_creat" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_fchmod" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_fchmodat" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_fchown" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_fchownat" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_fremovexattr" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_fsetxattr" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_ftruncate" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_lchown" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_lremovexattr" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_lsetxattr" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_open" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_open_by_handle_at" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creat" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_write" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_order" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_open_o_creat" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_open_o_trunc_write" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_open_rule_order" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_openat" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_openat_o_creat" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_openat_o_trunc_write" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_openat_rule_order" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_removexattr" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_rename" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_renameat" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_setxattr" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_truncate" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_unlink" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_unlinkat" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification_group" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification_gshadow" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification_opasswd" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification_passwd" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification_shadow" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_auditd_audispd_configure_remote_server" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_auditd_audispd_encrypt_sent_records" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_auditd_audispd_syslog_plugin_activated" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_auditd_freq" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_auditd_local_events" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_auditd_log_format" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_auditd_name_format" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_auditd_write_logs" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_banner_etc_issue" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_chronyd_client_only" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_chronyd_no_chronyc_network" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_configure_bind_crypto_policy" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_configure_crypto_policy" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_configure_kerberos_crypto_policy" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_configure_libreswan_crypto_policy" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_configure_openssl_crypto_policy" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_configure_ssh_crypto_policy" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_coredump_disable_backtraces" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_coredump_disable_storage" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_dconf_db_up_to_date" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_dconf_gnome_banner_enabled" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_dconf_gnome_login_banner_text" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_dconf_gnome_login_retries" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_idle_activation_enabled" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_idle_delay" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_lock_delay" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_lock_enabled" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_mode_blank" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_user_info" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_user_locks" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_dconf_gnome_session_idle_user_locks" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_directory_access_var_log_audit" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_disable_host_auth" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_dnf-automatic_apply_updates" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_dnf-automatic_security_updates_only" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_enable_fips_mode" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_ensure_fedora_gpgkey_installed" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_ensure_gpgcheck_globally_activated" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_ensure_gpgcheck_local_packages" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_ensure_gpgcheck_never_disabled" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_gnome_gdm_disable_automatic_login" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_gnome_gdm_disable_guest_login" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_grub2_audit_argument" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_grub2_audit_backlog_limit_argument" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_grub2_disable_interactive_boot" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_grub2_page_poison_argument" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_grub2_password" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_grub2_pti_argument" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_grub2_slub_debug_argument" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_grub2_uefi_password" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_grub2_vsyscall_argument" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_installed_OS_is_vendor_supported" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_kernel_module_atm_disabled" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_kernel_module_can_disabled" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_kernel_module_firewire-core_disabled" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_kernel_module_tipc_disabled" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_mount_option_dev_shm_nodev" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_mount_option_dev_shm_noexec" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_mount_option_dev_shm_nosuid" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_no_empty_passwords" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_package_abrt_removed" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_package_dnf-automatic_installed" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_package_fapolicyd_installed" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_package_screen_installed" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_package_sendmail_removed" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_require_singleuser_auth" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_rpm_verify_hashes" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_rsyslog_cron_logging" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_rsyslog_remote_loghost" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_selinux_all_devicefiles_labeled" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_selinux_confinement_of_daemons" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_selinux_policytype" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_selinux_state" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_service_auditd_enabled" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_service_debug-shell_disabled" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_service_firewalld_enabled" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_service_rngd_enabled" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_service_systemd-coredump_disabled" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_set_firewalld_default_zone" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_sshd_disable_empty_passwords" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_sshd_disable_gssapi_auth" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_sshd_disable_kerb_auth" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_sshd_disable_root_login" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_sshd_enable_warning_banner" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_sshd_rekey_limit" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_sssd_run_as_sssd_user" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_sysctl_kernel_core_pattern" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_sysctl_kernel_dmesg_restrict" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_sysctl_kernel_kexec_load_disabled" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_sysctl_kernel_kptr_restrict" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_sysctl_kernel_perf_event_paranoid" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_sysctl_kernel_unprivileged_bpf_disabled" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_sysctl_kernel_yama_ptrace_scope" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_sysctl_net_core_bpf_jit_harden" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_sysctl_user_max_user_namespaces" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_timer_dnf-automatic_enabled" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_group_remediation_functions" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_aide" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_endpoint_security_software" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_mcafee_security_software" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_mcafee_hbss_software" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_system-tools" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_sudo" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_gnome_network_settings" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_gnome_remote_access_settings" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_gnome_media_settings" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_gnome_system_settings" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_disk_partitioning" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_sap_host" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_password_quality_pamcracklib" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_set_password_hashing_algorithm" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_smart_card_login" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_root_logins" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_account_expiration" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_root_paths" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_user_umask" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_audit_time_rules" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_audit_execution_acl_commands" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_policy_rules" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_mounting" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_enable_nx" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_daemon_umask" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_files" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_permissions_within_important_dirs" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_permissions_var_log_dir" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_permissions_important_account_files" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_permissions_local" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_rsyslog_accepting_remote_messages" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_log_rotation" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_configure_logwatch_on_logserver" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_network-wireless" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_wireless_software" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_network_disable_unused_interfaces" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_network-susefirewall2" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_network-iptables" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_iptables_ruleset_modifications" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_iptables_icmp_disabled" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_iptables_log_and_drop_suspicious" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_iptables_activation" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_network-ipsec" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_network_ssl" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_network-kernel" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_network_host_parameters" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_network_host_and_router_parameters" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_network-ipv6" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_disabling_ipv6" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_configuring_ipv6" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_network_ipv6_limit_requests" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_selinux-booleans" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_entropy" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_bootloader-zipl" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_cron_and_at" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_restrict_at_cron_users" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_postfix_client" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_postfix_harden_os" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_postfix_configure_ssl_certs" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_postfix_install_ssl_cert" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_postfix_server_cfg" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_postfix_server_relay" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_postfix_server_relay_smtp_auth_for_untrusted" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_postfix_server_mail_smtpd_recipient_restrictions" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_postfix_server_relay_set_trusted" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_postfix_server_relay_require_tls" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_postfix_server_mail_smtpd_relay_restrictions" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_postfix_server_dos" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_snmp" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_disabling_snmp_service" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_snmp_configure_server" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_routing" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_disabling_quagga" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_proxy" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_disabling_squid" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_radius" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_apport" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_deprecated" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_docker" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_apt" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_nfs_and_rpc" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_nfs_configuring_all_machines" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_nfs_client_or_server_not_both" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_nfs_configure_fixed_ports" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_nfs_configuring_clients" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_disabling_nfsd" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_mounting_remote_filesystems" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_nfs_configuring_servers" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_export_filesystems_read_only" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_use_acl_enforce_auth_restrictions" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_configure_exports_restrictively" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_disabling_nfs" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_disabling_nfs_services" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_disabling_netfs" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_smb" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_configuring_samba" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_smb_disable_printing" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_smb_restrict_file_sharing" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_disabling_samba" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_http" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_disabling_httpd" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_installing_httpd" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_httpd_minimal_modules_installed" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_securing_httpd" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_httpd_configure_php_securely" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_httpd_configure_os_protect_web_server" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_httpd_restrict_file_dir_access" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_httpd_chroot" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_httpd_restrict_info_leakage" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_httpd_use_dos_protection_modules" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_httpd_minimize_loadable_modules" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_httpd_core_modules" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_httpd_optional_components" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_httpd_basic_authentication" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_httpd_minimize_config_files_included" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_httpd_modules_improve_security" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_httpd_deploy_mod_ssl" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_httpd_deploy_mod_security" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_httpd_directory_restrictions" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_httpd_secure_content" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_httpd_configure_perl_securely" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_xwindows" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_disabling_xwindows" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_kerberos" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_ftp" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_disabling_vsftpd" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_ftp_configure_vsftpd" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_ftp_restrict_users" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_ftp_use_vsftpd" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_imap" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_configure_dovecot" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_dovecot_support_necessary_protocols" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_dovecot_enabling_ssl" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_dovecot_allow_imap_access" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_disabling_dovecot" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_avahi" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_avahi_configuration" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_disable_avahi_group" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_ldap" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_openldap_server" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_ldap_server_config_certificate_files" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_openldap_client" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_printing" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_configure_printing" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_dhcp" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_disabling_dhcp_server" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_disabling_dhcp_client" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_dhcp_client_configuration" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_dhcp_server_configuration" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_obsolete" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_telnet" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_tftp" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_r_services" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_inetd_and_xinetd" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_talk" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_nis" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_dns" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_dns_server_protection" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_dns_server_separate_internal_external" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_dns_server_partition_with_views" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_disabling_dns_server" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_dns_server_isolation" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_dns_server_dedicated" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_dns_server_chroot" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_sssd-ldap" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_usbguard" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_ssh_client" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_sshd_strengthen_firewall" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_intro" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_how-to-use" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_intro-read-sections-completely" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_intro-test-non-production" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_intro-reboot-required" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_intro-formatting-conventions" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_intro-root-shell-assumed" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_general-principles" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_principle-minimize-software" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_principle-encrypt-transmitted-data" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_principle-separate-servers" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_principle-least-privilege" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_principle-use-security-tools" selected="false"/>
    <refine-value idref="xccdf_org.ssgproject.content_value_var_system_crypto_policy" selector="fips"/>
    <refine-value idref="xccdf_org.ssgproject.content_value_var_selinux_policy_name" selector="targeted"/>
    <refine-value idref="xccdf_org.ssgproject.content_value_var_selinux_state" selector="enforcing"/>
    <refine-value idref="xccdf_org.ssgproject.content_value_var_password_pam_minlen" selector="12"/>
    <refine-value idref="xccdf_org.ssgproject.content_value_var_password_pam_ocredit" selector="1"/>
    <refine-value idref="xccdf_org.ssgproject.content_value_var_password_pam_dcredit" selector="1"/>
    <refine-value idref="xccdf_org.ssgproject.content_value_var_password_pam_ucredit" selector="1"/>
    <refine-value idref="xccdf_org.ssgproject.content_value_var_password_pam_lcredit" selector="1"/>
    <refine-value idref="xccdf_org.ssgproject.content_value_var_accounts_tmout" selector="10_min"/>
    <refine-value idref="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_deny" selector="3"/>
    <refine-value idref="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_fail_interval" selector="900"/>
    <refine-value idref="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_unlock_time" selector="never"/>
    <refine-value idref="xccdf_org.ssgproject.content_value_var_password_pam_retry" selector="3"/>
    <refine-value idref="xccdf_org.ssgproject.content_value_login_banner_text" selector="usgcb_default"/>
  </Profile>
  <Profile id="xccdf_org.ssgproject.content_profile_pci-dss">
    <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" override="true">PCI-DSS v3.2.1 Control Baseline for Fedora</title>
    <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" override="true">Ensures PCI-DSS v3.2.1 related security configuration settings are applied.</description>
    <select idref="xccdf_org.ssgproject.content_rule_account_disable_post_pw_expiration" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_account_unique_name" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_accounts_maximum_age_login_defs" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_accounts_password_all_shadowed" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_accounts_password_pam_dcredit" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_accounts_password_pam_lcredit" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_accounts_password_pam_minlen" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_accounts_password_pam_ucredit" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_accounts_password_pam_unix_remember" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_deny" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_unlock_time" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_aide_build_database" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_aide_periodic_cron_checking" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_chmod" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_chown" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fchmod" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fchmodat" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fchown" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fchownat" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fremovexattr" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fsetxattr" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_lchown" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_lremovexattr" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_lsetxattr" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_removexattr" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_setxattr" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_file_deletion_events_rename" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_file_deletion_events_renameat" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_file_deletion_events_rmdir" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_file_deletion_events_unlink" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_file_deletion_events_unlinkat" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_immutable" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_kernel_module_loading_delete" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_kernel_module_loading_finit" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_kernel_module_loading_init" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_login_events" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_mac_modification" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_media_export" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_networkconfig_modification" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_session_events" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_sysadmin_actions" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_time_adjtimex" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_time_clock_settime" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_time_settimeofday" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_time_stime" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_time_watch_localtime" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_creat" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_ftruncate" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_open" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_open_by_handle_at" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_openat" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_truncate" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification_group" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification_gshadow" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification_opasswd" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification_passwd" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification_shadow" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_auditd_audispd_syslog_plugin_activated" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_auditd_data_retention_action_mail_acct" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_auditd_data_retention_admin_space_left_action" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_auditd_data_retention_max_log_file" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_auditd_data_retention_max_log_file_action" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_auditd_data_retention_num_logs" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_auditd_data_retention_space_left_action" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_chronyd_or_ntpd_specify_multiple_servers" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_chronyd_or_ntpd_specify_remote_server" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_configure_bind_crypto_policy" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_configure_crypto_policy" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_configure_kerberos_crypto_policy" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_configure_libreswan_crypto_policy" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_configure_opensc_card_drivers" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_configure_openssl_crypto_policy" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_configure_ssh_crypto_policy" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_dconf_db_up_to_date" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_idle_activation_enabled" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_idle_delay" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_lock_enabled" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_mode_blank" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_display_login_attempts" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_ensure_fedora_gpgkey_installed" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_ensure_gpgcheck_globally_activated" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_ensure_gpgcheck_never_disabled" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_ensure_logrotate_activated" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_groupowner_etc_group" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_groupowner_etc_passwd" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_groupowner_etc_shadow" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_groupowner_grub2_cfg" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_owner_etc_group" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_owner_etc_passwd" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_owner_etc_shadow" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_owner_grub2_cfg" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_ownership_var_log_audit" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_permissions_etc_group" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_permissions_etc_passwd" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_permissions_etc_shadow" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_permissions_var_log_audit" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_force_opensc_card_drivers" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_gid_passwd_group_same" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_grub2_audit_argument" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_install_hids" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_no_empty_passwords" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_package_aide_installed" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_package_audispd-plugins_installed" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_package_libreswan_installed" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_package_opensc_installed" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_package_pcsc-lite_installed" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_rpm_verify_hashes" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_rpm_verify_permissions" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_rsyslog_files_groupownership" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_rsyslog_files_ownership" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_rsyslog_files_permissions" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_security_patches_up_to_date" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_service_auditd_enabled" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_service_chronyd_or_ntpd_enabled" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_service_pcscd_enabled" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_set_password_hashing_algorithm_libuserconf" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_set_password_hashing_algorithm_logindefs" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_set_password_hashing_algorithm_systemauth" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_sshd_set_idle_timeout" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_sshd_set_keepalive" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_sssd_enable_smartcards" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_group_remediation_functions" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_fips" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_mcafee_security_software" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_mcafee_hbss_software" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_certified-vendor" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_system-tools" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_sudo" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_gnome_network_settings" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_gnome_remote_access_settings" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_gnome_media_settings" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_gnome_system_settings" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_gnome_login_screen" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_disk_partitioning" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_sap_host" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_accounts-banners" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_gui_login_banner" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_password_quality_pamcracklib" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_console_screen_locking" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_root_logins" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_accounts-session" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_root_paths" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_user_umask" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_audit_execution_acl_commands" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_audit_execution_selinux_commands" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_policy_rules" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_mounting" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_restrictions" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_poisoning" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_enable_nx" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_coredumps" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_enable_execshield_settings" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_daemon_umask" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_permissions_within_important_dirs" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_permissions_var_log_dir" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_permissions_local" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_partitions" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_rsyslog_accepting_remote_messages" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_rsyslog_sending_messages" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_configure_logwatch_on_logserver" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_network-uncommon" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_network-wireless" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_wireless_software" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_network_disable_unused_interfaces" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_network-susefirewall2" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_network-iptables" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_iptables_ruleset_modifications" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_iptables_icmp_disabled" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_iptables_log_and_drop_suspicious" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_iptables_activation" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_network-firewalld" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_firewalld_activation" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_ruleset_modifications" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_network_ssl" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_network-kernel" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_network_host_parameters" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_network_host_and_router_parameters" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_network-ipv6" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_disabling_ipv6" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_configuring_ipv6" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_network_ipv6_limit_requests" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_selinux" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_selinux-booleans" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_entropy" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_uefi" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_bootloader-zipl" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_cron_and_at" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_restrict_at_cron_users" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_mail" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_postfix_client" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_postfix_harden_os" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_postfix_configure_ssl_certs" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_postfix_install_ssl_cert" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_postfix_server_cfg" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_postfix_server_relay" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_postfix_server_relay_smtp_auth_for_untrusted" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_postfix_server_mail_smtpd_recipient_restrictions" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_postfix_server_relay_set_trusted" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_postfix_server_relay_require_tls" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_postfix_server_mail_smtpd_relay_restrictions" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_postfix_server_dos" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_snmp" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_disabling_snmp_service" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_snmp_configure_server" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_routing" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_disabling_quagga" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_proxy" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_disabling_squid" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_radius" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_apport" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_deprecated" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_docker" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_apt" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_fapolicyd" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_nfs_and_rpc" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_nfs_configuring_all_machines" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_nfs_client_or_server_not_both" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_nfs_configure_fixed_ports" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_nfs_configuring_clients" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_disabling_nfsd" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_mounting_remote_filesystems" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_nfs_configuring_servers" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_export_filesystems_read_only" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_use_acl_enforce_auth_restrictions" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_configure_exports_restrictively" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_disabling_nfs" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_disabling_nfs_services" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_disabling_netfs" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_smb" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_configuring_samba" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_smb_disable_printing" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_smb_restrict_file_sharing" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_disabling_samba" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_http" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_disabling_httpd" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_installing_httpd" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_httpd_minimal_modules_installed" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_securing_httpd" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_httpd_configure_php_securely" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_httpd_configure_os_protect_web_server" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_httpd_restrict_file_dir_access" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_httpd_chroot" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_httpd_restrict_info_leakage" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_httpd_use_dos_protection_modules" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_httpd_minimize_loadable_modules" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_httpd_core_modules" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_httpd_optional_components" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_httpd_basic_authentication" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_httpd_minimize_config_files_included" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_httpd_modules_improve_security" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_httpd_deploy_mod_ssl" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_httpd_deploy_mod_security" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_httpd_directory_restrictions" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_httpd_secure_content" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_httpd_configure_perl_securely" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_xwindows" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_disabling_xwindows" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_kerberos" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_ftp" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_disabling_vsftpd" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_ftp_configure_vsftpd" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_ftp_restrict_users" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_ftp_use_vsftpd" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_imap" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_configure_dovecot" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_dovecot_support_necessary_protocols" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_dovecot_enabling_ssl" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_dovecot_allow_imap_access" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_disabling_dovecot" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_avahi" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_avahi_configuration" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_disable_avahi_group" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_ldap" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_openldap_server" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_ldap_server_config_certificate_files" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_openldap_client" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_printing" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_configure_printing" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_dhcp" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_disabling_dhcp_server" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_disabling_dhcp_client" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_dhcp_client_configuration" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_dhcp_server_configuration" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_obsolete" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_telnet" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_tftp" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_r_services" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_inetd_and_xinetd" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_talk" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_nis" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_dns" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_dns_server_protection" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_dns_server_separate_internal_external" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_dns_server_partition_with_views" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_disabling_dns_server" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_dns_server_isolation" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_dns_server_dedicated" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_dns_server_chroot" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_rng" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_sssd-ldap" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_usbguard" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_ssh_client" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_sshd_strengthen_firewall" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_base" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_intro" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_how-to-use" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_intro-read-sections-completely" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_intro-test-non-production" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_intro-reboot-required" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_intro-formatting-conventions" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_intro-root-shell-assumed" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_general-principles" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_principle-minimize-software" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_principle-encrypt-transmitted-data" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_principle-separate-servers" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_principle-least-privilege" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_principle-use-security-tools" selected="false"/>
    <refine-value idref="xccdf_org.ssgproject.content_value_var_password_pam_unix_remember" selector="4"/>
    <refine-value idref="xccdf_org.ssgproject.content_value_var_account_disable_post_pw_expiration" selector="90"/>
    <refine-value idref="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_deny" selector="6"/>
    <refine-value idref="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_unlock_time" selector="1800"/>
    <refine-value idref="xccdf_org.ssgproject.content_value_sshd_idle_timeout_value" selector="15_minutes"/>
    <refine-value idref="xccdf_org.ssgproject.content_value_var_password_pam_minlen" selector="7"/>
    <refine-value idref="xccdf_org.ssgproject.content_value_var_password_pam_minclass" selector="2"/>
    <refine-value idref="xccdf_org.ssgproject.content_value_var_accounts_maximum_age_login_defs" selector="90"/>
    <refine-value idref="xccdf_org.ssgproject.content_value_var_auditd_num_logs" selector="5"/>
    <refine-value idref="xccdf_org.ssgproject.content_value_var_multiple_time_servers" selector="rhel"/>
    <refine-value idref="xccdf_org.ssgproject.content_value_var_sshd_set_keepalive" selector="1"/>
    <refine-value idref="xccdf_org.ssgproject.content_value_var_smartcard_drivers" selector="cac"/>
  </Profile>
  <Profile id="xccdf_org.ssgproject.content_profile_standard">
    <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" override="true">Standard System Security Profile for Fedora</title>
    <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" override="true">This profile contains rules to ensure standard security baseline of a Fedora system.
Regardless of your system's workload all of these checks should pass.</description>
    <select idref="xccdf_org.ssgproject.content_rule_account_unique_name" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_accounts_maximum_age_login_defs" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_accounts_minimum_age_login_defs" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_accounts_no_uid_except_zero" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_accounts_password_all_shadowed" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_accounts_password_minlen_login_defs" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_accounts_password_warn_age_login_defs" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_accounts_root_path_dirs_no_write" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_aide_build_database" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_chmod" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_chown" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fchmod" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fchmodat" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fchown" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fchownat" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fremovexattr" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fsetxattr" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_lchown" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_lremovexattr" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_lsetxattr" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_removexattr" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_setxattr" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_file_deletion_events" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_immutable" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_kernel_module_loading" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_login_events" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_mac_modification" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_media_export" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_networkconfig_modification" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_session_events" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_sysadmin_actions" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_time_adjtimex" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_time_clock_settime" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_time_settimeofday" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_time_stime" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_time_watch_localtime" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_auditd_audispd_syslog_plugin_activated" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_auditd_data_retention_action_mail_acct" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_auditd_data_retention_admin_space_left_action" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_auditd_data_retention_max_log_file" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_auditd_data_retention_max_log_file_action" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_auditd_data_retention_num_logs" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_auditd_data_retention_space_left_action" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_chronyd_or_ntpd_specify_remote_server" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_configure_bind_crypto_policy" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_configure_crypto_policy" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_configure_kerberos_crypto_policy" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_configure_libreswan_crypto_policy" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_configure_openssl_crypto_policy" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_configure_ssh_crypto_policy" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_display_login_attempts" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_ensure_gpgcheck_globally_activated" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_ensure_gpgcheck_never_disabled" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_ownership_binary_dirs" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_ownership_library_dirs" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_ownership_var_log_audit" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_permissions_binary_dirs" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_permissions_library_dirs" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_gid_passwd_group_same" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_grub2_audit_argument" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_grub2_nousb_argument" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_no_direct_root_logins" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_no_empty_passwords" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_no_netrc_files" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_restrict_serial_port_logins" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_rpm_verify_hashes" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_rpm_verify_permissions" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_securetty_root_login_console_only" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_service_auditd_enabled" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_service_chronyd_or_ntpd_enabled" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_service_firewalld_enabled" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_set_firewalld_default_zone" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_sshd_disable_empty_passwords" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_sshd_disable_root_login" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_sshd_set_idle_timeout" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_sshd_set_keepalive" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_group_remediation_functions" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_fips" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_endpoint_security_software" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_mcafee_security_software" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_mcafee_hbss_software" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_certified-vendor" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_system-tools" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_sudo" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_gnome" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_gnome_network_settings" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_gnome_remote_access_settings" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_gnome_media_settings" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_gnome_system_settings" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_gnome_screen_locking" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_gnome_login_screen" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_disk_partitioning" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_sap_host" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_accounts-banners" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_gui_login_banner" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_locking_out_password_attempts" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_password_quality" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_password_quality_pwquality" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_password_quality_pamcracklib" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_set_password_hashing_algorithm" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_accounts-physical" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_screen_locking" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_smart_card_login" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_console_screen_locking" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_user_umask" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_audit_execution_acl_commands" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_audit_execution_selinux_commands" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_policy_rules" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_restrictions" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_poisoning" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_enable_nx" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_coredumps" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_enable_execshield_settings" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_daemon_umask" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_permissions_var_log_dir" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_permissions_important_account_files" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_permissions_local" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_partitions" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_logging" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_rsyslog_accepting_remote_messages" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_log_rotation" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_rsyslog_sending_messages" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_ensure_rsyslog_log_file_configuration" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_configure_logwatch_on_logserver" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_network-uncommon" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_network-wireless" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_wireless_software" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_network_disable_unused_interfaces" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_network-susefirewall2" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_network-iptables" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_iptables_ruleset_modifications" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_iptables_icmp_disabled" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_iptables_log_and_drop_suspicious" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_iptables_activation" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_network-ipsec" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_network_ssl" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_network-kernel" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_network_host_parameters" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_network_host_and_router_parameters" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_network-ipv6" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_disabling_ipv6" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_configuring_ipv6" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_network_ipv6_limit_requests" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_selinux" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_selinux-booleans" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_entropy" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_bootloader-grub2" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_uefi" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_non-uefi" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_bootloader-zipl" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_cron_and_at" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_restrict_at_cron_users" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_mail" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_postfix_client" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_postfix_harden_os" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_postfix_configure_ssl_certs" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_postfix_install_ssl_cert" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_postfix_server_cfg" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_postfix_server_relay" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_postfix_server_relay_smtp_auth_for_untrusted" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_postfix_server_mail_smtpd_recipient_restrictions" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_postfix_server_relay_set_trusted" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_postfix_server_relay_require_tls" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_postfix_server_mail_smtpd_relay_restrictions" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_postfix_server_dos" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_snmp" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_disabling_snmp_service" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_snmp_configure_server" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_routing" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_disabling_quagga" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_proxy" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_disabling_squid" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_radius" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_apport" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_deprecated" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_docker" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_apt" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_fapolicyd" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_nfs_and_rpc" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_nfs_configuring_all_machines" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_nfs_client_or_server_not_both" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_nfs_configure_fixed_ports" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_nfs_configuring_clients" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_disabling_nfsd" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_mounting_remote_filesystems" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_nfs_configuring_servers" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_export_filesystems_read_only" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_use_acl_enforce_auth_restrictions" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_configure_exports_restrictively" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_disabling_nfs" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_disabling_nfs_services" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_disabling_netfs" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_smb" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_configuring_samba" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_smb_disable_printing" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_smb_restrict_file_sharing" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_disabling_samba" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_http" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_disabling_httpd" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_installing_httpd" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_httpd_minimal_modules_installed" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_securing_httpd" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_httpd_configure_php_securely" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_httpd_configure_os_protect_web_server" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_httpd_restrict_file_dir_access" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_httpd_chroot" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_httpd_restrict_info_leakage" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_httpd_use_dos_protection_modules" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_httpd_minimize_loadable_modules" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_httpd_core_modules" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_httpd_optional_components" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_httpd_basic_authentication" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_httpd_minimize_config_files_included" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_httpd_modules_improve_security" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_httpd_deploy_mod_ssl" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_httpd_deploy_mod_security" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_httpd_directory_restrictions" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_httpd_secure_content" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_httpd_configure_perl_securely" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_xwindows" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_disabling_xwindows" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_kerberos" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_ftp" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_disabling_vsftpd" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_ftp_configure_vsftpd" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_ftp_restrict_users" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_ftp_use_vsftpd" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_imap" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_configure_dovecot" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_dovecot_support_necessary_protocols" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_dovecot_enabling_ssl" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_dovecot_allow_imap_access" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_disabling_dovecot" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_avahi" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_avahi_configuration" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_disable_avahi_group" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_ldap" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_openldap_server" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_ldap_server_config_certificate_files" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_openldap_client" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_printing" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_configure_printing" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_dhcp" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_disabling_dhcp_server" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_disabling_dhcp_client" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_dhcp_client_configuration" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_dhcp_server_configuration" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_obsolete" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_telnet" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_tftp" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_r_services" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_inetd_and_xinetd" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_talk" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_nis" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_dns" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_dns_server_protection" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_dns_server_separate_internal_external" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_dns_server_partition_with_views" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_disabling_dns_server" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_dns_server_isolation" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_dns_server_dedicated" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_dns_server_chroot" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_rng" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_sssd" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_sssd-ldap" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_usbguard" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_ssh_client" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_sshd_strengthen_firewall" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_base" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_intro" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_how-to-use" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_intro-read-sections-completely" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_intro-test-non-production" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_intro-reboot-required" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_intro-formatting-conventions" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_intro-root-shell-assumed" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_general-principles" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_principle-minimize-software" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_principle-encrypt-transmitted-data" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_principle-separate-servers" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_principle-least-privilege" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_principle-use-security-tools" selected="false"/>
    <refine-value idref="xccdf_org.ssgproject.content_value_var_accounts_password_minlen_login_defs" selector="12"/>
    <refine-value idref="xccdf_org.ssgproject.content_value_var_accounts_minimum_age_login_defs" selector="7"/>
    <refine-value idref="xccdf_org.ssgproject.content_value_var_accounts_maximum_age_login_defs" selector="90"/>
    <refine-value idref="xccdf_org.ssgproject.content_value_var_accounts_password_warn_age_login_defs" selector="7"/>
    <refine-value idref="xccdf_org.ssgproject.content_value_var_auditd_num_logs" selector="5"/>
    <refine-value idref="xccdf_org.ssgproject.content_value_sshd_idle_timeout_value" selector="5_minutes"/>
    <refine-value idref="xccdf_org.ssgproject.content_value_var_sshd_set_keepalive" selector="1"/>
  </Profile>
  <Group id="xccdf_org.ssgproject.content_group_remediation_functions">
    <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Remediation functions used by the SCAP Security Guide Project</title>
    <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">XCCDF form of the various remediation functions as used by remediation scripts from the SCAP Security Guide Project.</description>
    <Value id="xccdf_org.ssgproject.content_value_function_create_audit_remediation_unsuccessful_file_modification_detailed" hidden="true" prohibitChanges="true" operator="equals" type="string">
      <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Remediation function create_audit_remediation_unsuccessful_file_modification_detailed</title>
      <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Shared bash remediation function. Not intended to be changed by tailoring.</description>
      <value>function create_audit_remediation_unsuccessful_file_modification_detailed {
	mkdir -p "$(dirname "$1")"
	# The - option to mark a here document limit string (&lt;&lt;-EOF) suppresses leading tabs (but not spaces) in the output.
	cat &lt;&lt;-EOF &gt; "$1"
		## This content is a section of an Audit config snapshot recommended for linux systems that target OSPP compliance.
		## The following content has been retreived on 2019-03-11 from: https://github.com/linux-audit/audit-userspace/blob/master/rules/30-ospp-v42.rules

		## The purpose of these rules is to meet the requirements for Operating
		## System Protection Profile (OSPP)v4.2. These rules depends on having
		## 10-base-config.rules, 11-loginuid.rules, and 43-module-load.rules installed.

		## Unsuccessful file creation (open with O_CREAT)
		-a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&amp;0100 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
		-a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&amp;0100 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
		-a always,exit -F arch=b32 -S open -F a1&amp;0100 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
		-a always,exit -F arch=b64 -S open -F a1&amp;0100 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
		-a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&amp;0100 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
		-a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&amp;0100 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
		-a always,exit -F arch=b32 -S open -F a1&amp;0100 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
		-a always,exit -F arch=b64 -S open -F a1&amp;0100 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
		-a always,exit -F arch=b32 -S creat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
		-a always,exit -F arch=b64 -S creat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
		-a always,exit -F arch=b32 -S creat -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
		-a always,exit -F arch=b64 -S creat -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create

		## Unsuccessful file modifications (open for write or truncate)
		-a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&amp;01003 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
		-a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&amp;01003 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
		-a always,exit -F arch=b32 -S open -F a1&amp;01003 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
		-a always,exit -F arch=b64 -S open -F a1&amp;01003 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
		-a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&amp;01003 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
		-a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&amp;01003 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
		-a always,exit -F arch=b32 -S open -F a1&amp;01003 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
		-a always,exit -F arch=b64 -S open -F a1&amp;01003 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
		-a always,exit -F arch=b32 -S truncate,ftruncate -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
		-a always,exit -F arch=b64 -S truncate,ftruncate -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
		-a always,exit -F arch=b32 -S truncate,ftruncate -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
		-a always,exit -F arch=b64 -S truncate,ftruncate -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification

		## Unsuccessful file access (any other opens) This has to go last.
		-a always,exit -F arch=b32 -S open,creat,truncate,ftruncate,openat,open_by_handle_at -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-access
		-a always,exit -F arch=b64 -S open,creat,truncate,ftruncate,openat,open_by_handle_at -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-access
		-a always,exit -F arch=b32 -S open,creat,truncate,ftruncate,openat,open_by_handle_at -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-access
		-a always,exit -F arch=b64 -S open,creat,truncate,ftruncate,openat,open_by_handle_at -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-access
	EOF
}</value>
    </Value>
    <Value id="xccdf_org.ssgproject.content_value_function_die" hidden="true" prohibitChanges="true" operator="equals" type="string">
      <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Remediation function die</title>
      <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Shared bash remediation function. Not intended to be changed by tailoring.</description>
      <value># Print a message to stderr and exit the shell
# $1: The message to print.
# $2: The error code (optional, default is 1)
function die {
	local _message="$1" _rc="${2:-1}"
	printf '%s\n' "$_message" &gt;&amp;2
	exit "$_rc"
}</value>
    </Value>
    <Value id="xccdf_org.ssgproject.content_value_function_ensure_pam_module_options" hidden="true" prohibitChanges="true" operator="equals" type="string">
      <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Remediation function ensure_pam_module_options</title>
      <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Shared bash remediation function. Not intended to be changed by tailoring.</description>
      <value>function ensure_pam_module_options {
	if [ $# -lt 7 ] || [ $# -gt 8 ] ; then
                echo "$0 requires seven or eight arguments" &gt;&amp;2
                exit 1
        fi
	local _pamFile="$1" _type="$2" _control="$3" _module="$4" _option="$5" _valueRegex="$6" _defaultValue="$7"
	local _remove_argument=""
	if [ $# -eq 8 ] ; then
        	_remove_argument="$8"
		# convert it to lowercase
		_remove_argument=${_remove_argument,,}
	fi

	# make sure that we have a line like this in ${_pamFile} (additional options are left as-is):
	# ${_type} ${_control} ${_module} ${_option}=${_valueRegex}

	if ! [ -e "$_pamFile" ] ; then
		echo "$_pamFile doesn't exist" &gt;&amp;2
		exit 1
	fi

	# if remove argument only
	if [ "${_remove_argument}" = "yes" -o "${_remove_argument}" = "true" ] ; then
		sed --follow-symlinks -i -E -e "s/^(\\s*${_type}\\s+\\S+\\s+${_module}(\\s.+)?)\\s${_option}(=\\S+)?/\\1/" "${_pamFile}"
		exit 0
	fi

	# non-empty values need to be preceded by an equals sign
	[ -n "${_valueRegex}" ] &amp;&amp; _valueRegex="=${_valueRegex}"
	# add an equals sign to non-empty values
	[ -n "${_defaultValue}" ] &amp;&amp; _defaultValue="=${_defaultValue}"

	# fix 'type' if it's wrong
	if grep -q -P "^\\s*(?"'!'"${_type}\\s)[[:alnum:]]+\\s+[[:alnum:]]+\\s+${_module}" &lt; "${_pamFile}" ; then
		sed --follow-symlinks -i -E -e "s/^(\\s*)[[:alnum:]]+(\\s+[[:alnum:]]+\\s+${_module})/\\1${_type}\\2/" "${_pamFile}"
	fi

	# fix 'control' if it's wrong
	if grep -q -P "^\\s*${_type}\\s+(?"'!'"${_control})[[:alnum:]]+\\s+${_module}" &lt; "${_pamFile}" ; then
		sed --follow-symlinks -i -E -e "s/^(\\s*${_type}\\s+)[[:alnum:]]+(\\s+${_module})/\\1${_control}\\2/" "${_pamFile}"
	fi

	# fix the value for 'option' if one exists but does not match '_valueRegex'
    if grep -q -P "^\\s*${_type}\\s+${_control}\\s+${_module}(\\s.+)?\\s+${_option}(?"'!'"${_valueRegex}(\\s|\$))" &lt; "${_pamFile}" ; then
		sed --follow-symlinks -i -E -e "s/^(\\s*${_type}\\s+${_control}\\s+${_module}(\\s.+)?\\s)${_option}=[^[:space:]]+/\\1${_option}${_defaultValue}/" "${_pamFile}"

    # add 'option=default' if option is not set
	elif grep -q -E "^\\s*${_type}\\s+${_control}\\s+${_module}" &lt; "${_pamFile}" &amp;&amp;
         grep    -E "^\\s*${_type}\\s+${_control}\\s+${_module}" &lt; "${_pamFile}" | grep -q -E -v "\\s${_option}(=|\\s|\$)" ; then

		sed --follow-symlinks -i -E -e "s/^(\\s*${_type}\\s+${_control}\\s+${_module}[^\\n]*)/\\1 ${_option}${_defaultValue}/" "${_pamFile}"
	# add a new entry if none exists
	elif ! grep -q -P "^\\s*${_type}\\s+${_control}\\s+${_module}(\\s.+)?\\s+${_option}${_valueRegex}(\\s|\$)" &lt; "${_pamFile}" ; then
		echo "${_type} ${_control} ${_module} ${_option}${_defaultValue}" &gt;&gt; "${_pamFile}"
	fi
}</value>
    </Value>
    <Value id="xccdf_org.ssgproject.content_value_function_fix_audit_syscall_rule" hidden="true" prohibitChanges="true" operator="equals" type="string">
      <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Remediation function fix_audit_syscall_rule</title>
      <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Shared bash remediation function. Not intended to be changed by tailoring.</description>
      <value># Function to fix syscall audit rule for given system call. It is
# based on example audit syscall rule definitions as outlined in
# /usr/share/doc/audit-2.3.7/stig.rules file provided with the audit
# package. It will combine multiple system calls belonging to the same
# syscall group into one audit rule (rather than to create audit rule per
# different system call) to avoid audit infrastructure performance penalty
# in the case of 'one-audit-rule-definition-per-one-system-call'. See:
#
#   https://www.redhat.com/archives/linux-audit/2014-November/msg00009.html
#
# for further details.
#
# Expects five arguments (each of them is required) in the form of:
# * audit tool				tool used to load audit rules,
# 					either 'auditctl', or 'augenrules
# * audit rules' pattern		audit rule skeleton for same syscall
# * syscall group			greatest common string this rule shares
# 					with other rules from the same group
# * architecture			architecture this rule is intended for
# * full form of new rule to add	expected full form of audit rule as to be
# 					added into audit.rules file
#
# Note: The 2-th up to 4-th arguments are used to determine how many existing
# audit rules will be inspected for resemblance with the new audit rule
# (5-th argument) the function is going to add. The rule's similarity check
# is performed to optimize audit.rules definition (merge syscalls of the same
# group into one rule) to avoid the "single-syscall-per-audit-rule" performance
# penalty.
#
# Example call:
#
#	See e.g. 'audit_rules_file_deletion_events.sh' remediation script
#
function fix_audit_syscall_rule {

# Load function arguments into local variables
local tool="$1"
local pattern="$2"
local group="$3"
local arch="$4"
local full_rule="$5"

# Check sanity of the input
if [ $# -ne "5" ]
then
	echo "Usage: fix_audit_syscall_rule 'tool' 'pattern' 'group' 'arch' 'full rule'"
	echo "Aborting."
	exit 1
fi

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
# 
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
declare -a files_to_inspect

retval=0

# First check sanity of the specified audit tool
if [ "$tool" != 'auditctl' ] &amp;&amp; [ "$tool" != 'augenrules' ]
then
	echo "Unknown audit rules loading tool: $1. Aborting."
	echo "Use either 'auditctl' or 'augenrules'!"
	return 1
# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
elif [ "$tool" == 'auditctl' ]
then
	files_to_inspect+=('/etc/audit/audit.rules' )
# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
elif [ "$tool" == 'augenrules' ]
then
	# Extract audit $key from audit rule so we can use it later
	matches=()
	key=$(expr "$full_rule" : '.*-k[[:space:]]\([^[:space:]]\+\)' '|' "$full_rule" : '.*-F[[:space:]]key=\([^[:space:]]\+\)')
	readarray -t matches &lt; &lt;(sed -s -n -e "\;${pattern};!d" -e "/${arch}/!d" -e "/${group}/!d;F" /etc/audit/rules.d/*.rules)
	if [ $? -ne 0 ]
	then
		retval=1
	fi
	for match in "${matches[@]}"
	do
		files_to_inspect+=("${match}")
	done
	# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
	if [ ${#files_to_inspect[@]} -eq "0" ]
	then
		file_to_inspect="/etc/audit/rules.d/$key.rules"
		files_to_inspect=("$file_to_inspect")
		if [ ! -e "$file_to_inspect" ]
		then
			touch "$file_to_inspect"
			chmod 0640 "$file_to_inspect"
		fi
	fi
fi

#
# Indicator that we want to append $full_rule into $audit_file by default
local append_expected_rule=0

for audit_file in "${files_to_inspect[@]}"
do
	# Filter existing $audit_file rules' definitions to select those that:
	# * follow the rule pattern, and
	# * meet the hardware architecture requirement, and
	# * are current syscall group specific
	readarray -t existing_rules &lt; &lt;(sed -e "\;${pattern};!d" -e "/${arch}/!d" -e "/${group}/!d"  "$audit_file")
	if [ $? -ne 0 ]
	then
		retval=1
	fi

	# Process rules found case-by-case
	for rule in "${existing_rules[@]}"
	do
		# Found rule is for same arch &amp; key, but differs (e.g. in count of -S arguments)
		if [ "${rule}" != "${full_rule}" ]
		then
			# If so, isolate just '(-S \w)+' substring of that rule
			rule_syscalls=$(echo "$rule" | grep -o -P '(-S \w+ )+')
			# Check if list of '-S syscall' arguments of that rule is subset
			# of '-S syscall' list of expected $full_rule
			if grep -q -- "$rule_syscalls" &lt;&lt;&lt; "$full_rule"
			then
				# Rule is covered (i.e. the list of -S syscalls for this rule is
				# subset of -S syscalls of $full_rule =&gt; existing rule can be deleted
				# Thus delete the rule from audit.rules &amp; our array
				sed -i -e "\;${rule};d" "$audit_file"
				if [ $? -ne 0 ]
				then
					retval=1
				fi
				existing_rules=("${existing_rules[@]//$rule/}")
			else
				# Rule isn't covered by $full_rule - it besides -S syscall arguments
				# for this group contains also -S syscall arguments for other syscall
				# group. Example: '-S lchown -S fchmod -S fchownat' =&gt; group='chown'
				# since 'lchown' &amp; 'fchownat' share 'chown' substring
				# Therefore:
				# * 1) delete the original rule from audit.rules
				# (original '-S lchown -S fchmod -S fchownat' rule would be deleted)
				# * 2) delete the -S syscall arguments for this syscall group, but
				# keep those not belonging to this syscall group
				# (original '-S lchown -S fchmod -S fchownat' would become '-S fchmod'
				# * 3) append the modified (filtered) rule again into audit.rules
				# if the same rule not already present
				#
				# 1) Delete the original rule
				sed -i -e "\;${rule};d" "$audit_file"
				if [ $? -ne 0 ]
				then
					retval=1
				fi

				# 2) Delete syscalls for this group, but keep those from other groups
				# Convert current rule syscall's string into array splitting by '-S' delimiter
				IFS_BKP="$IFS"
				IFS=$'-S'
				read -a rule_syscalls_as_array &lt;&lt;&lt; "$rule_syscalls"
				# Reset IFS back to default
				IFS="$IFS_BKP"
				# Splitting by "-S" can't be replaced by the readarray functionality easily

				# Declare new empty string to hold '-S syscall' arguments from other groups
				new_syscalls_for_rule=''
				# Walk through existing '-S syscall' arguments
				for syscall_arg in "${rule_syscalls_as_array[@]}"
				do
					# Skip empty $syscall_arg values
					if [ "$syscall_arg" == '' ]
					then
						continue
					fi
					# If the '-S syscall' doesn't belong to current group add it to the new list
					# (together with adding '-S' delimiter back for each of such item found)
					if grep -q -v -- "$group" &lt;&lt;&lt; "$syscall_arg"
					then
						new_syscalls_for_rule="$new_syscalls_for_rule -S $syscall_arg"
					fi
				done
				# Replace original '-S syscall' list with the new one for this rule
				updated_rule=${rule//$rule_syscalls/$new_syscalls_for_rule}
				# Squeeze repeated whitespace characters in rule definition (if any) into one
				updated_rule=$(echo "$updated_rule" | tr -s '[:space:]')
				# 3) Append the modified / filtered rule again into audit.rules
				#    (but only in case it's not present yet to prevent duplicate definitions)
				if ! grep -q -- "$updated_rule" "$audit_file"
				then
					echo "$updated_rule" &gt;&gt; "$audit_file"
				fi
			fi
		else
			# $audit_file already contains the expected rule form for this
			# architecture &amp; key =&gt; don't insert it second time
			append_expected_rule=1
		fi
	done

	# We deleted all rules that were subset of the expected one for this arch &amp; key.
	# Also isolated rules containing system calls not from this system calls group.
	# Now append the expected rule if it's not present in $audit_file yet
	if [[ ${append_expected_rule} -eq "0" ]]
	then
		echo "$full_rule" &gt;&gt; "$audit_file"
	fi
done

return $retval

}</value>
    </Value>
    <Value id="xccdf_org.ssgproject.content_value_function_fix_audit_watch_rule" hidden="true" prohibitChanges="true" operator="equals" type="string">
      <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Remediation function fix_audit_watch_rule</title>
      <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Shared bash remediation function. Not intended to be changed by tailoring.</description>
      <value># Function to fix audit file system object watch rule for given path:
# * if rule exists, also verifies the -w bits match the requirements
# * if rule doesn't exist yet, appends expected rule form to $files_to_inspect
#   audit rules file, depending on the tool which was used to load audit rules
#
# Expects four arguments (each of them is required) in the form of:
# * audit tool				tool used to load audit rules,
# 					either 'auditctl', or 'augenrules'
# * path                        	value of -w audit rule's argument
# * required access bits        	value of -p audit rule's argument
# * key                         	value of -k audit rule's argument
#
# Example call:
#
#       fix_audit_watch_rule "auditctl" "/etc/localtime" "wa" "audit_time_rules"
#
function fix_audit_watch_rule {

# Load function arguments into local variables
local tool="$1"
local path="$2"
local required_access_bits="$3"
local key="$4"

# Check sanity of the input
if [ $# -ne "4" ]
then
	echo "Usage: fix_audit_watch_rule 'tool' 'path' 'bits' 'key'"
	echo "Aborting."
	exit 1
fi

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
declare -a files_to_inspect
files_to_inspect=()

# Check sanity of the specified audit tool
if [ "$tool" != 'auditctl' ] &amp;&amp; [ "$tool" != 'augenrules' ]
then
	echo "Unknown audit rules loading tool: $1. Aborting."
	echo "Use either 'auditctl' or 'augenrules'!"
	exit 1
# If the audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# into the list of files to be inspected
elif [ "$tool" == 'auditctl' ]
then
	files_to_inspect+=('/etc/audit/audit.rules')
# If the audit is 'augenrules', then check if rule is already defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to list of files for inspection.
# If rule isn't defined, add '/etc/audit/rules.d/$key.rules' to list of files for inspection.
elif [ "$tool" == 'augenrules' ]
then
	readarray -t matches &lt; &lt;(grep -P "[\s]*-w[\s]+$path" /etc/audit/rules.d/*.rules)

	# For each of the matched entries
	for match in "${matches[@]}"
	do
		# Extract filepath from the match
		rulesd_audit_file=$(echo $match | cut -f1 -d ':')
		# Append that path into list of files for inspection
		files_to_inspect+=("$rulesd_audit_file")
	done
	# Case when particular audit rule isn't defined yet
	if [ "${#files_to_inspect[@]}" -eq "0" ]
	then
		# Append '/etc/audit/rules.d/$key.rules' into list of files for inspection
		local key_rule_file="/etc/audit/rules.d/$key.rules"
		# If the $key.rules file doesn't exist yet, create it with correct permissions
		if [ ! -e "$key_rule_file" ]
		then
			touch "$key_rule_file"
			chmod 0640 "$key_rule_file"
		fi

		files_to_inspect+=("$key_rule_file")
	fi
fi

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do

	# Check if audit watch file system object rule for given path already present
	if grep -q -P -- "[\s]*-w[\s]+$path" "$audit_rules_file"
	then
		# Rule is found =&gt; verify yet if existing rule definition contains
		# all of the required access type bits

		# Escape slashes in path for use in sed pattern below
		local esc_path=${path//$'/'/$'\/'}
		# Define BRE whitespace class shortcut
		local sp="[[:space:]]"
		# Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
		current_access_bits=$(sed -ne "s/$sp*-w$sp\+$esc_path$sp\+-p$sp\+\([rxwa]\{1,4\}\).*/\1/p" "$audit_rules_file")
		# Split required access bits string into characters array
		# (to check bit's presence for one bit at a time)
		for access_bit in $(echo "$required_access_bits" | grep -o .)
		do
			# For each from the required access bits (e.g. 'w', 'a') check
			# if they are already present in current access bits for rule.
			# If not, append that bit at the end
			if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
			then
				# Concatenate the existing mask with the missing bit
				current_access_bits="$current_access_bits$access_bit"
			fi
		done
		# Propagate the updated rule's access bits (original + the required
		# ones) back into the /etc/audit/audit.rules file for that rule
		sed -i "s/\($sp*-w$sp\+$esc_path$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)/\1$current_access_bits\3/" "$audit_rules_file"
	else
		# Rule isn't present yet. Append it at the end of $audit_rules_file file
		# with proper key

		echo "-w $path -p $required_access_bits -k $key" &gt;&gt; "$audit_rules_file"
	fi
done
}</value>
    </Value>
    <Value id="xccdf_org.ssgproject.content_value_function_include_merge_files_by_lines" hidden="true" prohibitChanges="true" operator="equals" type="string">
      <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Remediation function include_merge_files_by_lines</title>
      <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Shared bash remediation function. Not intended to be changed by tailoring.</description>
      <value>function include_merge_files_by_lines {
	:
}

# 1: Filename of the "master" file
# 2: Filename of the newly created file
function create_empty_file_like {
	local lines_count
	lines_count=$(cat "$1" | wc -l)
	for _ in $(seq 1 "$lines_count"); do
		printf '\n' &gt;&gt; "$2"
	done
}


# 1: Filename of the "master" file
# 2: Filename of sample flie
function second_file_is_same_except_newlines {
	local lines_of_master lines_of_sample len_of_master line_number i
	readarray -t lines_of_master &lt; "$1"
	readarray -t lines_of_sample &lt; "$2"

	len_of_master="${#lines_of_master[@]}"
	if test "$len_of_master" != "${#lines_of_sample[@]}"; then
		echo "Files '$1' and '$2' have different number of lines, $len_of_master and ${#lines_of_sample[@]} respectively."
		return 1
	fi

	for line_number in $(seq 1 "$len_of_master"); do
		i=$((line_number - 1))
		test -n "${lines_of_sample[$i]}" || continue
		if test "${lines_of_master[$i]}" != "${lines_of_sample[$i]}"; then
			echo "Line $line_number is different in files '$1' and '$2'."
			return 1
		fi
	done
}


# 1: Filename of the "master" file
# 2: Filename of sample flie
# 3: List of indices (1-based, space-separated string)
function merge_first_lines_to_second_on_indices {
	local lines_of_master lines_of_sample line_number i
	test -f "$2" || create_empty_file_like "$1" "$2"

	readarray -t lines_of_master &lt; "$1"
	readarray -t lines_of_sample &lt; "$2"

	error_msg="$(second_file_is_same_except_newlines "$1" "$2")"
	if test $? != 0; then
		echo "Error merging lines into '$2': $error_msg" &gt;&amp;2
		return 1
	fi

	for line_number in $3; do
		i=$((line_number - 1))
		lines_of_sample[$i]="${lines_of_master[$i]}"
	done

	printf "%s\n" "${lines_of_sample[@]}" &gt; "$2"
}</value>
    </Value>
    <Value id="xccdf_org.ssgproject.content_value_function_include_mount_options_functions" hidden="true" prohibitChanges="true" operator="equals" type="string">
      <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Remediation function include_mount_options_functions</title>
      <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Shared bash remediation function. Not intended to be changed by tailoring.</description>
      <value>function include_mount_options_functions {
	:
}

# $1: type of filesystem
# $2: new mount point option
# $3: filesystem of new mount point (used when adding new entry in fstab)
# $4: mount type of new mount point (used when adding new entry in fstab)
function ensure_mount_option_for_vfstype {
        local _vfstype="$1" _new_opt="$2" _filesystem=$3 _type=$4 _vfstype_points=()
        readarray -t _vfstype_points &lt; &lt;(grep -E "[[:space:]]${_vfstype}[[:space:]]" /etc/fstab | awk '{print $2}')

        for _vfstype_point in "${_vfstype_points[@]}"
        do
                ensure_mount_option_in_fstab "$_vfstype_point" "$_new_opt" "$_filesystem" "$_type"
        done
}

# $1: mount point
# $2: new mount point option
# $3: device or virtual string (used when adding new entry in fstab)
# $4: mount type of mount point (used when adding new entry in fstab)
function ensure_mount_option_in_fstab {
	local _mount_point="$1" _new_opt="$2" _device=$3 _type=$4
	local _mount_point_match_regexp="" _previous_mount_opts=""
	_mount_point_match_regexp="$(get_mount_point_regexp "$_mount_point")"

	if [ "$(grep -c "$_mount_point_match_regexp" /etc/fstab)" -eq 0 ]; then
		# runtime opts without some automatic kernel/userspace-added defaults
		_previous_mount_opts=$(grep "$_mount_point_match_regexp" /etc/mtab | head -1 |  awk '{print $4}' \
					| sed -E "s/(rw|defaults|seclabel|${_new_opt})(,|$)//g;s/,$//")
		[ "$_previous_mount_opts" ] &amp;&amp; _previous_mount_opts+=","
		echo "${_device} ${_mount_point} ${_type} defaults,${_previous_mount_opts}${_new_opt} 0 0" &gt;&gt; /etc/fstab
	elif [ "$(grep "$_mount_point_match_regexp" /etc/fstab | grep -c "$_new_opt")" -eq 0 ]; then
		_previous_mount_opts=$(grep "$_mount_point_match_regexp" /etc/fstab | awk '{print $4}')
		sed -i "s|\(${_mount_point_match_regexp}.*${_previous_mount_opts}\)|\1,${_new_opt}|" /etc/fstab
	fi
}

# $1: mount point
function get_mount_point_regexp {
		printf "[[:space:]]%s[[:space:]]" "$1"
}

# $1: mount point
function assert_mount_point_in_fstab {
	local _mount_point_match_regexp
	_mount_point_match_regexp="$(get_mount_point_regexp "$1")"
	grep "$_mount_point_match_regexp" -q /etc/fstab \
		|| { echo "The mount point '$1' is not even in /etc/fstab, so we can't set up mount options" &gt;&amp;2; return 1; }
}

# $1: mount point
function remove_defaults_from_fstab_if_overriden {
	local _mount_point_match_regexp
	_mount_point_match_regexp="$(get_mount_point_regexp "$1")"
	if grep "$_mount_point_match_regexp" /etc/fstab | grep -q "defaults,"
	then
		sed -i "s|\(${_mount_point_match_regexp}.*\)defaults,|\1|" /etc/fstab
	fi
}

# $1: mount point
function ensure_partition_is_mounted {
	local _mount_point="$1"
	mkdir -p "$_mount_point" || return 1
	if mountpoint -q "$_mount_point"; then
		mount -o remount --target "$_mount_point"
	else
		mount --target "$_mount_point"
	fi
}</value>
    </Value>
    <Value id="xccdf_org.ssgproject.content_value_function_perform_audit_adjtimex_settimeofday_stime_remediation" hidden="true" prohibitChanges="true" operator="equals" type="string">
      <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Remediation function perform_audit_adjtimex_settimeofday_stime_remediation</title>
      <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Shared bash remediation function. Not intended to be changed by tailoring.</description>
      <value># Function to fix syscall audit rule for given system call. It is
# based on example audit syscall rule definitions as outlined in
# /usr/share/doc/audit-2.3.7/stig.rules file provided with the audit
# package. It will combine multiple system calls belonging to the same
# syscall group into one audit rule (rather than to create audit rule per
# different system call) to avoid audit infrastructure performance penalty
# in the case of 'one-audit-rule-definition-per-one-system-call'. See:
#
#   https://www.redhat.com/archives/linux-audit/2014-November/msg00009.html
#
# for further details.
#
# Expects five arguments (each of them is required) in the form of:
# * audit tool				tool used to load audit rules,
# 					either 'auditctl', or 'augenrules
# * audit rules' pattern		audit rule skeleton for same syscall
# * syscall group			greatest common string this rule shares
# 					with other rules from the same group
# * architecture			architecture this rule is intended for
# * full form of new rule to add	expected full form of audit rule as to be
# 					added into audit.rules file
#
# Note: The 2-th up to 4-th arguments are used to determine how many existing
# audit rules will be inspected for resemblance with the new audit rule
# (5-th argument) the function is going to add. The rule's similarity check
# is performed to optimize audit.rules definition (merge syscalls of the same
# group into one rule) to avoid the "single-syscall-per-audit-rule" performance
# penalty.
#
# Example call:
#
#	See e.g. 'audit_rules_file_deletion_events.sh' remediation script
#
function fix_audit_syscall_rule {

# Load function arguments into local variables
local tool="$1"
local pattern="$2"
local group="$3"
local arch="$4"
local full_rule="$5"

# Check sanity of the input
if [ $# -ne "5" ]
then
	echo "Usage: fix_audit_syscall_rule 'tool' 'pattern' 'group' 'arch' 'full rule'"
	echo "Aborting."
	exit 1
fi

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
# 
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
declare -a files_to_inspect

retval=0

# First check sanity of the specified audit tool
if [ "$tool" != 'auditctl' ] &amp;&amp; [ "$tool" != 'augenrules' ]
then
	echo "Unknown audit rules loading tool: $1. Aborting."
	echo "Use either 'auditctl' or 'augenrules'!"
	return 1
# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
elif [ "$tool" == 'auditctl' ]
then
	files_to_inspect+=('/etc/audit/audit.rules' )
# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
elif [ "$tool" == 'augenrules' ]
then
	# Extract audit $key from audit rule so we can use it later
	matches=()
	key=$(expr "$full_rule" : '.*-k[[:space:]]\([^[:space:]]\+\)' '|' "$full_rule" : '.*-F[[:space:]]key=\([^[:space:]]\+\)')
	readarray -t matches &lt; &lt;(sed -s -n -e "\;${pattern};!d" -e "/${arch}/!d" -e "/${group}/!d;F" /etc/audit/rules.d/*.rules)
	if [ $? -ne 0 ]
	then
		retval=1
	fi
	for match in "${matches[@]}"
	do
		files_to_inspect+=("${match}")
	done
	# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
	if [ ${#files_to_inspect[@]} -eq "0" ]
	then
		file_to_inspect="/etc/audit/rules.d/$key.rules"
		files_to_inspect=("$file_to_inspect")
		if [ ! -e "$file_to_inspect" ]
		then
			touch "$file_to_inspect"
			chmod 0640 "$file_to_inspect"
		fi
	fi
fi

#
# Indicator that we want to append $full_rule into $audit_file by default
local append_expected_rule=0

for audit_file in "${files_to_inspect[@]}"
do
	# Filter existing $audit_file rules' definitions to select those that:
	# * follow the rule pattern, and
	# * meet the hardware architecture requirement, and
	# * are current syscall group specific
	readarray -t existing_rules &lt; &lt;(sed -e "\;${pattern};!d" -e "/${arch}/!d" -e "/${group}/!d"  "$audit_file")
	if [ $? -ne 0 ]
	then
		retval=1
	fi

	# Process rules found case-by-case
	for rule in "${existing_rules[@]}"
	do
		# Found rule is for same arch &amp; key, but differs (e.g. in count of -S arguments)
		if [ "${rule}" != "${full_rule}" ]
		then
			# If so, isolate just '(-S \w)+' substring of that rule
			rule_syscalls=$(echo "$rule" | grep -o -P '(-S \w+ )+')
			# Check if list of '-S syscall' arguments of that rule is subset
			# of '-S syscall' list of expected $full_rule
			if grep -q -- "$rule_syscalls" &lt;&lt;&lt; "$full_rule"
			then
				# Rule is covered (i.e. the list of -S syscalls for this rule is
				# subset of -S syscalls of $full_rule =&gt; existing rule can be deleted
				# Thus delete the rule from audit.rules &amp; our array
				sed -i -e "\;${rule};d" "$audit_file"
				if [ $? -ne 0 ]
				then
					retval=1
				fi
				existing_rules=("${existing_rules[@]//$rule/}")
			else
				# Rule isn't covered by $full_rule - it besides -S syscall arguments
				# for this group contains also -S syscall arguments for other syscall
				# group. Example: '-S lchown -S fchmod -S fchownat' =&gt; group='chown'
				# since 'lchown' &amp; 'fchownat' share 'chown' substring
				# Therefore:
				# * 1) delete the original rule from audit.rules
				# (original '-S lchown -S fchmod -S fchownat' rule would be deleted)
				# * 2) delete the -S syscall arguments for this syscall group, but
				# keep those not belonging to this syscall group
				# (original '-S lchown -S fchmod -S fchownat' would become '-S fchmod'
				# * 3) append the modified (filtered) rule again into audit.rules
				# if the same rule not already present
				#
				# 1) Delete the original rule
				sed -i -e "\;${rule};d" "$audit_file"
				if [ $? -ne 0 ]
				then
					retval=1
				fi

				# 2) Delete syscalls for this group, but keep those from other groups
				# Convert current rule syscall's string into array splitting by '-S' delimiter
				IFS_BKP="$IFS"
				IFS=$'-S'
				read -a rule_syscalls_as_array &lt;&lt;&lt; "$rule_syscalls"
				# Reset IFS back to default
				IFS="$IFS_BKP"
				# Splitting by "-S" can't be replaced by the readarray functionality easily

				# Declare new empty string to hold '-S syscall' arguments from other groups
				new_syscalls_for_rule=''
				# Walk through existing '-S syscall' arguments
				for syscall_arg in "${rule_syscalls_as_array[@]}"
				do
					# Skip empty $syscall_arg values
					if [ "$syscall_arg" == '' ]
					then
						continue
					fi
					# If the '-S syscall' doesn't belong to current group add it to the new list
					# (together with adding '-S' delimiter back for each of such item found)
					if grep -q -v -- "$group" &lt;&lt;&lt; "$syscall_arg"
					then
						new_syscalls_for_rule="$new_syscalls_for_rule -S $syscall_arg"
					fi
				done
				# Replace original '-S syscall' list with the new one for this rule
				updated_rule=${rule//$rule_syscalls/$new_syscalls_for_rule}
				# Squeeze repeated whitespace characters in rule definition (if any) into one
				updated_rule=$(echo "$updated_rule" | tr -s '[:space:]')
				# 3) Append the modified / filtered rule again into audit.rules
				#    (but only in case it's not present yet to prevent duplicate definitions)
				if ! grep -q -- "$updated_rule" "$audit_file"
				then
					echo "$updated_rule" &gt;&gt; "$audit_file"
				fi
			fi
		else
			# $audit_file already contains the expected rule form for this
			# architecture &amp; key =&gt; don't insert it second time
			append_expected_rule=1
		fi
	done

	# We deleted all rules that were subset of the expected one for this arch &amp; key.
	# Also isolated rules containing system calls not from this system calls group.
	# Now append the expected rule if it's not present in $audit_file yet
	if [[ ${append_expected_rule} -eq "0" ]]
	then
		echo "$full_rule" &gt;&gt; "$audit_file"
	fi
done

return $retval

}


# Function to perform remediation for the 'adjtimex', 'settimeofday', and 'stime' audit
# system calls on RHEL, Fedora or OL systems.
# Remediation performed for both possible tools: 'auditctl' and 'augenrules'.
#
# Note: 'stime' system call isn't known at 64-bit arch (see "$ ausyscall x86_64 stime" 's output)
# therefore excluded from the list of time group system calls to be audited on this arch
#
# Example Call:
#
#      perform_audit_adjtimex_settimeofday_stime_remediation
#
function perform_audit_adjtimex_settimeofday_stime_remediation {

# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do

	PATTERN="-a always,exit -F arch=${ARCH} -S .* -k *"
	# Create expected audit group and audit rule form for particular system call &amp; architecture
	if [ ${ARCH} = "b32" ]
	then
		# stime system call is known at 32-bit arch (see e.g "$ ausyscall i386 stime" 's output)
		# so append it to the list of time group system calls to be audited
		GROUP="\(adjtimex\|settimeofday\|stime\)"
		FULL_RULE="-a always,exit -F arch=${ARCH} -S adjtimex -S settimeofday -S stime -k audit_time_rules"
	elif [ ${ARCH} = "b64" ]
	then
		# stime system call isn't known at 64-bit arch (see "$ ausyscall x86_64 stime" 's output)
		# therefore don't add it to the list of time group system calls to be audited
		GROUP="\(adjtimex\|settimeofday\)"
		FULL_RULE="-a always,exit -F arch=${ARCH} -S adjtimex -S settimeofday -k audit_time_rules"
	fi
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	fix_audit_syscall_rule "auditctl" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
	fix_audit_syscall_rule "augenrules" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
done

}</value>
    </Value>
    <Value id="xccdf_org.ssgproject.content_value_function_perform_audit_rules_privileged_commands_remediation" hidden="true" prohibitChanges="true" operator="equals" type="string">
      <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Remediation function perform_audit_rules_privileged_commands_remediation</title>
      <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Shared bash remediation function. Not intended to be changed by tailoring.</description>
      <value># Function to perform remediation for 'audit_rules_privileged_commands' rule
#
# Expects two arguments:
#
# audit_tool		tool used to load audit rules
# 			One of 'auditctl' or 'augenrules'
#
# min_auid		Minimum original ID the user logged in with
#
# Example Call(s):
#
#      perform_audit_rules_privileged_commands_remediation "auditctl" "500"
#      perform_audit_rules_privileged_commands_remediation "augenrules"	"1000"
#
function perform_audit_rules_privileged_commands_remediation {
#
# Load function arguments into local variables
local tool="$1"
local min_auid="$2"

# Check sanity of the input
if [ $# -ne "2" ]
then
	echo "Usage: perform_audit_rules_privileged_commands_remediation 'auditctl | augenrules' '500 | 1000'"
	echo "Aborting."
	exit 1
fi

declare -a files_to_inspect=()

# Check sanity of the specified audit tool
if [ "$tool" != 'auditctl' ] &amp;&amp; [ "$tool" != 'augenrules' ]
then
	echo "Unknown audit rules loading tool: $1. Aborting."
	echo "Use either 'auditctl' or 'augenrules'!"
	exit 1
# If the audit tool is 'auditctl', then:
# * add '/etc/audit/audit.rules'to the list of files to be inspected,
# * specify '/etc/audit/audit.rules' as the output audit file, where
#   missing rules should be inserted
elif [ "$tool" == 'auditctl' ]
then
	files_to_inspect=("/etc/audit/audit.rules")
	output_audit_file="/etc/audit/audit.rules"
#
# If the audit tool is 'augenrules', then:
# * add '/etc/audit/rules.d/*.rules' to the list of files to be inspected
#   (split by newline),
# * specify /etc/audit/rules.d/privileged.rules' as the output file, where
#   missing rules should be inserted
elif [ "$tool" == 'augenrules' ]
then
	readarray -t files_to_inspect &lt; &lt;(find /etc/audit/rules.d -maxdepth 1 -type f -name '*.rules' -print)
	output_audit_file="/etc/audit/rules.d/privileged.rules"
fi

# Obtain the list of SUID/SGID binaries on the particular system (split by newline)
# into privileged_binaries array
privileged_binaries=()
readarray -t privileged_binaries &lt; &lt;(find / -not \( -fstype afs -o -fstype ceph -o -fstype cifs -o -fstype smb3 -o -fstype smbfs -o -fstype sshfs -o -fstype ncpfs -o -fstype ncp -o -fstype nfs -o -fstype nfs4 -o -fstype gfs -o -fstype gfs2 -o -fstype glusterfs -o -fstype gpfs -o -fstype pvfs2 -o -fstype ocfs2 -o -fstype lustre -o -fstype davfs -o -fstype fuse.sshfs \) -type f \( -perm -4000 -o -perm -2000 \) 2&gt; /dev/null)

# Keep list of SUID/SGID binaries that have been already handled within some previous iteration
declare -a sbinaries_to_skip=()

# For each found sbinary in privileged_binaries list
for sbinary in "${privileged_binaries[@]}"
do

	# Check if this sbinary wasn't already handled in some of the previous sbinary iterations
	# Return match only if whole sbinary definition matched (not in the case just prefix matched!!!)
	if [[ $(sed -ne "\|${sbinary}|p" &lt;&lt;&lt; "${sbinaries_to_skip[*]}") ]]
	then
		# If so, don't process it second time &amp; go to process next sbinary
		continue
	fi

	# Reset the counter of inspected files when starting to check
	# presence of existing audit rule for new sbinary
	local count_of_inspected_files=0

	# Define expected rule form for this binary
	expected_rule="-a always,exit -F path=${sbinary} -F auid&gt;=${min_auid} -F auid!=unset -F key=privileged"

	# If list of audit rules files to be inspected is empty, just add new rule and move on to next binary
	if [[ ${#files_to_inspect[@]} -eq 0 ]]; then
		echo "$expected_rule" &gt;&gt; "$output_audit_file"
		continue
	fi

	# Replace possible slash '/' character in sbinary definition so we could use it in sed expressions below
	sbinary_esc=${sbinary//$'/'/$'\/'}

	# For each audit rules file from the list of files to be inspected
	for afile in "${files_to_inspect[@]}"
	do

		# Search current audit rules file's content for match. Match criteria:
		# * existing rule is for the same SUID/SGID binary we are currently processing (but
		#   can contain multiple -F path= elements covering multiple SUID/SGID binaries)
		# * existing rule contains all arguments from expected rule form (though can contain
		#   them in arbitrary order)
	
		base_search=$(sed -e '/-a always,exit/!d' -e '/-F path='"${sbinary_esc}"'[^[:graph:]]/!d'		\
				-e '/-F path=[^[:space:]]\+/!d'						\
				-e '/-F auid&gt;='"${min_auid}"'/!d' -e '/-F auid!=\(4294967295\|unset\)/!d'	\
				-e '/-k \|-F key=/!d' "$afile")

		# Increase the count of inspected files for this sbinary
		count_of_inspected_files=$((count_of_inspected_files + 1))


		# Search current audit rules file's content for presence of rule pattern for this sbinary
		if [[ $base_search ]]
		then

			# Current audit rules file already contains rule for this binary =&gt;
			# Store the exact form of found rule for this binary for further processing
			concrete_rule=$base_search

			# Select all other SUID/SGID binaries possibly also present in the found rule

			readarray -t handled_sbinaries &lt; &lt;(grep -o -e "-F path=[^[:space:]]\+" &lt;&lt;&lt; "$concrete_rule")
			handled_sbinaries=("${handled_sbinaries[@]//-F path=/}")

			# Merge the list of such SUID/SGID binaries found in this iteration with global list ignoring duplicates
			readarray -t sbinaries_to_skip &lt; &lt;(for i in "${sbinaries_to_skip[@]}" "${handled_sbinaries[@]}"; do echo "$i"; done | sort -du)

			# if there is a -F perm flag, remove it
			if grep -q '.*-F\s\+perm=[rwxa]\+.*' &lt;&lt;&lt; "$concrete_rule"; then

				# Separate concrete_rule into three sections using hash '#'
				# sign as a delimiter around rule's permission section borders
				# note that the trailing space after perm flag is captured because there would be 
				# two consecutive spaces after joining remaining parts of the rule together
				concrete_rule="$(echo "$concrete_rule" | sed -n "s/\(.*\)\+\(-F perm=[rwax]\+\ \?\)\+/\1#\2#/p")"

				# Split concrete_rule into head, perm, and tail sections using hash '#' delimiter
				rule_head=$(cut -d '#' -f 1 &lt;&lt;&lt; "$concrete_rule")
				rule_perm=$(cut -d '#' -f 2 &lt;&lt;&lt; "$concrete_rule")
				rule_tail=$(cut -d '#' -f 3 &lt;&lt;&lt; "$concrete_rule")

				# Remove permissions section from existing rule in the file
				sed -i "s#${rule_head}\(.*\)${rule_tail}#${rule_head}${rule_tail}#" "$afile"
			fi
		# If the required audit rule for particular sbinary wasn't found yet, insert it under following conditions:
		#
		# * in the "auditctl" mode of operation insert particular rule each time
		#   (because in this mode there's only one file -- /etc/audit/audit.rules to be inspected for presence of this rule),
		#
		# * in the "augenrules" mode of operation insert particular rule only once and only in case we have already
		#   searched all of the files from /etc/audit/rules.d/*.rules location (since that audit rule can be defined
		#   in any of those files and if not, we want it to be inserted only once into /etc/audit/rules.d/privileged.rules file)
		#
		elif [ "$tool" == "auditctl" ] || [[ "$tool" == "augenrules" &amp;&amp; $count_of_inspected_files -eq "${#files_to_inspect[@]}" ]]
		then

			# Check if this sbinary wasn't already handled in some of the previous afile iterations
			# Return match only if whole sbinary definition matched (not in the case just prefix matched!!!)
			if [[ ! $(sed -ne "\|${sbinary}|p" &lt;&lt;&lt; "${sbinaries_to_skip[*]}") ]]
			then
				# Current audit rules file's content doesn't contain expected rule for this
				# SUID/SGID binary yet =&gt; append it
				echo "$expected_rule" &gt;&gt; "$output_audit_file"
			fi

			continue
		fi

	done

done
}</value>
    </Value>
    <Value id="xccdf_org.ssgproject.content_value_function_populate" hidden="true" prohibitChanges="true" operator="equals" type="string">
      <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Remediation function populate</title>
      <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Shared bash remediation function. Not intended to be changed by tailoring.</description>
      <value># The populate function isn't directly used by SSG at the moment but it can be 
# used for testing purposes and will be used in SSG Testsuite in the future.

function populate {
# code to populate environment variables needed (for unit testing)
if [ -z "${!1}" ]; then
	echo "$1 is not defined. Exiting."
	exit
fi
}</value>
    </Value>
    <Value id="xccdf_org.ssgproject.content_value_function_replace_or_append" hidden="true" prohibitChanges="true" operator="equals" type="string">
      <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Remediation function replace_or_append</title>
      <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Shared bash remediation function. Not intended to be changed by tailoring.</description>
      <value># Function to replace configuration setting in config file or add the configuration setting if
# it does not exist.
#
# Expects arguments:
#
# config_file:		Configuration file that will be modified
# key:			Configuration option to change
# value:		Value of the configuration option to change
# cce:			The CCE identifier or '@CCENUM@' if no CCE identifier exists
# format:		The printf-like format string that will be given stripped key and value as arguments,
#			so e.g. '%s=%s' will result in key=value subsitution (i.e. without spaces around =)
#
# Optional arugments:
#
# format:		Optional argument to specify the format of how key/value should be
# 			modified/appended in the configuration file. The default is key = value.
#
# Example Call(s):
#
#     With default format of 'key = value':
#     replace_or_append '/etc/sysctl.conf' '^kernel.randomize_va_space' '2' '@CCENUM@'
#
#     With custom key/value format:
#     replace_or_append '/etc/sysconfig/selinux' '^SELINUX=' 'disabled' '@CCENUM@' '%s=%s'
#
#     With a variable:
#     replace_or_append '/etc/sysconfig/selinux' '^SELINUX=' $var_selinux_state '@CCENUM@' '%s=%s'
#
function replace_or_append {
  local default_format='%s = %s' case_insensitive_mode=yes sed_case_insensitive_option='' grep_case_insensitive_option=''
  local config_file=$1
  local key=$2
  local value=$3
  local cce=$4
  local format=$5

  if [ "$case_insensitive_mode" = yes ]; then
    sed_case_insensitive_option="i"
    grep_case_insensitive_option="-i"
  fi
  [ -n "$format" ] || format="$default_format"
  # Check sanity of the input
  [ $# -ge "3" ] || { echo "Usage: replace_or_append &lt;config_file_location&gt; &lt;key_to_search&gt; &lt;new_value&gt; [&lt;CCE number or literal '@CCENUM@' if unknown&gt;] [printf-like format, default is '$default_format']" &gt;&amp;2; exit 1; }

  # Test if the config_file is a symbolic link. If so, use --follow-symlinks with sed.
  # Otherwise, regular sed command will do.
  sed_command=('sed' '-i')
  if test -L "$config_file"; then
    sed_command+=('--follow-symlinks')
  fi

  # Test that the cce arg is not empty or does not equal @CCENUM@.
  # If @CCENUM@ exists, it means that there is no CCE assigned.
  if [ -n "$cce" ] &amp;&amp; [ "$cce" != '@CCENUM@' ]; then
    cce="${cce}"
  else
    cce="CCE"
  fi

  # Strip any search characters in the key arg so that the key can be replaced without
  # adding any search characters to the config file.
  stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "$key")

  # shellcheck disable=SC2059
  printf -v formatted_output "$format" "$stripped_key" "$value"

  # If the key exists, change it. Otherwise, add it to the config_file.
  # We search for the key string followed by a word boundary (matched by \&gt;),
  # so if we search for 'setting', 'setting2' won't match.
  if LC_ALL=C grep -q -m 1 $grep_case_insensitive_option -e "${key}\\&gt;" "$config_file"; then
    "${sed_command[@]}" "s/${key}\\&gt;.*/$formatted_output/g$sed_case_insensitive_option" "$config_file"
  else
    # \n is precaution for case where file ends without trailing newline
    printf '\n# Per %s: Set %s in %s\n' "$cce" "$formatted_output" "$config_file" &gt;&gt; "$config_file"
    printf '%s\n' "$formatted_output" &gt;&gt; "$config_file"
  fi
}</value>
    </Value>
    <Value id="xccdf_org.ssgproject.content_value_function_set_faillock_option_to_value_in_pam_file" hidden="true" prohibitChanges="true" operator="equals" type="string">
      <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Remediation function set_faillock_option_to_value_in_pam_file</title>
      <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Shared bash remediation function. Not intended to be changed by tailoring.</description>
      <value>function set_faillock_option_to_value_in_pam_file {
	# If invoked with no arguments, exit. This is an intentional behavior.
	[ $# -gt 1 ] || return 0
	[ $# -ge 3 ] || die "$0 requires exactly zero, three, or four arguments"
	[ $# -le 4 ] || die "$0 requires exactly zero, three, or four arguments"
	local _pamFile="$1" _option="$2" _value="$3" _insert_lines_callback="$4"
	# pam_faillock.so already present?
	if grep -q "^auth.*pam_faillock.so.*" "$_pamFile"; then

		# pam_faillock.so present, is the option present?
		if grep -q "^auth.*[default=die].*pam_faillock.so.*authfail.*$_option=" "$_pamFile"; then

			# both pam_faillock.so &amp; option present, just correct option to the right value
			sed -i --follow-symlinks "s/\(^auth.*required.*pam_faillock.so.*preauth.*silent.*\)\($_option *= *\).*/\1\2$_value/" "$_pamFile"
			sed -i --follow-symlinks "s/\(^auth.*[default=die].*pam_faillock.so.*authfail.*\)\($_option *= *\).*/\1\2$_value/" "$_pamFile"

		# pam_faillock.so present, but the option not yet
		else

			# append correct option value to appropriate places
			sed -i --follow-symlinks "/^auth.*required.*pam_faillock.so.*preauth.*silent.*/ s/$/ $_option=$_value/" "$_pamFile"
			sed -i --follow-symlinks "/^auth.*[default=die].*pam_faillock.so.*authfail.*/ s/$/ $_option=$_value/" "$_pamFile"
		fi

	# pam_faillock.so not present yet
	else
		test -z "$_insert_lines_callback" || "$_insert_lines_callback" "$_option" "$_value" "$_pamFile"
		# insert pam_faillock.so preauth &amp; authfail rows with proper value of the option in question
	fi
}</value>
    </Value>
  </Group>
  <Group id="xccdf_org.ssgproject.content_group_system">
    <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">System Settings</title>
    <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Contains rules that check correct system settings.</description>
    <Group id="xccdf_org.ssgproject.content_group_software">
      <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Installing and Maintaining Software</title>
      <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The following sections contain information on
security-relevant choices during the initial operating system
installation process and the setup of software
updates.</description>
      <Rule id="xccdf_org.ssgproject.content_rule_prefer_64bit_os" selected="false" role="full" severity="medium">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Prefer to use a 64-bit Operating System when supported</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Prefer installation of 64-bit operating systems when the CPU supports it.</description>
        <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">There is no remediation besides installing a 64-bit operating system.</warning>
        <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R10)</reference>
        <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Use of a 64-bit operating system offers a few advantages, like a larger address space range for
Address Space Layout Randomization (ASLR) and systematic presence of No eXecute and Execute Disable (NX/XD) protection bits.</rationale>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref name="oval:ssg-prefer_64bit_os:def:1" href="ssg-fedora-oval.xml"/>
        </check>
        <check system="http://scap.nist.gov/schema/ocil/2">
          <check-content-ref name="ocil:ssg-prefer_64bit_os_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
        </check>
      </Rule>
      <Group id="xccdf_org.ssgproject.content_group_integrity">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">System and Software Integrity</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">System and software integrity can be gained by installing antivirus, increasing
system encryption strength with FIPS, verifying installed software, enabling SELinux,
installing an Intrusion Prevention System, etc. However, installing or enabling integrity
checking tools cannot <html:i xmlns:html="http://www.w3.org/1999/xhtml">prevent</html:i> intrusions, but they can detect that an intrusion
may have occurred. Requirements for integrity checking may be highly dependent on
the environment in which the system will be used. Snapshot-based approaches such
as AIDE may induce considerable overhead in the presence of frequent software updates.</description>
        <Group id="xccdf_org.ssgproject.content_group_software-integrity">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Software Integrity Checking</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Both the AIDE (Advanced Intrusion Detection Environment)
software and the RPM package management system provide
mechanisms for verifying the integrity of installed software.
AIDE uses snapshots of file metadata (such as hashes) and compares these
to current system files in order to detect changes.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
The RPM package management system can conduct integrity
checks by comparing information in its metadata database with
files installed on the system.</description>
          <Group id="xccdf_org.ssgproject.content_group_rpm_verification">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Verify Integrity with RPM</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The RPM package management system includes the ability
to verify the integrity of installed packages by comparing the
installed files with information about the files taken from the
package metadata stored in the RPM database. Although an attacker
could corrupt the RPM database (analogous to attacking the AIDE
database as described above), this check can still reveal
modification of important files. To list which files on the system differ from what is expected by the RPM database:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ rpm -qVa</html:pre>
See the man page for <html:code xmlns:html="http://www.w3.org/1999/xhtml">rpm</html:code> to see a complete explanation of each column.</description>
            <Rule id="xccdf_org.ssgproject.content_rule_rpm_verify_hashes" selected="false" role="full" severity="high">
              <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Verify File Hashes with RPM</title>
              <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Without cryptographic integrity protections, system
executables and files can be altered by unauthorized users without
detection.
The RPM package management system can check the hashes of
installed software packages, including many that are important to system
security.
To verify that the cryptographic hash of system files and commands matches vendor
values, run the following command to list which files on the system
have hashes that differ from what is expected by the RPM database:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ rpm -Va --noconfig | grep '^..5'</html:pre>
A "c" in the second column indicates that a file is a configuration file, which
may appropriately be expected to change. If the file was not expected to
change, investigate the cause of the change using audit logs or other means.
The package can then be reinstalled to restore the file.
Run the following command to determine which package owns the file:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ rpm -qf <html:i>FILENAME</html:i></html:pre>
The package can be reinstalled from a dnf repository using the command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo dnf reinstall <html:i>PACKAGENAME</html:i></html:pre>
Alternatively, the package can be reinstalled from trusted media using the command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo rpm -Uvh <html:i>PACKAGENAME</html:i></html:pre></description>
              <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.10.4.1</reference>
              <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.3.8</reference>
              <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.4.1</reference>
              <reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</reference>
              <reference href="https://public.cyber.mil/stigs/cci/">CCI-001749</reference>
              <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</reference>
              <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</reference>
              <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(c)(1)</reference>
              <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(c)(2)</reference>
              <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(2)(i)</reference>
              <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(d)</reference>
              <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(c)</reference>
              <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SI-7</reference>
              <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SI-7(1)</reference>
              <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SI-7(6)</reference>
              <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-9(3)</reference>
              <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-6</reference>
              <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-8</reference>
              <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
              <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-11.5</reference>
              <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.3</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.4</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.2</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.3</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.4</reference>
              <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
              <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
              <reference href="https://www.isaca.org/resources/cobit">BAI06.01</reference>
              <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
              <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
              <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
              <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.11.2.4</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.12.1.2</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.12.2.1</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.12.5.1</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.12.6.2</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.14.1.2</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.14.2.2</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.14.2.3</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.14.2.4</reference>
              <reference href="https://www.cisecurity.org/controls/">11</reference>
              <reference href="https://www.cisecurity.org/controls/">2</reference>
              <reference href="https://www.cisecurity.org/controls/">3</reference>
              <reference href="https://www.cisecurity.org/controls/">9</reference>
              <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The hashes of important files like system executables should match the
information given by the RPM database. Executables with erroneous hashes could
be a sign of nefarious activity on the system.</rationale>
              <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="rpm_verify_hashes" system="urn:xccdf:fix:script:sh">
# Find which files have incorrect hash (not in /etc, because of the system related config files) and then get files names
files_with_incorrect_hash="$(rpm -Va --noconfig | grep -E '^..5' | awk '{print $NF}' )"

# From files names get package names and change newline to space, because rpm writes each package to new line
packages_to_reinstall="$(rpm -qf $files_with_incorrect_hash | tr '\n' ' ')"

dnf reinstall -y $packages_to_reinstall
</fix>
              <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="rpm_verify_hashes" system="urn:xccdf:fix:script:ansible" complexity="high" disruption="medium" strategy="restrict">- name: 'Set fact: Package manager reinstall command (dnf)'
  set_fact:
    package_manager_reinstall_cmd: dnf reinstall -y
  when: ansible_distribution == "Fedora"
  tags:
    - CJIS-5.10.4.1
    - NIST-800-171-3.3.8
    - NIST-800-171-3.4.1
    - NIST-800-53-AU-9(3)
    - NIST-800-53-CM-6(c)
    - NIST-800-53-CM-6(d)
    - NIST-800-53-SI-7
    - NIST-800-53-SI-7(1)
    - NIST-800-53-SI-7(6)
    - PCI-DSS-Req-11.5
    - high_complexity
    - high_severity
    - medium_disruption
    - no_reboot_needed
    - restrict_strategy
    - rpm_verify_hashes

- name: 'Set fact: Package manager reinstall command (yum)'
  set_fact:
    package_manager_reinstall_cmd: yum reinstall -y
  when: (ansible_distribution == "RedHat" or ansible_distribution == "OracleLinux")
  tags:
    - CJIS-5.10.4.1
    - NIST-800-171-3.3.8
    - NIST-800-171-3.4.1
    - NIST-800-53-AU-9(3)
    - NIST-800-53-CM-6(c)
    - NIST-800-53-CM-6(d)
    - NIST-800-53-SI-7
    - NIST-800-53-SI-7(1)
    - NIST-800-53-SI-7(6)
    - PCI-DSS-Req-11.5
    - high_complexity
    - high_severity
    - medium_disruption
    - no_reboot_needed
    - restrict_strategy
    - rpm_verify_hashes

- name: Read files with incorrect hash
  command: rpm -Va --nodeps --nosize --nomtime --nordev --nocaps --nolinkto --nouser
    --nogroup --nomode --noghost --noconfig
  args:
    warn: false
  register: files_with_incorrect_hash
  changed_when: false
  failed_when: files_with_incorrect_hash.rc &gt; 1
  check_mode: false
  when: (package_manager_reinstall_cmd is defined)
  tags:
    - CJIS-5.10.4.1
    - NIST-800-171-3.3.8
    - NIST-800-171-3.4.1
    - NIST-800-53-AU-9(3)
    - NIST-800-53-CM-6(c)
    - NIST-800-53-CM-6(d)
    - NIST-800-53-SI-7
    - NIST-800-53-SI-7(1)
    - NIST-800-53-SI-7(6)
    - PCI-DSS-Req-11.5
    - high_complexity
    - high_severity
    - medium_disruption
    - no_reboot_needed
    - restrict_strategy
    - rpm_verify_hashes

- name: Create list of packages
  command: rpm -qf "{{ item }}"
  args:
    warn: false
  with_items: '{{ files_with_incorrect_hash.stdout_lines | map(''regex_findall'',
    ''^[.]+[5]+.* (\/.*)'', ''\1'') | map(''join'') | select(''match'', ''(\/.*)'')
    | list | unique }}'
  register: list_of_packages
  changed_when: false
  check_mode: false
  when:
    - files_with_incorrect_hash.stdout_lines is defined
    - (files_with_incorrect_hash.stdout_lines | length &gt; 0)
  tags:
    - CJIS-5.10.4.1
    - NIST-800-171-3.3.8
    - NIST-800-171-3.4.1
    - NIST-800-53-AU-9(3)
    - NIST-800-53-CM-6(c)
    - NIST-800-53-CM-6(d)
    - NIST-800-53-SI-7
    - NIST-800-53-SI-7(1)
    - NIST-800-53-SI-7(6)
    - PCI-DSS-Req-11.5
    - high_complexity
    - high_severity
    - medium_disruption
    - no_reboot_needed
    - restrict_strategy
    - rpm_verify_hashes

- name: Reinstall packages of files with incorrect hash
  command: '{{ package_manager_reinstall_cmd }} ''{{ item }}'''
  args:
    warn: false
  with_items: '{{ list_of_packages.results | map(attribute=''stdout_lines'') | list
    | unique }}'
  when:
    - files_with_incorrect_hash.stdout_lines is defined
    - (package_manager_reinstall_cmd is defined and (files_with_incorrect_hash.stdout_lines
      | length &gt; 0))
  tags:
    - CJIS-5.10.4.1
    - NIST-800-171-3.3.8
    - NIST-800-171-3.4.1
    - NIST-800-53-AU-9(3)
    - NIST-800-53-CM-6(c)
    - NIST-800-53-CM-6(d)
    - NIST-800-53-SI-7
    - NIST-800-53-SI-7(1)
    - NIST-800-53-SI-7(6)
    - PCI-DSS-Req-11.5
    - high_complexity
    - high_severity
    - medium_disruption
    - no_reboot_needed
    - restrict_strategy
    - rpm_verify_hashes
</fix>
              <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <check-content-ref name="oval:ssg-rpm_verify_hashes:def:1" href="ssg-fedora-oval.xml"/>
              </check>
              <check system="http://scap.nist.gov/schema/ocil/2">
                <check-content-ref name="ocil:ssg-rpm_verify_hashes_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
              </check>
            </Rule>
            <Rule id="xccdf_org.ssgproject.content_rule_rpm_verify_permissions" selected="false" role="full" severity="high">
              <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Verify and Correct File Permissions with RPM</title>
              <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The RPM package management system can check file access permissions
of installed software packages, including many that are important
to system security.
Verify that the file permissions of system files
and commands match vendor values. Check the file permissions
with the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo rpm -Va | awk '{ if (substr($0,2,1)=="M") print $NF }'</html:pre>
Output indicates files that do not match vendor defaults.
After locating a file with incorrect permissions,
run the following command to determine which package owns it:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ rpm -qf <html:i>FILENAME</html:i></html:pre>
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Next, run the following command to reset its permissions to
the correct values:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo rpm --setperms <html:i>PACKAGENAME</html:i></html:pre></description>
              <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">Profiles may require that specific files have stricter file permissions than defined by the
vendor.
Such files will be reported as a finding and need to be evaluated according to your policy
and deployment environment.</warning>
              <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.10.4.1</reference>
              <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.3.8</reference>
              <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.4.1</reference>
              <reference href="https://public.cyber.mil/stigs/cci/">CCI-001493</reference>
              <reference href="https://public.cyber.mil/stigs/cci/">CCI-001494</reference>
              <reference href="https://public.cyber.mil/stigs/cci/">CCI-001495</reference>
              <reference href="https://public.cyber.mil/stigs/cci/">CCI-001496</reference>
              <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</reference>
              <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</reference>
              <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(c)(1)</reference>
              <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(c)(2)</reference>
              <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(2)(i)</reference>
              <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(d)</reference>
              <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(c)</reference>
              <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SI-7</reference>
              <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SI-7(1)</reference>
              <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SI-7(6)</reference>
              <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-9(3)</reference>
              <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
              <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
              <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</reference>
              <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
              <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
              <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-11.5</reference>
              <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000256-GPOS-00097</reference>
              <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000257-GPOS-00098</reference>
              <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000258-GPOS-00099</reference>
              <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000278-GPOS-00108</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.2</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.3</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</reference>
              <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
              <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
              <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
              <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
              <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
              <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
              <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
              <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.10.1.1</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.11.1.4</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.11.1.5</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.11.2.1</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.12.1.2</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.12.4.1</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.12.4.2</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.12.4.3</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.12.4.4</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.12.5.1</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.12.6.2</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.12.7.1</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.13.1.3</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.13.2.3</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.13.2.4</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.14.1.2</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.14.2.2</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.14.2.3</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.14.2.4</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.6.1.2</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.7.1.1</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.7.1.2</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.7.3.1</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.8.2.2</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.8.2.3</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.9.1.1</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.9.2.3</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.9.4.1</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.9.4.4</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.9.4.5</reference>
              <reference href="https://www.cisecurity.org/controls/">1</reference>
              <reference href="https://www.cisecurity.org/controls/">11</reference>
              <reference href="https://www.cisecurity.org/controls/">12</reference>
              <reference href="https://www.cisecurity.org/controls/">13</reference>
              <reference href="https://www.cisecurity.org/controls/">14</reference>
              <reference href="https://www.cisecurity.org/controls/">15</reference>
              <reference href="https://www.cisecurity.org/controls/">16</reference>
              <reference href="https://www.cisecurity.org/controls/">18</reference>
              <reference href="https://www.cisecurity.org/controls/">3</reference>
              <reference href="https://www.cisecurity.org/controls/">5</reference>
              <reference href="https://www.cisecurity.org/controls/">6</reference>
              <reference href="https://www.cisecurity.org/controls/">9</reference>
              <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Permissions on system binaries and configuration files that are too generous
could allow an unauthorized user to gain privileges that they should not have.
The permissions set by the vendor should be maintained. Any deviations from
this baseline should be investigated.</rationale>
              <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="rpm_verify_permissions" system="urn:xccdf:fix:script:sh" complexity="high" disruption="medium" strategy="restrict">
# Declare array to hold set of RPM packages we need to correct permissions for
declare -A SETPERMS_RPM_DICT

# Create a list of files on the system having permissions different from what
# is expected by the RPM database
readarray -t FILES_WITH_INCORRECT_PERMS &lt; &lt;(rpm -Va --nofiledigest | awk '{ if (substr($0,2,1)=="M") print $NF }')

for FILE_PATH in "${FILES_WITH_INCORRECT_PERMS[@]}"
do
        # NOTE: some files maybe controlled by more then one package
        readarray -t RPM_PACKAGES &lt; &lt;(rpm -qf "${FILE_PATH}")
        for RPM_PACKAGE in "${RPM_PACKAGES[@]}"
        do
                # Use an associative array to store packages as it's keys, not having to care about duplicates.
                SETPERMS_RPM_DICT["$RPM_PACKAGE"]=1
        done
done

# For each of the RPM packages left in the list -- reset its permissions to the
# correct values
for RPM_PACKAGE in "${!SETPERMS_RPM_DICT[@]}"
do
	rpm --restore "${RPM_PACKAGE}"
done
</fix>
              <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="rpm_verify_permissions" system="urn:xccdf:fix:script:ansible" complexity="high" disruption="medium" strategy="restrict">- name: Read list of files with incorrect permissions
  command: rpm -Va --nodeps --nosignature --nofiledigest --nosize --nomtime --nordev
    --nocaps --nolinkto --nouser --nogroup
  args:
    warn: false
  register: files_with_incorrect_permissions
  failed_when: files_with_incorrect_permissions.rc &gt; 1
  changed_when: false
  check_mode: false
  tags:
    - CJIS-5.10.4.1
    - NIST-800-171-3.3.8
    - NIST-800-171-3.4.1
    - NIST-800-53-AU-9(3)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-6(c)
    - NIST-800-53-CM-6(d)
    - NIST-800-53-SI-7
    - NIST-800-53-SI-7(1)
    - NIST-800-53-SI-7(6)
    - PCI-DSS-Req-11.5
    - high_complexity
    - high_severity
    - medium_disruption
    - no_reboot_needed
    - restrict_strategy
    - rpm_verify_permissions

- name: Create list of packages
  command: rpm -qf "{{ item }}"
  args:
    warn: false
  with_items: '{{ files_with_incorrect_permissions.stdout_lines | map(''regex_findall'',
    ''^[.]+[M]+.* (\/.*)'', ''\1'') | map(''join'') | select(''match'', ''(\/.*)'')
    | list | unique }}'
  register: list_of_packages
  changed_when: false
  check_mode: false
  when: (files_with_incorrect_permissions.stdout_lines | length &gt; 0)
  tags:
    - CJIS-5.10.4.1
    - NIST-800-171-3.3.8
    - NIST-800-171-3.4.1
    - NIST-800-53-AU-9(3)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-6(c)
    - NIST-800-53-CM-6(d)
    - NIST-800-53-SI-7
    - NIST-800-53-SI-7(1)
    - NIST-800-53-SI-7(6)
    - PCI-DSS-Req-11.5
    - high_complexity
    - high_severity
    - medium_disruption
    - no_reboot_needed
    - restrict_strategy
    - rpm_verify_permissions

- name: Correct file permissions with RPM
  command: rpm --setperms '{{ item }}'
  args:
    warn: false
  with_items: '{{ list_of_packages.results | map(attribute=''stdout_lines'') | list
    | unique }}'
  when: (files_with_incorrect_permissions.stdout_lines | length &gt; 0)
  tags:
    - CJIS-5.10.4.1
    - NIST-800-171-3.3.8
    - NIST-800-171-3.4.1
    - NIST-800-53-AU-9(3)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-6(c)
    - NIST-800-53-CM-6(d)
    - NIST-800-53-SI-7
    - NIST-800-53-SI-7(1)
    - NIST-800-53-SI-7(6)
    - PCI-DSS-Req-11.5
    - high_complexity
    - high_severity
    - medium_disruption
    - no_reboot_needed
    - restrict_strategy
    - rpm_verify_permissions
</fix>
              <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <check-content-ref name="oval:ssg-rpm_verify_permissions:def:1" href="ssg-fedora-oval.xml"/>
              </check>
              <check system="http://scap.nist.gov/schema/ocil/2">
                <check-content-ref name="ocil:ssg-rpm_verify_permissions_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
              </check>
            </Rule>
          </Group>
          <Group id="xccdf_org.ssgproject.content_group_aide">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Verify Integrity with AIDE</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">AIDE conducts integrity checks by comparing information about
files with previously-gathered information. Ideally, the AIDE database is
created immediately after initial system configuration, and then again after any
software update.  AIDE is highly configurable, with further configuration
information located in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/usr/share/doc/aide-<html:i>VERSION</html:i></html:code>.</description>
            <platform idref="cpe:/a:machine"/>
            <Rule id="xccdf_org.ssgproject.content_rule_package_aide_installed" selected="false" role="full" severity="medium">
              <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Install AIDE</title>
              <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">aide</html:code> package can be installed with the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">
$ sudo dnf install aide</html:pre></description>
              <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.10.1.3</reference>
              <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
              <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
              <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</reference>
              <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-1</reference>
              <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-6</reference>
              <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-8</reference>
              <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
              <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-3</reference>
              <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-11.5</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.3</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.4</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.2</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.3</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.4</reference>
              <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
              <reference href="https://www.isaca.org/resources/cobit">BAI01.06</reference>
              <reference href="https://www.isaca.org/resources/cobit">BAI02.01</reference>
              <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
              <reference href="https://www.isaca.org/resources/cobit">BAI06.01</reference>
              <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
              <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
              <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
              <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS04.07</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS05.03</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS06.06</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.11.2.4</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.12.1.2</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.12.2.1</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.12.4.1</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.12.5.1</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.12.6.2</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.14.1.2</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.14.2.2</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.14.2.3</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.14.2.4</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.14.2.7</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.15.2.1</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.8.2.3</reference>
              <reference href="https://www.cisecurity.org/controls/">1</reference>
              <reference href="https://www.cisecurity.org/controls/">11</reference>
              <reference href="https://www.cisecurity.org/controls/">12</reference>
              <reference href="https://www.cisecurity.org/controls/">13</reference>
              <reference href="https://www.cisecurity.org/controls/">14</reference>
              <reference href="https://www.cisecurity.org/controls/">15</reference>
              <reference href="https://www.cisecurity.org/controls/">16</reference>
              <reference href="https://www.cisecurity.org/controls/">2</reference>
              <reference href="https://www.cisecurity.org/controls/">3</reference>
              <reference href="https://www.cisecurity.org/controls/">5</reference>
              <reference href="https://www.cisecurity.org/controls/">7</reference>
              <reference href="https://www.cisecurity.org/controls/">8</reference>
              <reference href="https://www.cisecurity.org/controls/">9</reference>
              <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R51)</reference>
              <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000363-GPOS-00150</reference>
              <reference href="">1034</reference>
              <reference href="">1288</reference>
              <reference href="">1341</reference>
              <reference href="">1417</reference>
              <reference href="https://public.cyber.mil/stigs/cci/">CCI-002699</reference>
              <reference href="https://public.cyber.mil/stigs/cci/">CCI-001744</reference>
              <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The AIDE package must be installed if it is to be available for integrity checking.</rationale>
              <platform idref="cpe:/a:machine"/>
              <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_aide_installed" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="enable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

if ! rpm -q --quiet "aide" ; then
    dnf install -y "aide"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
              <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_aide_installed" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="enable">- name: Ensure aide is installed
  package:
    name: aide
    state: present
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.10.1.3
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-11.5
    - enable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - package_aide_installed
</fix>
              <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_aide_installed" system="urn:xccdf:fix:script:puppet" complexity="low" disruption="low" strategy="enable">include install_aide

class install_aide {
  package { 'aide':
    ensure =&gt; 'installed',
  }
}
</fix>
              <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_aide_installed" system="urn:redhat:anaconda:pre" complexity="low" disruption="low" strategy="enable">
package --add=aide
</fix>
              <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_aide_installed" system="urn:redhat:osbuild:blueprint">
[[packages]]
name = "aide"
version = "*"
</fix>
              <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <check-content-ref name="oval:ssg-package_aide_installed:def:1" href="ssg-fedora-oval.xml"/>
              </check>
              <check system="http://scap.nist.gov/schema/ocil/2">
                <check-content-ref name="ocil:ssg-package_aide_installed_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
              </check>
            </Rule>
            <Rule id="xccdf_org.ssgproject.content_rule_aide_build_database" selected="false" role="full" severity="medium">
              <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Build and Test AIDE Database</title>
              <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Run the following command to generate a new database:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo /usr/sbin/aide --init</html:pre>
By default, the database will be written to the file <html:code xmlns:html="http://www.w3.org/1999/xhtml">/var/lib/aide/aide.db.new.gz</html:code>.
Storing the database, the configuration file <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/aide.conf</html:code>, and the binary
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/usr/sbin/aide</html:code> (or hashes of these files), in a secure location (such as on read-only media) provides additional assurance about their integrity.
The newly-generated database can be installed as follows:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo cp /var/lib/aide/aide.db.new.gz /var/lib/aide/aide.db.gz</html:pre>
To initiate a manual check, run the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo /usr/sbin/aide --check</html:pre>
If this check produces any unexpected output, investigate.</description>
              <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R51)</reference>
              <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.10.1.3</reference>
              <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
              <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
              <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</reference>
              <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-1</reference>
              <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-6</reference>
              <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-8</reference>
              <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
              <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-3</reference>
              <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-11.5</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.3</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.4</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.2</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.3</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.4</reference>
              <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
              <reference href="https://www.isaca.org/resources/cobit">BAI01.06</reference>
              <reference href="https://www.isaca.org/resources/cobit">BAI02.01</reference>
              <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
              <reference href="https://www.isaca.org/resources/cobit">BAI06.01</reference>
              <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
              <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
              <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
              <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS04.07</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS05.03</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS06.06</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.11.2.4</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.12.1.2</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.12.2.1</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.12.4.1</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.12.5.1</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.12.6.2</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.14.1.2</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.14.2.2</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.14.2.3</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.14.2.4</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.14.2.7</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.15.2.1</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.8.2.3</reference>
              <reference href="https://www.cisecurity.org/controls/">1</reference>
              <reference href="https://www.cisecurity.org/controls/">11</reference>
              <reference href="https://www.cisecurity.org/controls/">12</reference>
              <reference href="https://www.cisecurity.org/controls/">13</reference>
              <reference href="https://www.cisecurity.org/controls/">14</reference>
              <reference href="https://www.cisecurity.org/controls/">15</reference>
              <reference href="https://www.cisecurity.org/controls/">16</reference>
              <reference href="https://www.cisecurity.org/controls/">2</reference>
              <reference href="https://www.cisecurity.org/controls/">3</reference>
              <reference href="https://www.cisecurity.org/controls/">5</reference>
              <reference href="https://www.cisecurity.org/controls/">7</reference>
              <reference href="https://www.cisecurity.org/controls/">8</reference>
              <reference href="https://www.cisecurity.org/controls/">9</reference>
              <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">For AIDE to be effective, an initial database of "known-good" information about files
must be captured and it should be able to be verified against the installed files.</rationale>
              <platform idref="cpe:/a:machine"/>
              <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="aide_build_database" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

if ! rpm -q --quiet "aide" ; then
    dnf install -y "aide"
fi

/usr/sbin/aide --init
/bin/cp -p /var/lib/aide/aide.db.new.gz /var/lib/aide/aide.db.gz

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
              <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="aide_build_database" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Ensure AIDE is installed
  package:
    name: '{{ item }}'
    state: present
  with_items:
    - aide
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.10.1.3
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-11.5
    - aide_build_database
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Build and Test AIDE Database
  command: /usr/sbin/aide --init
  changed_when: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.10.1.3
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-11.5
    - aide_build_database
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Check whether the stock AIDE Database exists
  stat:
    path: /var/lib/aide/aide.db.new.gz
  register: aide_database_stat
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.10.1.3
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-11.5
    - aide_build_database
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Stage AIDE Database
  copy:
    src: /var/lib/aide/aide.db.new.gz
    dest: /var/lib/aide/aide.db.gz
    backup: true
    remote_src: true
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - (aide_database_stat.stat.exists is defined and aide_database_stat.stat.exists)
  tags:
    - CJIS-5.10.1.3
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-11.5
    - aide_build_database
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</fix>
              <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <check-content-ref name="oval:ssg-aide_build_database:def:1" href="ssg-fedora-oval.xml"/>
              </check>
              <check system="http://scap.nist.gov/schema/ocil/2">
                <check-content-ref name="ocil:ssg-aide_build_database_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
              </check>
            </Rule>
            <Rule id="xccdf_org.ssgproject.content_rule_aide_periodic_cron_checking" selected="false" role="full" severity="medium">
              <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Configure Periodic Execution of AIDE</title>
              <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">At a minimum, AIDE should be configured to run a weekly scan.
To implement a daily execution of AIDE at 4:05am using cron, add the following line to <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/crontab</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">05 4 * * * root /usr/sbin/aide --check</html:pre>
To implement a weekly execution of AIDE at 4:05am using cron, add the following line to <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/crontab</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">05 4 * * 0 root /usr/sbin/aide --check</html:pre>
AIDE can be executed periodically through other means; this is merely one example.
The usage of cron's special time codes, such as  <html:code xmlns:html="http://www.w3.org/1999/xhtml">@daily</html:code> and
<html:code xmlns:html="http://www.w3.org/1999/xhtml">@weekly</html:code> is acceptable.</description>
              <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R51)</reference>
              <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.10.1.3</reference>
              <reference href="https://public.cyber.mil/stigs/cci/">CCI-001744</reference>
              <reference href="https://public.cyber.mil/stigs/cci/">CCI-002699</reference>
              <reference href="https://public.cyber.mil/stigs/cci/">CCI-002702</reference>
              <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SI-7</reference>
              <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SI-7(1)</reference>
              <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
              <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
              <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</reference>
              <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-1</reference>
              <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-6</reference>
              <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-8</reference>
              <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
              <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-3</reference>
              <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-11.5</reference>
              <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000363-GPOS-00150</reference>
              <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000446-GPOS-00200</reference>
              <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000447-GPOS-00201</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.3</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.4</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.2</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.3</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.4</reference>
              <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
              <reference href="https://www.isaca.org/resources/cobit">BAI01.06</reference>
              <reference href="https://www.isaca.org/resources/cobit">BAI02.01</reference>
              <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
              <reference href="https://www.isaca.org/resources/cobit">BAI06.01</reference>
              <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
              <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
              <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
              <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS04.07</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS05.03</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS06.06</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.11.2.4</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.12.1.2</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.12.2.1</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.12.4.1</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.12.5.1</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.12.6.2</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.14.1.2</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.14.2.2</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.14.2.3</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.14.2.4</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.14.2.7</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.15.2.1</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.8.2.3</reference>
              <reference href="https://www.cisecurity.org/controls/">1</reference>
              <reference href="https://www.cisecurity.org/controls/">11</reference>
              <reference href="https://www.cisecurity.org/controls/">12</reference>
              <reference href="https://www.cisecurity.org/controls/">13</reference>
              <reference href="https://www.cisecurity.org/controls/">14</reference>
              <reference href="https://www.cisecurity.org/controls/">15</reference>
              <reference href="https://www.cisecurity.org/controls/">16</reference>
              <reference href="https://www.cisecurity.org/controls/">2</reference>
              <reference href="https://www.cisecurity.org/controls/">3</reference>
              <reference href="https://www.cisecurity.org/controls/">5</reference>
              <reference href="https://www.cisecurity.org/controls/">7</reference>
              <reference href="https://www.cisecurity.org/controls/">8</reference>
              <reference href="https://www.cisecurity.org/controls/">9</reference>
              <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">By default, AIDE does not install itself for periodic execution. Periodically
running AIDE is necessary to reveal unexpected changes in installed files.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Unauthorized changes to the baseline configuration could make the system vulnerable
to various attacks or allow unauthorized access to the operating system. Changes to
operating system configurations can have unintended side effects, some of which may
be relevant to security.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Detecting such changes and providing an automated response can help avoid unintended,
negative consequences that could ultimately affect the security state of the operating
system. The operating system's Information Management Officer (IMO)/Information System
Security Officer (ISSO) and System Administrators (SAs) must be notified via email and/or
monitoring system trap when there is an unauthorized modification of a configuration item.</rationale>
              <platform idref="cpe:/a:machine"/>
              <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="aide_periodic_cron_checking" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

if ! rpm -q --quiet "aide" ; then
    dnf install -y "aide"
fi

if ! grep -q "/usr/sbin/aide --check" /etc/crontab ; then
    echo "05 4 * * * root /usr/sbin/aide --check" &gt;&gt; /etc/crontab
else
    sed -i '/^.*\/usr\/sbin\/aide --check.*$/d' /etc/crontab
    echo "05 4 * * * root /usr/sbin/aide --check" &gt;&gt; /etc/crontab
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
              <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="aide_periodic_cron_checking" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Ensure AIDE is installed
  package:
    name: '{{ item }}'
    state: present
  with_items:
    - aide
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.10.1.3
    - NIST-800-53-CM-6(a)
    - NIST-800-53-SI-7
    - NIST-800-53-SI-7(1)
    - PCI-DSS-Req-11.5
    - aide_periodic_cron_checking
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Configure Periodic Execution of AIDE
  cron:
    name: run AIDE check
    minute: 5
    hour: 4
    weekday: 0
    user: root
    job: /usr/sbin/aide --check
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.10.1.3
    - NIST-800-53-CM-6(a)
    - NIST-800-53-SI-7
    - NIST-800-53-SI-7(1)
    - PCI-DSS-Req-11.5
    - aide_periodic_cron_checking
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</fix>
              <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <check-content-ref name="oval:ssg-aide_periodic_cron_checking:def:1" href="ssg-fedora-oval.xml"/>
              </check>
              <check system="http://scap.nist.gov/schema/ocil/2">
                <check-content-ref name="ocil:ssg-aide_periodic_cron_checking_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
              </check>
            </Rule>
          </Group>
        </Group>
        <Group id="xccdf_org.ssgproject.content_group_fips">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Federal Information Processing Standard (FIPS)</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The Federal Information Processing Standard (FIPS) is a computer security standard which
is developed by the U.S. Government and industry working groups to validate the quality
of cryptographic modules. The FIPS standard provides four security levels to ensure
adequate coverage of different industries, implementation of cryptographic modules, and
organizational sizes and requirements.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
FIPS 140-2 is the current standard for validating that mechanisms used to access cryptographic modules
utilize authentication that meets industry and government requirements. For government systems, this allows
Security Levels 1, 2, 3, or 4 for use on Fedora.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
See <html:b xmlns:html="http://www.w3.org/1999/xhtml"><html:a href="http://csrc.nist.gov/publications/PubsFIPS.html">http://csrc.nist.gov/publications/PubsFIPS.html</html:a></html:b> for more information.</description>
          <platform idref="cpe:/a:machine"/>
          <Rule id="xccdf_org.ssgproject.content_rule_sysctl_crypto_fips_enabled" selected="false" role="full" severity="high">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Set kernel parameter 'crypto.fips_enabled' to 1</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">System running in FIPS mode is indicated by kernel parameter
<html:code xmlns:html="http://www.w3.org/1999/xhtml">'crypto.fips_enabled'</html:code>. This parameter should be set to <html:code xmlns:html="http://www.w3.org/1999/xhtml">1</html:code>
in FIPS mode.
To enable FIPS mode, run the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">fips-mode-setup --enable</html:pre></description>
            <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">The system needs to be rebooted for these changes to take effect.</warning>
            <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="regulatory">System Crypto Modules must be provided by a vendor that undergoes
FIPS-140 certifications.
FIPS-140 is applicable to all Federal agencies that use
cryptographic-based security systems to protect sensitive information
in computer and telecommunication systems (including voice systems) as
defined in Section 5131 of the Information Technology Management Reform
Act of 1996, Public Law 104-106. This standard shall be used in
designing and implementing cryptographic modules that Federal
departments and agencies operate or are operated for them under
contract. See <html:b xmlns:html="http://www.w3.org/1999/xhtml"><html:a href="https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-2.pdf">https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-2.pdf</html:a></html:b>
To meet this, the system has to have cryptographic software provided by
a vendor that has undergone this certification. This means providing
documentation, test results, design information, and independent third
party review by an accredited lab. While open source software is
capable of meeting this, it does not meet FIPS-140 unless the vendor
submits to this process.</warning>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000068</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000803</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-002450</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-12(2)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-12(3)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-7</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-13</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-12</reference>
            <reference href="">SRG-OS-000120-VMM-000600</reference>
            <reference href="">SRG-OS-000478-VMM-001980</reference>
            <reference href="">SRG-OS-000396-VMM-001590</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000033-GPOS-00014</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000125-GPOS-00065</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000396-GPOS-00176</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000423-GPOS-00187</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000478-GPOS-00223</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to
protect data. The operating system must implement cryptographic modules adhering to the higher
standards approved by the federal government since this provides assurance they have been tested
and validated.</rationale>
            <platform idref="cpe:/a:machine"/>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-sysctl_crypto_fips_enabled:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-sysctl_crypto_fips_enabled_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_enable_fips_mode" selected="false" role="full" severity="high">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Enable FIPS Mode</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To enable FIPS mode, run the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">fips-mode-setup --enable</html:pre>
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
The <html:code xmlns:html="http://www.w3.org/1999/xhtml">fips-mode-setup</html:code> command will configure the system in
FIPS mode by automatically configuring the following:
<html:ul xmlns:html="http://www.w3.org/1999/xhtml"><html:li>Setting the kernel FIPS mode flag (<html:code>/proc/sys/crypto/fips_enabled</html:code>) to <html:code>1</html:code></html:li><html:li>Creating <html:code>/etc/system-fips</html:code></html:li><html:li>Setting the system crypto policy in <html:code>/etc/crypto-policies/config</html:code> to <html:code>FIPS</html:code></html:li><html:li>Loading the Dracut <html:code>fips</html:code> module</html:li></html:ul>
Furthermore, the system running in FIPS mode should be FIPS certified by NIST.</description>
            <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">The system needs to be rebooted for these changes to take effect.</warning>
            <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="regulatory">System Crypto Modules must be provided by a vendor that undergoes
FIPS-140 certifications.
FIPS-140 is applicable to all Federal agencies that use
cryptographic-based security systems to protect sensitive information
in computer and telecommunication systems (including voice systems) as
defined in Section 5131 of the Information Technology Management Reform
Act of 1996, Public Law 104-106. This standard shall be used in
designing and implementing cryptographic modules that Federal
departments and agencies operate or are operated for them under
contract. See <html:b xmlns:html="http://www.w3.org/1999/xhtml"><html:a href="https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-2.pdf">https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-2.pdf</html:a></html:b>
To meet this, the system has to have cryptographic software provided by
a vendor that has undergone this certification. This means providing
documentation, test results, design information, and independent third
party review by an accredited lab. While open source software is
capable of meeting this, it does not meet FIPS-140 unless the vendor
submits to this process.</warning>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000068</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000803</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-002450</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-12(2)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-12(3)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-7</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-13</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-12</reference>
            <reference href="">SRG-OS-000120-VMM-000600</reference>
            <reference href="">SRG-OS-000478-VMM-001980</reference>
            <reference href="">SRG-OS-000396-VMM-001590</reference>
            <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FCS_COP.1(1)</reference>
            <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FCS_COP.1(2)</reference>
            <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FCS_COP.1(3)</reference>
            <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FCS_COP.1(4)</reference>
            <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FCS_CKM.1</reference>
            <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FCS_CKM.2</reference>
            <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FCS_TLSC_EXT.1</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000478-GPOS-00223</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000396-GPOS-00176</reference>
            <reference href="">1446</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to
protect data. The operating system must implement cryptographic modules adhering to the higher
standards approved by the federal government since this provides assurance they have been tested
and validated.</rationale>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="enable_fips_mode" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

fips-mode-setup --enable

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="enable_fips_mode" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="medium" disruption="medium" strategy="restrict">- name: enable fips mode
  command: /usr/bin/fips-mode-setup --enable
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-7
    - NIST-800-53-SC-12
    - NIST-800-53-SC-12(2)
    - NIST-800-53-SC-12(3)
    - NIST-800-53-SC-13
    - enable_fips_mode
    - high_severity
    - medium_complexity
    - medium_disruption
    - reboot_required
    - restrict_strategy
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-export export-name="oval:ssg-var_system_crypto_policy:var:1" value-id="xccdf_org.ssgproject.content_value_var_system_crypto_policy"/>
              <check-content-ref name="oval:ssg-enable_fips_mode:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-enable_fips_mode_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_etc_system_fips_exists" selected="false" role="full" severity="high">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure '/etc/system-fips' exists</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">On a system where FIPS mode is enabled, <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/system-fips</html:code> must exist.
To enable FIPS mode, run the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">fips-mode-setup --enable</html:pre></description>
            <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">The system needs to be rebooted for these changes to take effect.</warning>
            <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="regulatory">System Crypto Modules must be provided by a vendor that undergoes
FIPS-140 certifications.
FIPS-140 is applicable to all Federal agencies that use
cryptographic-based security systems to protect sensitive information
in computer and telecommunication systems (including voice systems) as
defined in Section 5131 of the Information Technology Management Reform
Act of 1996, Public Law 104-106. This standard shall be used in
designing and implementing cryptographic modules that Federal
departments and agencies operate or are operated for them under
contract. See <html:b xmlns:html="http://www.w3.org/1999/xhtml"><html:a href="https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-2.pdf">https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-2.pdf</html:a></html:b>
To meet this, the system has to have cryptographic software provided by
a vendor that has undergone this certification. This means providing
documentation, test results, design information, and independent third
party review by an accredited lab. While open source software is
capable of meeting this, it does not meet FIPS-140 unless the vendor
submits to this process.</warning>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000068</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000803</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-002450</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-12(2)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-12(3)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-7</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-13</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-12</reference>
            <reference href="">SRG-OS-000120-VMM-000600</reference>
            <reference href="">SRG-OS-000478-VMM-001980</reference>
            <reference href="">SRG-OS-000396-VMM-001590</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to
protect data. The operating system must implement cryptographic modules adhering to the higher
standards approved by the federal government since this provides assurance they have been tested
and validated.</rationale>
            <platform idref="cpe:/a:machine"/>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-etc_system_fips_exists:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-etc_system_fips_exists_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_enable_dracut_fips_module" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Enable Dracut FIPS Module</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To enable FIPS mode, run the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">fips-mode-setup --enable</html:pre>
To enable FIPS, the system requires that the <html:code xmlns:html="http://www.w3.org/1999/xhtml">fips</html:code> module is added in
<html:code xmlns:html="http://www.w3.org/1999/xhtml">dracut</html:code> configuration.
Check if <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/dracut.conf.d/40-fips.conf</html:code> contain <html:code xmlns:html="http://www.w3.org/1999/xhtml">add_dracutmodules+=" fips "</html:code></description>
            <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">The system needs to be rebooted for these changes to take effect.</warning>
            <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="regulatory">System Crypto Modules must be provided by a vendor that undergoes
FIPS-140 certifications.
FIPS-140 is applicable to all Federal agencies that use
cryptographic-based security systems to protect sensitive information
in computer and telecommunication systems (including voice systems) as
defined in Section 5131 of the Information Technology Management Reform
Act of 1996, Public Law 104-106. This standard shall be used in
designing and implementing cryptographic modules that Federal
departments and agencies operate or are operated for them under
contract. See <html:b xmlns:html="http://www.w3.org/1999/xhtml"><html:a href="https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-2.pdf">https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-2.pdf</html:a></html:b>
To meet this, the system has to have cryptographic software provided by
a vendor that has undergone this certification. This means providing
documentation, test results, design information, and independent third
party review by an accredited lab. While open source software is
capable of meeting this, it does not meet FIPS-140 unless the vendor
submits to this process.</warning>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000068</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000803</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-002450</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-12(2)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-12(3)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-7</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-13</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-12</reference>
            <reference href="">SRG-OS-000120-VMM-000600</reference>
            <reference href="">SRG-OS-000478-VMM-001980</reference>
            <reference href="">SRG-OS-000396-VMM-001590</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000478-GPOS-00223</reference>
            <reference href="">1446</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to
protect data. The operating system must implement cryptographic modules adhering to the higher
standards approved by the federal government since this provides assurance they have been tested
and validated.</rationale>
            <platform idref="cpe:/a:machine"/>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-enable_dracut_fips_module:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-enable_dracut_fips_module_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
        </Group>
        <Group id="xccdf_org.ssgproject.content_group_crypto">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">System Cryptographic Policies</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Linux has the capability to centrally configure cryptographic polices. The command
<html:code xmlns:html="http://www.w3.org/1999/xhtml">update-crypto-policies</html:code> is used to set the policy applicable for the various
cryptographic back-ends, such as SSL/TLS libraries. The configured cryptographic
policies will be the default policy used by these backends unless the application
user configures them otherwise. When the system has been configured to use the
centralized cryptographic policies, the administrator is assured that any application
that utilizes the supported backends will follow a policy that adheres to the
configured profile.

Currently the supported backends are:
<html:ul xmlns:html="http://www.w3.org/1999/xhtml"><html:li>GnuTLS library</html:li><html:li>OpenSSL library</html:li><html:li>NSS library</html:li><html:li>OpenJDK</html:li><html:li>Libkrb5</html:li><html:li>BIND</html:li><html:li>OpenSSH</html:li></html:ul>
Applications and languages which rely on any of these backends will follow the
system policies as well. Examples are apache httpd, nginx, php, and others.</description>
          <Value id="xccdf_org.ssgproject.content_value_var_ssh_client_rekey_limit_size" type="string" interactive="true">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">SSH client RekeyLimit - size</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Specify the size component of the rekey limit. This limit signifies amount
of data. After this amount of data is transferred through the connection,
the session key is renegotiated. The number is followed by K, M or G for
kilobytes, megabytes or gigabytes. Note that the RekeyLimit can be also
configured according to elapsed time.</description>
            <value>512M</value>
            <value selector="512M">512M</value>
            <value selector="1G">1G</value>
          </Value>
          <Value id="xccdf_org.ssgproject.content_value_var_ssh_client_rekey_limit_time" type="string" interactive="true">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">SSH client RekeyLimit - time</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Specify the time component of the rekey limit. The session key is
renegotiated after the defined amount of time passes. The number is followed
by units such as H or M for hours or minutes. Note that the RekeyLimit can
be also configured according to amount of transfered data.</description>
            <value>1h</value>
            <value selector="1hour">1h</value>
          </Value>
          <Value id="xccdf_org.ssgproject.content_value_var_system_crypto_policy" type="string">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The system-provided crypto policies</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Specify the crypto policy for the system.</description>
            <value>DEFAULT</value>
            <value selector="default_nosha1">DEFAULT:NO-SHA1</value>
            <value selector="fips">FIPS</value>
            <value selector="fips_ospp">FIPS:OSPP</value>
            <value selector="legacy">LEGACY</value>
            <value selector="future">FUTURE</value>
            <value selector="next">NEXT</value>
          </Value>
          <Rule id="xccdf_org.ssgproject.content_rule_configure_openssl_crypto_policy" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Configure OpenSSL library to use System Crypto Policy</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Crypto Policies provide a centralized control over crypto algorithms usage of many packages.
OpenSSL is supported by crypto policy, but the OpenSSL configuration may be
set up to ignore it.
To check that Crypto Policies settings are configured correctly, you have to examine the OpenSSL config file
available under <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/pki/tls/openssl.cnf</html:code>.
This file has the <html:code xmlns:html="http://www.w3.org/1999/xhtml">ini</html:code> format, and it enables crypto policy support
if there is a <html:code xmlns:html="http://www.w3.org/1999/xhtml">[ crypto_policy ]</html:code> section that contains the <html:code xmlns:html="http://www.w3.org/1999/xhtml">.include /etc/crypto-policies/back-ends/opensslcnf.config</html:code> directive.</description>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(2)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">MA-4(6)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-13</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-12(2)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-12(3)</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000250-GPOS-00093</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-001453</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Overriding the system crypto policy makes the behavior of the Java runtime violates expectations,
and makes system configuration more fragmented.</rationale>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="configure_openssl_crypto_policy" system="urn:xccdf:fix:script:sh">
OPENSSL_CRYPTO_POLICY_SECTION='[ crypto_policy ]'
OPENSSL_CRYPTO_POLICY_SECTION_REGEX='\[\s*crypto_policy\s*\]'
OPENSSL_CRYPTO_POLICY_INCLUSION='.include /etc/crypto-policies/back-ends/opensslcnf.config'
OPENSSL_CRYPTO_POLICY_INCLUSION_REGEX='^\s*\.include\s*/etc/crypto-policies/back-ends/opensslcnf.config$'

function remediate_openssl_crypto_policy() {
	CONFIG_FILE="/etc/pki/tls/openssl.cnf"
	if test -f "$CONFIG_FILE"; then
		if ! grep -q "^\\s*$OPENSSL_CRYPTO_POLICY_SECTION_REGEX" "$CONFIG_FILE"; then
			printf '\n%s\n\n%s' "$OPENSSL_CRYPTO_POLICY_SECTION" "$OPENSSL_CRYPTO_POLICY_INCLUSION" &gt;&gt; "$CONFIG_FILE"
			return 0
		elif ! grep -q "^\\s*$OPENSSL_CRYPTO_POLICY_INCLUSION_REGEX" "$CONFIG_FILE"; then
			sed -i "s|$OPENSSL_CRYPTO_POLICY_SECTION_REGEX|&amp;\\n\\n$OPENSSL_CRYPTO_POLICY_INCLUSION\\n|" "$CONFIG_FILE"
			return 0
		fi
	else
		echo "Aborting remediation as '$CONFIG_FILE' was not even found." &gt;&amp;2
		return 1
	fi
}

remediate_openssl_crypto_policy
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="configure_openssl_crypto_policy" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="medium">- name: Test for crypto_policy group
  command: grep '^\s*\[\s*crypto_policy\s*]' /etc/pki/tls/openssl.cnf
  register: test_crypto_policy_group
  ignore_errors: true
  changed_when: false
  check_mode: false
  tags:
    - NIST-800-53-AC-17(2)
    - NIST-800-53-AC-17(a)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-MA-4(6)
    - NIST-800-53-SC-12(2)
    - NIST-800-53-SC-12(3)
    - NIST-800-53-SC-13
    - configure_openssl_crypto_policy
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Add .include for opensslcnf.config to crypto_policy section
  lineinfile:
    create: true
    insertafter: ^\s*\[\s*crypto_policy\s*]\s*
    line: .include /etc/crypto-policies/back-ends/opensslcnf.config
    path: /etc/pki/tls/openssl.cnf
  when:
    - test_crypto_policy_group.stdout is defined
    - test_crypto_policy_group.stdout | length &gt; 0
  tags:
    - NIST-800-53-AC-17(2)
    - NIST-800-53-AC-17(a)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-MA-4(6)
    - NIST-800-53-SC-12(2)
    - NIST-800-53-SC-12(3)
    - NIST-800-53-SC-13
    - configure_openssl_crypto_policy
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Add crypto_policy group and set include opensslcnf.config
  lineinfile:
    create: true
    line: |-
      [crypto_policy]
      .include /etc/crypto-policies/back-ends/opensslcnf.config
    path: /etc/pki/tls/openssl.cnf
  when:
    - test_crypto_policy_group.stdout is defined
    - test_crypto_policy_group.stdout | length &lt; 1
  tags:
    - NIST-800-53-AC-17(2)
    - NIST-800-53-AC-17(a)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-MA-4(6)
    - NIST-800-53-SC-12(2)
    - NIST-800-53-SC-12(3)
    - NIST-800-53-SC-13
    - configure_openssl_crypto_policy
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-configure_openssl_crypto_policy:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-configure_openssl_crypto_policy_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_harden_sshd_crypto_policy" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Harden SSHD Crypto Policy</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Crypto Policies are means of enforcing certain cryptographic settings for selected applications including OpenSSH server.
The SSHD service is by default configured to modify its configuration based on currently configured Crypto-Policy. However, in certain cases it might be needed to override the Crypto Policy specific to OpenSSH Server and leave rest of the Crypto Policy intact.
This can be done by dropping a file named <html:code xmlns:html="http://www.w3.org/1999/xhtml">opensshserver-xxx.config</html:code>, replacing <html:code xmlns:html="http://www.w3.org/1999/xhtml">xxx</html:code> with arbitrary identifier, into <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/crypto-policies/local.d</html:code>. This has to be followed by running <html:code xmlns:html="http://www.w3.org/1999/xhtml">update-crypto-policies</html:code> so that changes are applied.
Changes are propagated into <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/crypto-policies/back-ends/opensshserver.config</html:code>. This rule checks if this file contains predefined <html:code xmlns:html="http://www.w3.org/1999/xhtml">CRYPTO_POLICY</html:code> environment variable configured with predefined value.</description>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(2)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">MA-4(6)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-13</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-12(2)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-12(3)</reference>
            <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FCS_SSHS_EXT.1</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000250-GPOS-00093</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000033-GPOS-00014</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000120-GPOS-00061</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The Common Criteria requirements specify that certain parameters for OpenSSH Server are configured e.g. supported ciphers, accepted host key algorithms, public key types, key exchange algorithms, HMACs and GSSAPI key exchange is disabled. Currently particular requirements specified by CC are stricter compared to any existing Crypto Policy.</rationale>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="harden_sshd_crypto_policy" system="urn:xccdf:fix:script:sh">
cp="CRYPTO_POLICY='-oCiphers=aes256-ctr,aes128-ctr,aes256-cbc,aes128-cbc -oMACs=hmac-sha2-512,hmac-sha2-256 -oGSSAPIKeyExchange=no -oKexAlgorithms=ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group14-sha1 -oHostKeyAlgorithms=ssh-rsa,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256 -oPubkeyAcceptedKeyTypes=rsa-sha2-512,rsa-sha2-256,ssh-rsa,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256'"
file=/etc/crypto-policies/local.d/opensshserver-ospp.config

#blank line at the begining to ease later readibility
echo '' &gt; "$file"
echo "$cp" &gt;&gt; "$file"
update-crypto-policies
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-export export-name="oval:ssg-sshd_required:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_required"/>
              <check-content-ref name="oval:ssg-harden_sshd_crypto_policy:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-harden_sshd_crypto_policy_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_configure_libreswan_crypto_policy" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Configure Libreswan to use System Crypto Policy</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Crypto Policies provide a centralized control over crypto algorithms usage of many packages.
Libreswan is supported by system crypto policy, but the Libreswan configuration may be
set up to ignore it.

To check that Crypto Policies settings are configured correctly, ensure that the <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/ipsec.conf</html:code>
includes the appropriate configuration file.
In <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/ipsec.conf</html:code>, make sure that the following line
is not commented out or superseded by later includes:
<html:code xmlns:html="http://www.w3.org/1999/xhtml">include /etc/crypto-policies/back-ends/libreswan.config</html:code></description>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">MA-4(6)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-13</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-12(2)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-12(3)</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000033-GPOS-00014</reference>
            <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FCS_IPSEC_EXT.1.4</reference>
            <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FCS_IPSEC_EXT.1.6</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Overriding the system crypto policy makes the behavior of the Libreswan
service violate expectations, and makes system configuration more
fragmented.</rationale>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="configure_libreswan_crypto_policy" system="urn:xccdf:fix:script:sh">
function remediate_libreswan_crypto_policy() {
    CONFIG_FILE="/etc/ipsec.conf"
    if ! grep -qP "^\s*include\s+/etc/crypto-policies/back-ends/libreswan.config\s*(?:#.*)?$" "$CONFIG_FILE" ; then
        echo 'include /etc/crypto-policies/back-ends/libreswan.config' &gt;&gt; "$CONFIG_FILE"
    fi
    return 0
}

remediate_libreswan_crypto_policy
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="configure_libreswan_crypto_policy" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Configure Libreswan to use System Crypto Policy
  lineinfile:
    path: /etc/ipsec.conf
    line: include /etc/crypto-policies/back-ends/libreswan.config
    create: true
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-MA-4(6)
    - NIST-800-53-SC-12(2)
    - NIST-800-53-SC-12(3)
    - NIST-800-53-SC-13
    - configure_libreswan_crypto_policy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-configure_libreswan_crypto_policy:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-configure_libreswan_crypto_policy_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_harden_ssh_client_crypto_policy" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Harden SSH client Crypto Policy</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Crypto Policies are means of enforcing certain cryptographic settings for selected applications including OpenSSH client.
To override the system wide crypto policy for Openssh client, place a file in the <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/ssh/ssh_config.d/</html:code> so that it is loaded before the <html:code xmlns:html="http://www.w3.org/1999/xhtml">05-redhat.conf</html:code>. In this case it is file named <html:code xmlns:html="http://www.w3.org/1999/xhtml">02-ospp.conf</html:code> containing parameters which need to be changed with respect to the crypto policy.
This rule checks if the file exists and if it contains required parameters and values which modify the Crypto Policy.
During the parsing process, as soon as Openssh client parses some configuration option and its value, it remembers it and ignores any subsequent overrides. The customization mechanism provided by crypto policies appends eventual customizations at the end of the system wide crypto policy. Therefore, if the crypto policy customization overrides some parameter which is already configured in the system wide crypto policy, the SSH client will not honor that customized parameter.</description>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(2)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">MA-4(6)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-13</reference>
            <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FCS_SSHC_EXT.1</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000033-GPOS-00014</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000250-GPOS-00093</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000393-GPOS-00173</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000394-GPOS-00174</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The Common Criteria requirements specify how certain parameters for OpenSSH Client are configured. Particular parameters are RekeyLimit, GSSAPIAuthentication, Ciphers, PubkeyAcceptedKeyTypes, MACs and KexAlgorithms. Currently particular requirements specified by CC are stricter compared to any existing Crypto Policy.</rationale>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="harden_ssh_client_crypto_policy" system="urn:xccdf:fix:script:sh">
#the file starts with 02 so that it is loaded before the 05-redhat.conf which activates configuration provided by system vide crypto policy
file="/etc/ssh/ssh_config.d/02-ospp.conf"
echo -e "Match final all\n\
RekeyLimit 512M 1h\n\
GSSAPIAuthentication no\n\
Ciphers aes256-ctr,aes256-cbc,aes128-ctr,aes128-cbc\n\
PubkeyAcceptedKeyTypes ssh-rsa,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256\n\
MACs hmac-sha2-512,hmac-sha2-256\n\
KexAlgorithms ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group14-sha1\n" &gt; "$file"
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-harden_ssh_client_crypto_policy:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-harden_ssh_client_crypto_policy_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_configure_ssh_crypto_policy" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Configure SSH to use System Crypto Policy</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Crypto Policies provide a centralized control over crypto algorithms usage of many packages.
SSH is supported by crypto policy, but the SSH configuration may be
set up to ignore it.
To check that Crypto Policies settings are configured correctly, ensure that
the <html:code xmlns:html="http://www.w3.org/1999/xhtml">CRYPTO_POLICY</html:code> variable is either commented or not set at all
in the <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/sysconfig/sshd</html:code>.</description>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(2)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">MA-4(6)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-13</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000250-GPOS-00093</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(4)(i)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(1)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(3)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(1)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(2)(ii)</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Overriding the system crypto policy makes the behavior of the SSH service violate expectations,
and makes system configuration more fragmented.</rationale>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="configure_ssh_crypto_policy" system="urn:xccdf:fix:script:sh">
SSH_CONF="/etc/sysconfig/sshd"

sed -i "/^\s*CRYPTO_POLICY.*$/d" $SSH_CONF
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="configure_ssh_crypto_policy" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="medium" strategy="disable">- name: Configure SSH to use System Crypto Policy
  lineinfile:
    dest: /etc/sysconfig/sshd
    state: absent
    regexp: ^\s*CRYPTO_POLICY.*$
  tags:
    - NIST-800-53-AC-17(2)
    - NIST-800-53-AC-17(a)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-MA-4(6)
    - NIST-800-53-SC-13
    - configure_ssh_crypto_policy
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-configure_ssh_crypto_policy:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-configure_ssh_crypto_policy_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_configure_crypto_policy" selected="false" role="full" severity="high">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Configure System Cryptography Policy</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To configure the system cryptography policy to use ciphers only from the <html:code xmlns:html="http://www.w3.org/1999/xhtml" xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2"><xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_system_crypto_policy" use="legacy"/></html:code>
policy, run the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml" xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2">$ sudo update-crypto-policies --set <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_system_crypto_policy" use="legacy"/></html:pre>
The rule checks if settings for selected crypto policy are configured as expected. Configuration files in the <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/crypto-policies/back-ends</html:code> are either symlinks to correct files provided by Crypto-policies package or they are regular files in case crypto policy customizations are applied.
Crypto policies may be customized by crypto policy modules, in which case it is delimited from the base policy using a colon.</description>
            <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">The system needs to be rebooted for these changes to take effect.</warning>
            <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="regulatory">System Crypto Modules must be provided by a vendor that undergoes
FIPS-140 certifications.
FIPS-140 is applicable to all Federal agencies that use
cryptographic-based security systems to protect sensitive information
in computer and telecommunication systems (including voice systems) as
defined in Section 5131 of the Information Technology Management Reform
Act of 1996, Public Law 104-106. This standard shall be used in
designing and implementing cryptographic modules that Federal
departments and agencies operate or are operated for them under
contract. See <html:b xmlns:html="http://www.w3.org/1999/xhtml"><html:a href="https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-2.pdf">https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-2.pdf</html:a></html:b>
To meet this, the system has to have cryptographic software provided by
a vendor that has undergone this certification. This means providing
documentation, test results, design information, and independent third
party review by an accredited lab. While open source software is
capable of meeting this, it does not meet FIPS-140 unless the vendor
submits to this process.</warning>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(2)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">MA-4(6)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-13</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-12(2)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-12(3)</reference>
            <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FCS_COP.1(1)</reference>
            <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FCS_COP.1(2)</reference>
            <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FCS_COP.1(3)</reference>
            <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FCS_COP.1(4)</reference>
            <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FCS_CKM.1</reference>
            <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FCS_CKM.2</reference>
            <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FCS_TLSC_EXT.1</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000396-GPOS-00176</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000393-GPOS-00173</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000394-GPOS-00174</reference>
            <reference href="">1446</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(4)(i)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(1)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(3)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(1)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(2)(ii)</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Centralized cryptographic policies simplify applying secure ciphers across an operating system and
the applications that run on that operating system. Use of weak or untested encryption algorithms
undermines the purposes of utilizing encryption to protect data.</rationale>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="configure_crypto_policy" system="urn:xccdf:fix:script:sh">
# include remediation functions library

var_system_crypto_policy="<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_system_crypto_policy" use="legacy"/>"



stderr_of_call=$(update-crypto-policies --set ${var_system_crypto_policy} 2&gt;&amp;1 &gt; /dev/null)
rc=$?

if test "$rc" = 127; then
	echo "$stderr_of_call" &gt;&amp;2
	echo "Make sure that the script is installed on the remediated system." &gt;&amp;2
	echo "See output of the 'dnf provides update-crypto-policies' command" &gt;&amp;2
	echo "to see what package to (re)install" &gt;&amp;2

	false  # end with an error code
elif test "$rc" != 0; then
	echo "Error invoking the update-crypto-policies script: $stderr_of_call" &gt;&amp;2
	false  # end with an error code
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="configure_crypto_policy" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: XCCDF Value var_system_crypto_policy # promote to variable
  set_fact:
    var_system_crypto_policy: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_system_crypto_policy" use="legacy"/>
  tags:
    - always

- name: Configure System Cryptography Policy
  lineinfile:
    path: /etc/crypto-policies/config
    regexp: ^(?!#)(\S+)$
    line: '{{ var_system_crypto_policy }}'
    create: true
  tags:
    - NIST-800-53-AC-17(2)
    - NIST-800-53-AC-17(a)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-MA-4(6)
    - NIST-800-53-SC-12(2)
    - NIST-800-53-SC-12(3)
    - NIST-800-53-SC-13
    - configure_crypto_policy
    - high_severity
    - low_complexity
    - low_disruption
    - no_reboot_needed
    - restrict_strategy

- name: Verify that Crypto Policy is Set (runtime)
  command: /usr/bin/update-crypto-policies --set {{ var_system_crypto_policy }}
  tags:
    - NIST-800-53-AC-17(2)
    - NIST-800-53-AC-17(a)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-MA-4(6)
    - NIST-800-53-SC-12(2)
    - NIST-800-53-SC-12(3)
    - NIST-800-53-SC-13
    - configure_crypto_policy
    - high_severity
    - low_complexity
    - low_disruption
    - no_reboot_needed
    - restrict_strategy
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-export export-name="oval:ssg-var_system_crypto_policy:var:1" value-id="xccdf_org.ssgproject.content_value_var_system_crypto_policy"/>
              <check-content-ref name="oval:ssg-configure_crypto_policy:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-configure_crypto_policy_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_configure_bind_crypto_policy" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Configure BIND to use System Crypto Policy</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Crypto Policies provide a centralized control over crypto algorithms usage of many packages.
BIND is supported by crypto policy, but the BIND configuration may be
set up to ignore it.

To check that Crypto Policies settings are configured correctly, ensure that the <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/named.conf</html:code>
includes the appropriate configuration:
In the <html:code xmlns:html="http://www.w3.org/1999/xhtml">options</html:code> section of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/named.conf</html:code>, make sure that the following line
is not commented out or superseded by later includes:
<html:code xmlns:html="http://www.w3.org/1999/xhtml">include "/etc/crypto-policies/back-ends/bind.config";</html:code></description>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-13</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-12(2)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-12(3)</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000423-GPOS-00187</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000426-GPOS-00190</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Overriding the system crypto policy makes the behavior of the BIND service violate expectations,
and makes system configuration more fragmented.</rationale>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="configure_bind_crypto_policy" system="urn:xccdf:fix:script:sh">
function remediate_bind_crypto_policy() {
	CONFIG_FILE="/etc/named.conf"
	if test -f "$CONFIG_FILE"; then
		sed -i 's|options {|&amp;\n\tinclude "/etc/crypto-policies/back-ends/bind.config";|' "$CONFIG_FILE"
		return 0
	else
		echo "Aborting remediation as '$CONFIG_FILE' was not even found." &gt;&amp;2
		return 1
	fi
}

remediate_bind_crypto_policy
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-configure_bind_crypto_policy:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-configure_bind_crypto_policy_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_configure_kerberos_crypto_policy" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Configure Kerberos to use System Crypto Policy</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Crypto Policies provide a centralized control over crypto algorithms usage of many packages.
Kerberos is supported by crypto policy, but it's configuration may be
set up to ignore it.
To check that Crypto Policies settings for Kerberos are configured correctly, examine that there is a symlink at
/etc/krb5.conf.d/crypto-policies targeting /etc/cypto-policies/back-ends/krb5.config.
If the symlink exists, kerberos is configured to use the system-wide crypto policy settings.</description>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-13</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-12(2)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-12(3)</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000120-GPOS-00061</reference>
            <reference href="">0418</reference>
            <reference href="">1055</reference>
            <reference href="">1402</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Overriding the system crypto policy makes the behavior of Kerberos violate expectations,
and makes system configuration more fragmented.</rationale>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="configure_kerberos_crypto_policy" system="urn:xccdf:fix:script:sh" reboot="true" complexity="low" disruption="low" strategy="configure">
rm -f /etc/krb5.conf.d/crypto-policies
ln -s /etc/crypto-policies/back-ends/krb5.config /etc/krb5.conf.d/crypto-policies
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="configure_kerberos_crypto_policy" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="low" strategy="configure">- name: Configure Kerberos to use System Crypto Policy
  file:
    src: /etc/crypto-policies/back-ends/krb5.config
    path: /etc/krb5.conf.d/crypto-policies
    state: link
  tags:
    - NIST-800-53-SC-12(2)
    - NIST-800-53-SC-12(3)
    - NIST-800-53-SC-13
    - configure_kerberos_crypto_policy
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-configure_kerberos_crypto_policy:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-configure_kerberos_crypto_policy_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
        </Group>
        <Group id="xccdf_org.ssgproject.content_group_endpoint_security_software">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Endpoint Protection Software</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Endpoint protection security software that is not provided or supported

by Red Hat can be installed to provide complementary or duplicative

security capabilities to those provided by the base platform.  Add-on
software may not be appropriate for some specialized systems.</description>
          <Rule id="xccdf_org.ssgproject.content_rule_install_hids" selected="false" role="full" severity="high">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Install Intrusion Detection Software</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The base Fedora platform already includes a sophisticated auditing system that
can detect intruder activity, as well as SELinux, which provides host-based
intrusion prevention capabilities by confining privileged programs and user
sessions which may become compromised.</description>
            <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">In DoD environments, supplemental intrusion detection and antivirus tools,
such as the McAfee Host-based Security System, are available to integrate with
existing infrastructure. Per DISA guidance, when these supplemental tools interfere
with proper functioning of SELinux, SELinux takes precedence. Should further
clarification be required, DISA contact information is published publicly at
https://public.cyber.mil/stigs/</warning>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-001263</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-5</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
            <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-11.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.4</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.10.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.1.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.1.5</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.1.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.7.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.7.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.7.3.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.8.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.8.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.5</reference>
            <reference href="https://www.cisecurity.org/controls/">1</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">13</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">18</reference>
            <reference href="https://www.cisecurity.org/controls/">7</reference>
            <reference href="https://www.cisecurity.org/controls/">8</reference>
            <reference href="https://www.cisecurity.org/controls/">9</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Host-based intrusion detection tools provide a system-level defense when an
intruder gains access to a system or network.</rationale>
            <platform idref="cpe:/a:machine"/>
            <conflicts idref="xccdf_org.ssgproject.content_rule_selinux_state"/>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-install_hids:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-install_hids_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_install_antivirus" selected="false" role="full" severity="high">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Install Virus Scanning Software</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Virus scanning software can be used to protect a system from penetration from
computer viruses and to limit their spread through intermediate systems.

The virus scanning software should be configured to perform scans dynamically
on accessed files. If this capability is not available, the system must be
configured to scan, at a minimum, all altered files on the system on a daily
basis.

If the system processes inbound SMTP mail, the virus scanner must be configured
to scan all received mail.</description>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-001239</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-001668</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.DP-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-1</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.3.2</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO13.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI02.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI06.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS04.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.06</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.8</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.8.2.3</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">13</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">4</reference>
            <reference href="https://www.cisecurity.org/controls/">7</reference>
            <reference href="https://www.cisecurity.org/controls/">8</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Virus scanning software can be used to detect if a system has been compromised by
computer viruses, as well as to limit their spread to other systems.</rationale>
            <platform idref="cpe:/a:machine"/>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-install_antivirus:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-install_antivirus_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_configure_user_data_backups" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Configure Backups of User Data</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The operating system must conduct backups of user data contained
in the operating system. The operating system provides utilities for
automating backups of user data. Commercial and open-source products
are also available.</description>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Operating system backup is a critical step in maintaining data assurance and
availability. User-level information is data generated by information system
and/or application users. Backups shall be consistent with organizational
recovery time and recovery point objectives.</rationale>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-configure_user_data_backups_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Group id="xccdf_org.ssgproject.content_group_mcafee_security_software">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">McAfee Endpoint Security Software</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">In DoD environments, McAfee Host-based Security System (HBSS) and
VirusScan Enterprise for Linux (VSEL) is required to be installed on all systems.</description>
            <Value id="xccdf_org.ssgproject.content_value_var_mcafee_antivirus_definition_expire" type="number">
              <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The age of McAfee defintion file before requiring updating</title>
              <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Specify the amount of time (in seconds) before McAfee definition files need to be
updated.</description>
              <value>2592000</value>
              <value selector="1_day">86400</value>
              <value selector="1_week">604800</value>
              <value selector="30_days">2592000</value>
            </Value>
            <Group id="xccdf_org.ssgproject.content_group_mcafee_hbss_software">
              <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">McAfee Host-Based Intrusion Detection Software (HBSS)</title>
              <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">McAfee Host-based Security System (HBSS) is a suite of software applications
used to monitor, detect, and defend computer networks and systems.</description>
              <Rule id="xccdf_org.ssgproject.content_rule_package_MFEhiplsm_installed" selected="false" role="full" severity="medium">
                <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Install the Host Intrusion Prevention System (HIPS) Module</title>
                <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Install the McAfee Host Intrusion Prevention System (HIPS) Module if it is absolutely
necessary. If SELinux is enabled, do not install or enable this module.</description>
                <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="functionality">Installing and enabling this module conflicts with SELinux.
Per DoD/DISA guidance, SELinux takes precedence over this module.</warning>
                <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">Due to McAfee HIPS being 3rd party software, automated
remediation is not available for this configuration check.</warning>
                <reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</reference>
                <reference href="https://public.cyber.mil/stigs/cci/">CCI-001233</reference>
                <reference href="https://public.cyber.mil/stigs/cci/">CCI-001263</reference>
                <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
                <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-1</reference>
                <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-2</reference>
                <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</reference>
                <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-4</reference>
                <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
                <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-5</reference>
                <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-6</reference>
                <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</reference>
                <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.DP-2</reference>
                <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.DP-3</reference>
                <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.DP-4</reference>
                <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.DP-5</reference>
                <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.RA-1</reference>
                <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-5</reference>
                <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</reference>
                <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-8</reference>
                <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
                <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</reference>
                <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.CO-3</reference>
                <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-11.4</reference>
                <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000191-GPOS-00080</reference>
                <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000196</reference>
                <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
                <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</reference>
                <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</reference>
                <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</reference>
                <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.4</reference>
                <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</reference>
                <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</reference>
                <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</reference>
                <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.3</reference>
                <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.5</reference>
                <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</reference>
                <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.9</reference>
                <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</reference>
                <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.3</reference>
                <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.1</reference>
                <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
                <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.3</reference>
                <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.1</reference>
                <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</reference>
                <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</reference>
                <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
                <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3</reference>
                <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.12</reference>
                <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.7</reference>
                <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.9</reference>
                <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.4</reference>
                <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.2</reference>
                <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.6</reference>
                <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.7</reference>
                <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.8</reference>
                <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.9</reference>
                <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.3.2</reference>
                <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.3.3</reference>
                <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.3.4</reference>
                <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
                <reference href="https://www.isaca.org/resources/cobit">APO07.06</reference>
                <reference href="https://www.isaca.org/resources/cobit">APO08.04</reference>
                <reference href="https://www.isaca.org/resources/cobit">APO10.05</reference>
                <reference href="https://www.isaca.org/resources/cobit">APO11.06</reference>
                <reference href="https://www.isaca.org/resources/cobit">APO12.01</reference>
                <reference href="https://www.isaca.org/resources/cobit">APO12.02</reference>
                <reference href="https://www.isaca.org/resources/cobit">APO12.03</reference>
                <reference href="https://www.isaca.org/resources/cobit">APO12.04</reference>
                <reference href="https://www.isaca.org/resources/cobit">APO12.06</reference>
                <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
                <reference href="https://www.isaca.org/resources/cobit">APO13.02</reference>
                <reference href="https://www.isaca.org/resources/cobit">BAI08.02</reference>
                <reference href="https://www.isaca.org/resources/cobit">BAI08.04</reference>
                <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
                <reference href="https://www.isaca.org/resources/cobit">DSS01.05</reference>
                <reference href="https://www.isaca.org/resources/cobit">DSS02.04</reference>
                <reference href="https://www.isaca.org/resources/cobit">DSS02.05</reference>
                <reference href="https://www.isaca.org/resources/cobit">DSS02.07</reference>
                <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
                <reference href="https://www.isaca.org/resources/cobit">DSS03.04</reference>
                <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
                <reference href="https://www.isaca.org/resources/cobit">DSS04.05</reference>
                <reference href="https://www.isaca.org/resources/cobit">DSS05.01</reference>
                <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
                <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
                <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
                <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
                <reference href="https://www.isaca.org/resources/cobit">DSS06.01</reference>
                <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
                <reference href="https://www.isaca.org/resources/cobit">MEA03.03</reference>
                <reference href="https://www.isaca.org/resources/cobit">MEA03.04</reference>
                <reference href="https://www.iso.org/standard/54534.html">A.10.1.1</reference>
                <reference href="https://www.iso.org/standard/54534.html">A.11.1.4</reference>
                <reference href="https://www.iso.org/standard/54534.html">A.11.1.5</reference>
                <reference href="https://www.iso.org/standard/54534.html">A.11.2.1</reference>
                <reference href="https://www.iso.org/standard/54534.html">A.12.1.1</reference>
                <reference href="https://www.iso.org/standard/54534.html">A.12.1.2</reference>
                <reference href="https://www.iso.org/standard/54534.html">A.12.4.1</reference>
                <reference href="https://www.iso.org/standard/54534.html">A.12.4.3</reference>
                <reference href="https://www.iso.org/standard/54534.html">A.12.5.1</reference>
                <reference href="https://www.iso.org/standard/54534.html">A.12.6.1</reference>
                <reference href="https://www.iso.org/standard/54534.html">A.12.6.2</reference>
                <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
                <reference href="https://www.iso.org/standard/54534.html">A.13.1.2</reference>
                <reference href="https://www.iso.org/standard/54534.html">A.13.1.3</reference>
                <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
                <reference href="https://www.iso.org/standard/54534.html">A.13.2.3</reference>
                <reference href="https://www.iso.org/standard/54534.html">A.13.2.4</reference>
                <reference href="https://www.iso.org/standard/54534.html">A.14.1.2</reference>
                <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
                <reference href="https://www.iso.org/standard/54534.html">A.14.2.7</reference>
                <reference href="https://www.iso.org/standard/54534.html">A.14.2.8</reference>
                <reference href="https://www.iso.org/standard/54534.html">A.15.2.1</reference>
                <reference href="https://www.iso.org/standard/54534.html">A.16.1.1</reference>
                <reference href="https://www.iso.org/standard/54534.html">A.16.1.2</reference>
                <reference href="https://www.iso.org/standard/54534.html">A.16.1.3</reference>
                <reference href="https://www.iso.org/standard/54534.html">A.16.1.4</reference>
                <reference href="https://www.iso.org/standard/54534.html">A.16.1.5</reference>
                <reference href="https://www.iso.org/standard/54534.html">A.16.1.6</reference>
                <reference href="https://www.iso.org/standard/54534.html">A.16.1.7</reference>
                <reference href="https://www.iso.org/standard/54534.html">A.18.1.4</reference>
                <reference href="https://www.iso.org/standard/54534.html">A.18.2.2</reference>
                <reference href="https://www.iso.org/standard/54534.html">A.18.2.3</reference>
                <reference href="https://www.iso.org/standard/54534.html">A.6.1.2</reference>
                <reference href="https://www.iso.org/standard/54534.html">A.7.1.1</reference>
                <reference href="https://www.iso.org/standard/54534.html">A.7.1.2</reference>
                <reference href="https://www.iso.org/standard/54534.html">A.7.3.1</reference>
                <reference href="https://www.iso.org/standard/54534.html">A.8.2.2</reference>
                <reference href="https://www.iso.org/standard/54534.html">A.8.2.3</reference>
                <reference href="https://www.iso.org/standard/54534.html">A.9.1.1</reference>
                <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
                <reference href="https://www.iso.org/standard/54534.html">A.9.2.3</reference>
                <reference href="https://www.iso.org/standard/54534.html">A.9.4.1</reference>
                <reference href="https://www.iso.org/standard/54534.html">A.9.4.4</reference>
                <reference href="https://www.iso.org/standard/54534.html">A.9.4.5</reference>
                <reference href="https://www.iso.org/standard/54534.html">Clause 16.1.2</reference>
                <reference href="https://www.iso.org/standard/54534.html">Clause 7.4</reference>
                <reference href="https://www.cisecurity.org/controls/">1</reference>
                <reference href="https://www.cisecurity.org/controls/">11</reference>
                <reference href="https://www.cisecurity.org/controls/">12</reference>
                <reference href="https://www.cisecurity.org/controls/">13</reference>
                <reference href="https://www.cisecurity.org/controls/">14</reference>
                <reference href="https://www.cisecurity.org/controls/">15</reference>
                <reference href="https://www.cisecurity.org/controls/">16</reference>
                <reference href="https://www.cisecurity.org/controls/">18</reference>
                <reference href="https://www.cisecurity.org/controls/">19</reference>
                <reference href="https://www.cisecurity.org/controls/">2</reference>
                <reference href="https://www.cisecurity.org/controls/">3</reference>
                <reference href="https://www.cisecurity.org/controls/">4</reference>
                <reference href="https://www.cisecurity.org/controls/">5</reference>
                <reference href="https://www.cisecurity.org/controls/">6</reference>
                <reference href="https://www.cisecurity.org/controls/">7</reference>
                <reference href="https://www.cisecurity.org/controls/">8</reference>
                <reference href="https://www.cisecurity.org/controls/">9</reference>
                <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Without a host-based intrusion detection tool, there is no system-level defense
when an intruder gains access to a system or network. Additionally, a host-based
intrusion prevention tool can provide methods to immediately lock out detected
intrusion attempts.</rationale>
                <conflicts idref="xccdf_org.ssgproject.content_rule_selinux_state"/>
                <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_MFEhiplsm_installed" system="urn:redhat:osbuild:blueprint">
[[packages]]
name = "MFEhiplsm"
version = "*"
</fix>
                <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <check-content-ref name="oval:ssg-package_MFEhiplsm_installed:def:1" href="ssg-fedora-oval.xml"/>
                </check>
                <check system="http://scap.nist.gov/schema/ocil/2">
                  <check-content-ref name="ocil:ssg-package_MFEhiplsm_installed_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
                </check>
              </Rule>
            </Group>
          </Group>
        </Group>
        <Group id="xccdf_org.ssgproject.content_group_certified-vendor">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Operating System Vendor Support and Certification</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The assurance of a vendor to provide operating system support and maintenance
for their product is an important criterion to ensure product stability and
security over the life of the product. A certified product that follows the
necessary standards and government certification requirements guarantees that
known software vulnerabilities will be remediated, and proper guidance for
protecting and securing the operating system will be given.</description>
          <Rule id="xccdf_org.ssgproject.content_rule_installed_OS_is_vendor_supported" selected="false" role="full" severity="high">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The Installed Operating System Is Vendor Supported</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The installed operating system must be maintained by a vendor.

Red Hat Enterprise Linux is supported by Red Hat, Inc. As the Red Hat Enterprise
Linux vendor, Red Hat, Inc. is responsible for providing security patches.</description>
            <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">There is no remediation besides switching to a different operating system.</warning>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">MA-6</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SA-13(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.RA-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-12</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.12</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.9</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO12.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO12.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO12.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO12.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI03.10</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.6.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.18.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.18.2.3</reference>
            <reference href="https://www.cisecurity.org/controls/">18</reference>
            <reference href="https://www.cisecurity.org/controls/">20</reference>
            <reference href="https://www.cisecurity.org/controls/">4</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">An operating system is considered "supported" if the vendor continues to
provide security patches for the product.  With an unsupported release, it
will not be possible to resolve any security issue discovered in the system
software.</rationale>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-installed_OS_is_vendor_supported:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-installed_OS_is_vendor_supported_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_installed_OS_is_FIPS_certified" selected="false" role="full" severity="high">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The Installed Operating System Is FIPS 140-2 Certified</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To enable processing of sensitive information the operating system must
provide certified cryptographic modules compliant with FIPS 140-2
standard.</description>
            <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">There is no remediation besides switching to a different operating system.</warning>
            <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="regulatory">System Crypto Modules must be provided by a vendor that undergoes
FIPS-140 certifications.
FIPS-140 is applicable to all Federal agencies that use
cryptographic-based security systems to protect sensitive information
in computer and telecommunication systems (including voice systems) as
defined in Section 5131 of the Information Technology Management Reform
Act of 1996, Public Law 104-106. This standard shall be used in
designing and implementing cryptographic modules that Federal
departments and agencies operate or are operated for them under
contract. See <html:b xmlns:html="http://www.w3.org/1999/xhtml"><html:a href="https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-2.pdf">https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-2.pdf</html:a></html:b>
To meet this, the system has to have cryptographic software provided by
a vendor that has undergone this certification. This means providing
documentation, test results, design information, and independent third
party review by an accredited lab. While open source software is
capable of meeting this, it does not meet FIPS-140 unless the vendor
submits to this process.</warning>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000803</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-002450</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-12(2)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-12(3)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-7</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-13</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-12</reference>
            <reference href="">SRG-OS-000120-VMM-000600</reference>
            <reference href="">SRG-OS-000478-VMM-001980</reference>
            <reference href="">SRG-OS-000396-VMM-001590</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The Federal Information Processing Standard (FIPS) Publication 140-2, (FIPS
PUB 140-2) is a computer security standard. The standard specifies security
requirements for cryptographic modules used to protect sensitive
unclassified information.  Refer to the full FIPS 140-2 standard at

    <html:a xmlns:html="http://www.w3.org/1999/xhtml" href="http://csrc.nist.gov/publications/fips/fips140-2/fips1402.pdf">http://csrc.nist.gov/publications/fips/fips140-2/fips1402.pdf</html:a>
for further details on the requirements.
FIPS 140-2 validation is required by U.S. law when information systems use
cryptography to protect sensitive government information. In order to
achieve FIPS 140-2 certification, cryptographic modules are subject to
extensive testing by independent laboratories, accredited by National
Institute of Standards and Technology (NIST).</rationale>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-installed_OS_is_FIPS_certified:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-installed_OS_is_FIPS_certified_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
        </Group>
      </Group>
      <Group id="xccdf_org.ssgproject.content_group_system-tools">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">System Tooling / Utilities</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The following checks evaluate the system for recommended base packages -- both for installation
and removal.</description>
        <Rule id="xccdf_org.ssgproject.content_rule_package_binutils_installed" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Install binutils Package</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">binutils</html:code> package can be installed with the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">
$ sudo dnf install binutils</html:pre></description>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US"><html:code xmlns:html="http://www.w3.org/1999/xhtml">binutils</html:code> is a collection of binary utilities required for
foundational system operator activities, such as <html:code xmlns:html="http://www.w3.org/1999/xhtml">ld</html:code>,
<html:code xmlns:html="http://www.w3.org/1999/xhtml">nm</html:code>, <html:code xmlns:html="http://www.w3.org/1999/xhtml">objcopy</html:code> and <html:code xmlns:html="http://www.w3.org/1999/xhtml">readelf</html:code>.</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_binutils_installed" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="enable">
if ! rpm -q --quiet "binutils" ; then
    dnf install -y "binutils"
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_binutils_installed" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="enable">- name: Ensure binutils is installed
  package:
    name: binutils
    state: present
  tags:
    - enable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - package_binutils_installed
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_binutils_installed" system="urn:xccdf:fix:script:puppet" complexity="low" disruption="low" strategy="enable">include install_binutils

class install_binutils {
  package { 'binutils':
    ensure =&gt; 'installed',
  }
}
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_binutils_installed" system="urn:redhat:anaconda:pre" complexity="low" disruption="low" strategy="enable">
package --add=binutils
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_binutils_installed" system="urn:redhat:osbuild:blueprint">
[[packages]]
name = "binutils"
version = "*"
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-package_binutils_installed:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-package_binutils_installed_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_package_cryptsetup-luks_installed" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Install cryptsetup-luks Package</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">cryptsetup-luks</html:code> package can be installed with the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">
$ sudo dnf install cryptsetup-luks</html:pre></description>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">LUKS is the upcoming standard for Linux hard disk encryption. By providing a standard
on-disk format, it does not only facilitate compatibility among distributions, but also
provide secure management of multiple user passwords. In contrast to existing solution,
LUKS stores all necessary setup information in the partition header, enabling the user
to transport or migrate their data seamlessly. LUKS for dm-crypt is implemented in
<html:code xmlns:html="http://www.w3.org/1999/xhtml">cryptsetup</html:code>. <html:code xmlns:html="http://www.w3.org/1999/xhtml">cryptsetup-luks</html:code> is intended as a complete replacement for the
original <html:code xmlns:html="http://www.w3.org/1999/xhtml">cryptsetup</html:code>. It provides all the functionality of the original
version plus all LUKS features, that are accessible by luks* action.</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_cryptsetup-luks_installed" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="enable">
if ! rpm -q --quiet "cryptsetup-luks" ; then
    dnf install -y "cryptsetup-luks"
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_cryptsetup-luks_installed" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="enable">- name: Ensure cryptsetup-luks is installed
  package:
    name: cryptsetup-luks
    state: present
  tags:
    - enable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - package_cryptsetup-luks_installed
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_cryptsetup-luks_installed" system="urn:xccdf:fix:script:puppet" complexity="low" disruption="low" strategy="enable">include install_cryptsetup-luks

class install_cryptsetup-luks {
  package { 'cryptsetup-luks':
    ensure =&gt; 'installed',
  }
}
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_cryptsetup-luks_installed" system="urn:redhat:anaconda:pre" complexity="low" disruption="low" strategy="enable">
package --add=cryptsetup-luks
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_cryptsetup-luks_installed" system="urn:redhat:osbuild:blueprint">
[[packages]]
name = "cryptsetup-luks"
version = "*"
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-package_cryptsetup-luks_installed:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-package_cryptsetup-luks_installed_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_package_gnutls-utils_installed" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure gnutls-utils is installed</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">gnutls-utils</html:code> package can be installed with the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">
$ sudo dnf install gnutls-utils</html:pre></description>
          <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FIA_X509_EXT</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">GnuTLS is a secure communications library implementing the SSL, TLS and DTLS
protocols and technologies around them. It provides a simple C language
application programming interface (API) to access the secure communications
protocols as well as APIs to parse and write X.509, PKCS #12, OpenPGP and
other required structures.
This package contains command line TLS client and server and certificate
manipulation tools.</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_gnutls-utils_installed" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="enable">
if ! rpm -q --quiet "gnutls-utils" ; then
    dnf install -y "gnutls-utils"
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_gnutls-utils_installed" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="enable">- name: Ensure gnutls-utils is installed
  package:
    name: gnutls-utils
    state: present
  tags:
    - enable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - package_gnutls-utils_installed
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_gnutls-utils_installed" system="urn:xccdf:fix:script:puppet" complexity="low" disruption="low" strategy="enable">include install_gnutls-utils

class install_gnutls-utils {
  package { 'gnutls-utils':
    ensure =&gt; 'installed',
  }
}
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_gnutls-utils_installed" system="urn:redhat:anaconda:pre" complexity="low" disruption="low" strategy="enable">
package --add=gnutls-utils
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_gnutls-utils_installed" system="urn:redhat:osbuild:blueprint">
[[packages]]
name = "gnutls-utils"
version = "*"
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-package_gnutls-utils_installed:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-package_gnutls-utils_installed_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_package_libcap-ng-utils_installed" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Install libcap-ng-utils Package</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">libcap-ng-utils</html:code> package can be installed with the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">
$ sudo dnf install libcap-ng-utils</html:pre></description>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000445-GPOS-00199</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US"><html:code xmlns:html="http://www.w3.org/1999/xhtml">libcap-ng-utils</html:code> contains applications to analyze the posix
posix capabilities of all the programs running on a system.
<html:code xmlns:html="http://www.w3.org/1999/xhtml">libcap-ng-utils</html:code> also lets system operators set the file
system based capabilities.</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_libcap-ng-utils_installed" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="enable">
if ! rpm -q --quiet "libcap-ng-utils" ; then
    dnf install -y "libcap-ng-utils"
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_libcap-ng-utils_installed" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="enable">- name: Ensure libcap-ng-utils is installed
  package:
    name: libcap-ng-utils
    state: present
  tags:
    - enable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - package_libcap-ng-utils_installed
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_libcap-ng-utils_installed" system="urn:xccdf:fix:script:puppet" complexity="low" disruption="low" strategy="enable">include install_libcap-ng-utils

class install_libcap-ng-utils {
  package { 'libcap-ng-utils':
    ensure =&gt; 'installed',
  }
}
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_libcap-ng-utils_installed" system="urn:redhat:anaconda:pre" complexity="low" disruption="low" strategy="enable">
package --add=libcap-ng-utils
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_libcap-ng-utils_installed" system="urn:redhat:osbuild:blueprint">
[[packages]]
name = "libcap-ng-utils"
version = "*"
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-package_libcap-ng-utils_installed:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-package_libcap-ng-utils_installed_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_package_nss-tools_installed" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure nss-tools is installed</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">nss-tools</html:code> package can be installed with the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">
$ sudo dnf install nss-tools</html:pre></description>
          <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_SMF_EXT.1</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Network Security Services (NSS) is a set of libraries designed to
support cross-platform development of security-enabled client and
server applications. Install the <html:code xmlns:html="http://www.w3.org/1999/xhtml">nss-tools</html:code> package
to install command-line tools to manipulate the NSS certificate
and key database.</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_nss-tools_installed" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="enable">
if ! rpm -q --quiet "nss-tools" ; then
    dnf install -y "nss-tools"
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_nss-tools_installed" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="enable">- name: Ensure nss-tools is installed
  package:
    name: nss-tools
    state: present
  tags:
    - enable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - package_nss-tools_installed
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_nss-tools_installed" system="urn:xccdf:fix:script:puppet" complexity="low" disruption="low" strategy="enable">include install_nss-tools

class install_nss-tools {
  package { 'nss-tools':
    ensure =&gt; 'installed',
  }
}
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_nss-tools_installed" system="urn:redhat:anaconda:pre" complexity="low" disruption="low" strategy="enable">
package --add=nss-tools
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_nss-tools_installed" system="urn:redhat:osbuild:blueprint">
[[packages]]
name = "nss-tools"
version = "*"
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-package_nss-tools_installed:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-package_nss-tools_installed_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_package_openscap-scanner_installed" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Install openscap-scanner Package</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">openscap-scanner</html:code> package can be installed with the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">
$ sudo dnf install openscap-scanner</html:pre></description>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000191-GPOS-00080</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US"><html:code xmlns:html="http://www.w3.org/1999/xhtml">openscap-scanner</html:code> contains the <html:code xmlns:html="http://www.w3.org/1999/xhtml">oscap</html:code> command line tool. This tool is a
configuration and vulnerability scanner, capable of performing compliance checking using
SCAP content.</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_openscap-scanner_installed" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="enable">
if ! rpm -q --quiet "openscap-scanner" ; then
    dnf install -y "openscap-scanner"
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_openscap-scanner_installed" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="enable">- name: Ensure openscap-scanner is installed
  package:
    name: openscap-scanner
    state: present
  tags:
    - enable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - package_openscap-scanner_installed
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_openscap-scanner_installed" system="urn:xccdf:fix:script:puppet" complexity="low" disruption="low" strategy="enable">include install_openscap-scanner

class install_openscap-scanner {
  package { 'openscap-scanner':
    ensure =&gt; 'installed',
  }
}
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_openscap-scanner_installed" system="urn:redhat:anaconda:pre" complexity="low" disruption="low" strategy="enable">
package --add=openscap-scanner
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_openscap-scanner_installed" system="urn:redhat:osbuild:blueprint">
[[packages]]
name = "openscap-scanner"
version = "*"
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-package_openscap-scanner_installed:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-package_openscap-scanner_installed_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_package_rear_installed" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Install rear Package</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">rear</html:code> package can be installed with the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">
$ sudo dnf install rear</html:pre></description>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US"><html:code xmlns:html="http://www.w3.org/1999/xhtml">rear</html:code> contains the Relax-and-Recover (ReaR) utility. ReaR produces a bootable
image of a system and restores from backup using this image.</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_rear_installed" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="enable">
if ! rpm -q --quiet "rear" ; then
    dnf install -y "rear"
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_rear_installed" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="enable">- name: Ensure rear is installed
  package:
    name: rear
    state: present
  tags:
    - enable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - package_rear_installed
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_rear_installed" system="urn:xccdf:fix:script:puppet" complexity="low" disruption="low" strategy="enable">include install_rear

class install_rear {
  package { 'rear':
    ensure =&gt; 'installed',
  }
}
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_rear_installed" system="urn:redhat:anaconda:pre" complexity="low" disruption="low" strategy="enable">
package --add=rear
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_rear_installed" system="urn:redhat:osbuild:blueprint">
[[packages]]
name = "rear"
version = "*"
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-package_rear_installed:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-package_rear_installed_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_package_rng-tools_installed" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Install rng-tools Package</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">rng-tools</html:code> package can be installed with the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">
$ sudo dnf install rng-tools</html:pre></description>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US"><html:code xmlns:html="http://www.w3.org/1999/xhtml">rng-tools</html:code> provides hardware random number generator tools,
such as those used in the formation of x509/PKI certificates.</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_rng-tools_installed" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="enable">
if ! rpm -q --quiet "rng-tools" ; then
    dnf install -y "rng-tools"
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_rng-tools_installed" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="enable">- name: Ensure rng-tools is installed
  package:
    name: rng-tools
    state: present
  tags:
    - enable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - package_rng-tools_installed
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_rng-tools_installed" system="urn:xccdf:fix:script:puppet" complexity="low" disruption="low" strategy="enable">include install_rng-tools

class install_rng-tools {
  package { 'rng-tools':
    ensure =&gt; 'installed',
  }
}
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_rng-tools_installed" system="urn:redhat:anaconda:pre" complexity="low" disruption="low" strategy="enable">
package --add=rng-tools
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_rng-tools_installed" system="urn:redhat:osbuild:blueprint">
[[packages]]
name = "rng-tools"
version = "*"
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-package_rng-tools_installed:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-package_rng-tools_installed_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_package_scap-security-guide_installed" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Install scap-security-guide Package</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">scap-security-guide</html:code> package can be installed with the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">
$ sudo dnf install scap-security-guide</html:pre></description>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">scap-security-guide</html:code> package provides a guide for configuration of the system
from the final system's security point of view. The guidance is specified in the Security
Content Automation Protocol (SCAP) format and constitutes a catalog of practical hardening
advice, linked to government requirements where applicable. The SCAP Security Guide project
bridges the gap between generalized policy requirements and specific implementation guidelines.
A system administrator can use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">oscap</html:code> CLI tool from the <html:code xmlns:html="http://www.w3.org/1999/xhtml">openscap-scanner</html:code>
package, or the SCAP Workbench GUI tool from the <html:code xmlns:html="http://www.w3.org/1999/xhtml">scap-workbench</html:code> package, to verify
that the system conforms to provided guidelines. Refer to the scap-security-guide(8) manual
page for futher information.</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_scap-security-guide_installed" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="enable">
if ! rpm -q --quiet "scap-security-guide" ; then
    dnf install -y "scap-security-guide"
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_scap-security-guide_installed" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="enable">- name: Ensure scap-security-guide is installed
  package:
    name: scap-security-guide
    state: present
  tags:
    - enable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - package_scap-security-guide_installed
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_scap-security-guide_installed" system="urn:xccdf:fix:script:puppet" complexity="low" disruption="low" strategy="enable">include install_scap-security-guide

class install_scap-security-guide {
  package { 'scap-security-guide':
    ensure =&gt; 'installed',
  }
}
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_scap-security-guide_installed" system="urn:redhat:anaconda:pre" complexity="low" disruption="low" strategy="enable">
package --add=scap-security-guide
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_scap-security-guide_installed" system="urn:redhat:osbuild:blueprint">
[[packages]]
name = "scap-security-guide"
version = "*"
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-package_scap-security-guide_installed:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-package_scap-security-guide_installed_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_package_tar_installed" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Install tar Package</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">tar</html:code> package can be installed with the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">
$ sudo dnf install tar</html:pre></description>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The GNU <html:code xmlns:html="http://www.w3.org/1999/xhtml">tar</html:code> program saves many files together into one archive and
can restore individual files (or all of the files) from the archive. <html:code xmlns:html="http://www.w3.org/1999/xhtml">tar</html:code>
includes multivolume support, automatic archive compression/decompression, the
the ability to perform incremental and full backups. If </rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_tar_installed" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="enable">
if ! rpm -q --quiet "tar" ; then
    dnf install -y "tar"
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_tar_installed" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="enable">- name: Ensure tar is installed
  package:
    name: tar
    state: present
  tags:
    - enable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - package_tar_installed
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_tar_installed" system="urn:xccdf:fix:script:puppet" complexity="low" disruption="low" strategy="enable">include install_tar

class install_tar {
  package { 'tar':
    ensure =&gt; 'installed',
  }
}
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_tar_installed" system="urn:redhat:anaconda:pre" complexity="low" disruption="low" strategy="enable">
package --add=tar
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_tar_installed" system="urn:redhat:osbuild:blueprint">
[[packages]]
name = "tar"
version = "*"
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-package_tar_installed:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-package_tar_installed_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_package_vim_installed" selected="false" role="full" severity="low">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Install vim Package</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">vim</html:code> package can be installed with the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">
$ sudo dnf install vim</html:pre></description>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Vim (Vi IMproved) is an almost compatible version of the UNIX editor <html:code xmlns:html="http://www.w3.org/1999/xhtml">vi</html:code>. </rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_vim_installed" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="enable">
if ! rpm -q --quiet "vim" ; then
    dnf install -y "vim"
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_vim_installed" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="enable">- name: Ensure vim is installed
  package:
    name: vim
    state: present
  tags:
    - enable_strategy
    - low_complexity
    - low_disruption
    - low_severity
    - no_reboot_needed
    - package_vim_installed
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_vim_installed" system="urn:xccdf:fix:script:puppet" complexity="low" disruption="low" strategy="enable">include install_vim

class install_vim {
  package { 'vim':
    ensure =&gt; 'installed',
  }
}
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_vim_installed" system="urn:redhat:anaconda:pre" complexity="low" disruption="low" strategy="enable">
package --add=vim
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_vim_installed" system="urn:redhat:osbuild:blueprint">
[[packages]]
name = "vim"
version = "*"
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-package_vim_installed:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-package_vim_installed_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_package_abrt-addon-ccpp_removed" selected="false" role="full" severity="low">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Uninstall abrt-addon-ccpp Package</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">abrt-addon-ccpp</html:code> package can be removed with the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">
$ sudo dnf erase abrt-addon-ccpp</html:pre></description>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000095-GPOS-00049</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-000381</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US"><html:code xmlns:html="http://www.w3.org/1999/xhtml">abrt-addon-ccpp</html:code> contains hooks for C/C++ crashed programs and <html:code xmlns:html="http://www.w3.org/1999/xhtml">abrt</html:code>'s
C/C++ analyzer plugin.</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_abrt-addon-ccpp_removed" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="disable">
# CAUTION: This remediation script will remove abrt-addon-ccpp
#	   from the system, and may remove any packages
#	   that depend on abrt-addon-ccpp. Execute this
#	   remediation AFTER testing on a non-production
#	   system!

if rpm -q --quiet "abrt-addon-ccpp" ; then
    dnf remove -y "abrt-addon-ccpp"
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_abrt-addon-ccpp_removed" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="disable">- name: Ensure abrt-addon-ccpp is removed
  package:
    name: abrt-addon-ccpp
    state: absent
  tags:
    - disable_strategy
    - low_complexity
    - low_disruption
    - low_severity
    - no_reboot_needed
    - package_abrt-addon-ccpp_removed
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_abrt-addon-ccpp_removed" system="urn:xccdf:fix:script:puppet" complexity="low" disruption="low" strategy="disable">include remove_abrt-addon-ccpp

class remove_abrt-addon-ccpp {
  package { 'abrt-addon-ccpp':
    ensure =&gt; 'purged',
  }
}
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_abrt-addon-ccpp_removed" system="urn:redhat:anaconda:pre" complexity="low" disruption="low" strategy="disable">
package --remove=abrt-addon-ccpp
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-package_abrt-addon-ccpp_removed:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-package_abrt-addon-ccpp_removed_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_package_abrt-addon-kerneloops_removed" selected="false" role="full" severity="low">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Uninstall abrt-addon-kerneloops Package</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">abrt-addon-kerneloops</html:code> package can be removed with the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">
$ sudo dnf erase abrt-addon-kerneloops</html:pre></description>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000095-GPOS-00049</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-000381</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US"><html:code xmlns:html="http://www.w3.org/1999/xhtml">abrt-addon-kerneloops</html:code> contains plugins for collecting kernel crash information and
reporter plugin which sends this information to a specified server, usually to kerneloops.org.</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_abrt-addon-kerneloops_removed" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="disable">
# CAUTION: This remediation script will remove abrt-addon-kerneloops
#	   from the system, and may remove any packages
#	   that depend on abrt-addon-kerneloops. Execute this
#	   remediation AFTER testing on a non-production
#	   system!

if rpm -q --quiet "abrt-addon-kerneloops" ; then
    dnf remove -y "abrt-addon-kerneloops"
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_abrt-addon-kerneloops_removed" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="disable">- name: Ensure abrt-addon-kerneloops is removed
  package:
    name: abrt-addon-kerneloops
    state: absent
  tags:
    - disable_strategy
    - low_complexity
    - low_disruption
    - low_severity
    - no_reboot_needed
    - package_abrt-addon-kerneloops_removed
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_abrt-addon-kerneloops_removed" system="urn:xccdf:fix:script:puppet" complexity="low" disruption="low" strategy="disable">include remove_abrt-addon-kerneloops

class remove_abrt-addon-kerneloops {
  package { 'abrt-addon-kerneloops':
    ensure =&gt; 'purged',
  }
}
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_abrt-addon-kerneloops_removed" system="urn:redhat:anaconda:pre" complexity="low" disruption="low" strategy="disable">
package --remove=abrt-addon-kerneloops
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-package_abrt-addon-kerneloops_removed:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-package_abrt-addon-kerneloops_removed_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_package_abrt-addon-python_removed" selected="false" role="full" severity="low">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Uninstall abrt-addon-python Package</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">abrt-addon-python</html:code> package can be removed with the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">
$ sudo dnf erase abrt-addon-python</html:pre></description>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000095-GPOS-00049</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-000381</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US"><html:code xmlns:html="http://www.w3.org/1999/xhtml">abrt-addon-python</html:code> contains python hook and python analyzer
plugin for handling uncaught exceptions in python programs.</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_abrt-addon-python_removed" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="disable">
# CAUTION: This remediation script will remove abrt-addon-python
#	   from the system, and may remove any packages
#	   that depend on abrt-addon-python. Execute this
#	   remediation AFTER testing on a non-production
#	   system!

if rpm -q --quiet "abrt-addon-python" ; then
    dnf remove -y "abrt-addon-python"
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_abrt-addon-python_removed" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="disable">- name: Ensure abrt-addon-python is removed
  package:
    name: abrt-addon-python
    state: absent
  tags:
    - disable_strategy
    - low_complexity
    - low_disruption
    - low_severity
    - no_reboot_needed
    - package_abrt-addon-python_removed
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_abrt-addon-python_removed" system="urn:xccdf:fix:script:puppet" complexity="low" disruption="low" strategy="disable">include remove_abrt-addon-python

class remove_abrt-addon-python {
  package { 'abrt-addon-python':
    ensure =&gt; 'purged',
  }
}
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_abrt-addon-python_removed" system="urn:redhat:anaconda:pre" complexity="low" disruption="low" strategy="disable">
package --remove=abrt-addon-python
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-package_abrt-addon-python_removed:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-package_abrt-addon-python_removed_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_package_abrt-cli_removed" selected="false" role="full" severity="low">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Uninstall abrt-cli Package</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">abrt-cli</html:code> package can be removed with the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">
$ sudo dnf erase abrt-cli</html:pre></description>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000095-GPOS-00049</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-000381</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US"><html:code xmlns:html="http://www.w3.org/1999/xhtml">abrt-cli</html:code> contains a command line client for controlling abrt daemon
over sockets.</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_abrt-cli_removed" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="disable">
# CAUTION: This remediation script will remove abrt-cli
#	   from the system, and may remove any packages
#	   that depend on abrt-cli. Execute this
#	   remediation AFTER testing on a non-production
#	   system!

if rpm -q --quiet "abrt-cli" ; then
    dnf remove -y "abrt-cli"
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_abrt-cli_removed" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="disable">- name: Ensure abrt-cli is removed
  package:
    name: abrt-cli
    state: absent
  tags:
    - disable_strategy
    - low_complexity
    - low_disruption
    - low_severity
    - no_reboot_needed
    - package_abrt-cli_removed
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_abrt-cli_removed" system="urn:xccdf:fix:script:puppet" complexity="low" disruption="low" strategy="disable">include remove_abrt-cli

class remove_abrt-cli {
  package { 'abrt-cli':
    ensure =&gt; 'purged',
  }
}
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_abrt-cli_removed" system="urn:redhat:anaconda:pre" complexity="low" disruption="low" strategy="disable">
package --remove=abrt-cli
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-package_abrt-cli_removed:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-package_abrt-cli_removed_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_package_abrt-plugin-logger_removed" selected="false" role="full" severity="low">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Uninstall abrt-plugin-logger Package</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">abrt-plugin-logger</html:code> package can be removed with the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">
$ sudo dnf erase abrt-plugin-logger</html:pre></description>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000095-GPOS-00049</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-000381</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US"><html:code xmlns:html="http://www.w3.org/1999/xhtml">abrt-plugin-logger</html:code> is an ABRT plugin which writes a report
to a specified file.</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_abrt-plugin-logger_removed" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="disable">
# CAUTION: This remediation script will remove abrt-plugin-logger
#	   from the system, and may remove any packages
#	   that depend on abrt-plugin-logger. Execute this
#	   remediation AFTER testing on a non-production
#	   system!

if rpm -q --quiet "abrt-plugin-logger" ; then
    dnf remove -y "abrt-plugin-logger"
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_abrt-plugin-logger_removed" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="disable">- name: Ensure abrt-plugin-logger is removed
  package:
    name: abrt-plugin-logger
    state: absent
  tags:
    - disable_strategy
    - low_complexity
    - low_disruption
    - low_severity
    - no_reboot_needed
    - package_abrt-plugin-logger_removed
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_abrt-plugin-logger_removed" system="urn:xccdf:fix:script:puppet" complexity="low" disruption="low" strategy="disable">include remove_abrt-plugin-logger

class remove_abrt-plugin-logger {
  package { 'abrt-plugin-logger':
    ensure =&gt; 'purged',
  }
}
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_abrt-plugin-logger_removed" system="urn:redhat:anaconda:pre" complexity="low" disruption="low" strategy="disable">
package --remove=abrt-plugin-logger
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-package_abrt-plugin-logger_removed:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-package_abrt-plugin-logger_removed_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_package_abrt-plugin-rhtsupport_removed" selected="false" role="full" severity="low">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Uninstall abrt-plugin-rhtsupport Package</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">abrt-plugin-rhtsupport</html:code> package can be removed with the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">
$ sudo dnf erase abrt-plugin-rhtsupport</html:pre></description>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000095-GPOS-00049</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-000381</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US"><html:code xmlns:html="http://www.w3.org/1999/xhtml">abrt-plugin-rhtsupport</html:code> is a ABRT plugin to report bugs into the
Red Hat Support system.</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_abrt-plugin-rhtsupport_removed" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="disable">
# CAUTION: This remediation script will remove abrt-plugin-rhtsupport
#	   from the system, and may remove any packages
#	   that depend on abrt-plugin-rhtsupport. Execute this
#	   remediation AFTER testing on a non-production
#	   system!

if rpm -q --quiet "abrt-plugin-rhtsupport" ; then
    dnf remove -y "abrt-plugin-rhtsupport"
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_abrt-plugin-rhtsupport_removed" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="disable">- name: Ensure abrt-plugin-rhtsupport is removed
  package:
    name: abrt-plugin-rhtsupport
    state: absent
  tags:
    - disable_strategy
    - low_complexity
    - low_disruption
    - low_severity
    - no_reboot_needed
    - package_abrt-plugin-rhtsupport_removed
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_abrt-plugin-rhtsupport_removed" system="urn:xccdf:fix:script:puppet" complexity="low" disruption="low" strategy="disable">include remove_abrt-plugin-rhtsupport

class remove_abrt-plugin-rhtsupport {
  package { 'abrt-plugin-rhtsupport':
    ensure =&gt; 'purged',
  }
}
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_abrt-plugin-rhtsupport_removed" system="urn:redhat:anaconda:pre" complexity="low" disruption="low" strategy="disable">
package --remove=abrt-plugin-rhtsupport
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-package_abrt-plugin-rhtsupport_removed:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-package_abrt-plugin-rhtsupport_removed_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_package_abrt-plugin-sosreport_removed" selected="false" role="full" severity="low">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Uninstall abrt-plugin-sosreport Package</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">abrt-plugin-sosreport</html:code> package can be removed with the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">
$ sudo dnf erase abrt-plugin-sosreport</html:pre></description>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000095-GPOS-00049</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-000381</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US"><html:code xmlns:html="http://www.w3.org/1999/xhtml">abrt-plugin-sosreport</html:code> provides a plugin to include an sosreport in an ABRT report.</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_abrt-plugin-sosreport_removed" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="disable">
# CAUTION: This remediation script will remove abrt-plugin-sosreport
#	   from the system, and may remove any packages
#	   that depend on abrt-plugin-sosreport. Execute this
#	   remediation AFTER testing on a non-production
#	   system!

if rpm -q --quiet "abrt-plugin-sosreport" ; then
    dnf remove -y "abrt-plugin-sosreport"
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_abrt-plugin-sosreport_removed" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="disable">- name: Ensure abrt-plugin-sosreport is removed
  package:
    name: abrt-plugin-sosreport
    state: absent
  tags:
    - disable_strategy
    - low_complexity
    - low_disruption
    - low_severity
    - no_reboot_needed
    - package_abrt-plugin-sosreport_removed
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_abrt-plugin-sosreport_removed" system="urn:xccdf:fix:script:puppet" complexity="low" disruption="low" strategy="disable">include remove_abrt-plugin-sosreport

class remove_abrt-plugin-sosreport {
  package { 'abrt-plugin-sosreport':
    ensure =&gt; 'purged',
  }
}
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_abrt-plugin-sosreport_removed" system="urn:redhat:anaconda:pre" complexity="low" disruption="low" strategy="disable">
package --remove=abrt-plugin-sosreport
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-package_abrt-plugin-sosreport_removed:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-package_abrt-plugin-sosreport_removed_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_package_geolite2-city_removed" selected="false" role="full" severity="low">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Uninstall geolite2-city Package</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">geolite2-city</html:code> package can be removed with the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">
$ sudo dnf erase geolite2-city</html:pre></description>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US"><html:code xmlns:html="http://www.w3.org/1999/xhtml">geolite2-city</html:code> is part of the GeoLite2 database packages, offering geolocation databases and tooling.</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_geolite2-city_removed" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="disable">
# CAUTION: This remediation script will remove geolite2-city
#	   from the system, and may remove any packages
#	   that depend on geolite2-city. Execute this
#	   remediation AFTER testing on a non-production
#	   system!

if rpm -q --quiet "geolite2-city" ; then
    dnf remove -y "geolite2-city"
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_geolite2-city_removed" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="disable">- name: Ensure geolite2-city is removed
  package:
    name: geolite2-city
    state: absent
  tags:
    - disable_strategy
    - low_complexity
    - low_disruption
    - low_severity
    - no_reboot_needed
    - package_geolite2-city_removed
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_geolite2-city_removed" system="urn:xccdf:fix:script:puppet" complexity="low" disruption="low" strategy="disable">include remove_geolite2-city

class remove_geolite2-city {
  package { 'geolite2-city':
    ensure =&gt; 'purged',
  }
}
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_geolite2-city_removed" system="urn:redhat:anaconda:pre" complexity="low" disruption="low" strategy="disable">
package --remove=geolite2-city
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-package_geolite2-city_removed:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-package_geolite2-city_removed_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_package_geolite2-country_removed" selected="false" role="full" severity="low">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Uninstall geolite2-country Package</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">geolite2-country</html:code> package can be removed with the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">
$ sudo dnf erase geolite2-country</html:pre></description>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US"><html:code xmlns:html="http://www.w3.org/1999/xhtml">geolite2-country</html:code> is part of the GeoLite2 database packages, offering geolocation databases and tooling.</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_geolite2-country_removed" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="disable">
# CAUTION: This remediation script will remove geolite2-country
#	   from the system, and may remove any packages
#	   that depend on geolite2-country. Execute this
#	   remediation AFTER testing on a non-production
#	   system!

if rpm -q --quiet "geolite2-country" ; then
    dnf remove -y "geolite2-country"
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_geolite2-country_removed" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="disable">- name: Ensure geolite2-country is removed
  package:
    name: geolite2-country
    state: absent
  tags:
    - disable_strategy
    - low_complexity
    - low_disruption
    - low_severity
    - no_reboot_needed
    - package_geolite2-country_removed
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_geolite2-country_removed" system="urn:xccdf:fix:script:puppet" complexity="low" disruption="low" strategy="disable">include remove_geolite2-country

class remove_geolite2-country {
  package { 'geolite2-country':
    ensure =&gt; 'purged',
  }
}
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_geolite2-country_removed" system="urn:redhat:anaconda:pre" complexity="low" disruption="low" strategy="disable">
package --remove=geolite2-country
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-package_geolite2-country_removed:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-package_geolite2-country_removed_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_package_gssproxy_removed" selected="false" role="full" severity="low">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Uninstall gssproxy Package</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">gssproxy</html:code> package can be removed with the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">
$ sudo dnf erase gssproxy</html:pre></description>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000095-GPOS-00049</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-000381</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US"><html:code xmlns:html="http://www.w3.org/1999/xhtml">gssproxy</html:code> is a proxy for GSS API credential handling.</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_gssproxy_removed" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="disable">
# CAUTION: This remediation script will remove gssproxy
#	   from the system, and may remove any packages
#	   that depend on gssproxy. Execute this
#	   remediation AFTER testing on a non-production
#	   system!

if rpm -q --quiet "gssproxy" ; then
    dnf remove -y "gssproxy"
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_gssproxy_removed" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="disable">- name: Ensure gssproxy is removed
  package:
    name: gssproxy
    state: absent
  tags:
    - disable_strategy
    - low_complexity
    - low_disruption
    - low_severity
    - no_reboot_needed
    - package_gssproxy_removed
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_gssproxy_removed" system="urn:xccdf:fix:script:puppet" complexity="low" disruption="low" strategy="disable">include remove_gssproxy

class remove_gssproxy {
  package { 'gssproxy':
    ensure =&gt; 'purged',
  }
}
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-package_gssproxy_removed:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-package_gssproxy_removed_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_package_iprutils_removed" selected="false" role="full" severity="low">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Uninstall iprutils Package</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">iprutils</html:code> package can be removed with the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">
$ sudo dnf erase iprutils</html:pre></description>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000095-GPOS-00049</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US"><html:code xmlns:html="http://www.w3.org/1999/xhtml">iprutils</html:code> provides a suite of utlilities to manage and configure SCSI devices
supported by the ipr SCSI storage device driver.</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_iprutils_removed" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="disable">
# CAUTION: This remediation script will remove iprutils
#	   from the system, and may remove any packages
#	   that depend on iprutils. Execute this
#	   remediation AFTER testing on a non-production
#	   system!

if rpm -q --quiet "iprutils" ; then
    dnf remove -y "iprutils"
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_iprutils_removed" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="disable">- name: Ensure iprutils is removed
  package:
    name: iprutils
    state: absent
  tags:
    - disable_strategy
    - low_complexity
    - low_disruption
    - low_severity
    - no_reboot_needed
    - package_iprutils_removed
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_iprutils_removed" system="urn:xccdf:fix:script:puppet" complexity="low" disruption="low" strategy="disable">include remove_iprutils

class remove_iprutils {
  package { 'iprutils':
    ensure =&gt; 'purged',
  }
}
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_iprutils_removed" system="urn:redhat:anaconda:pre" complexity="low" disruption="low" strategy="disable">
package --remove=iprutils
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-package_iprutils_removed:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-package_iprutils_removed_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_package_krb5-workstation_removed" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Uninstall krb5-workstation Package</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">krb5-workstation</html:code> package can be removed with the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">
$ sudo dnf erase krb5-workstation</html:pre></description>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000095-GPOS-00049</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000120-GPOS-00061</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-000803</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Kerberos is a network authentication system. The <html:code xmlns:html="http://www.w3.org/1999/xhtml">krb5-workstation</html:code> package contains the basic
Kerberos programs (<html:code xmlns:html="http://www.w3.org/1999/xhtml">kinit</html:code>, <html:code xmlns:html="http://www.w3.org/1999/xhtml">klist</html:code>, <html:code xmlns:html="http://www.w3.org/1999/xhtml">kdestroy</html:code>, <html:code xmlns:html="http://www.w3.org/1999/xhtml">kpasswd</html:code>).

Currently, Kerberos does not utilize FIPS 140-2 cryptography and is not permitted on Government networks,
nor is it permitted in many regulatory environments such as HIPAA.</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_krb5-workstation_removed" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="disable">
# CAUTION: This remediation script will remove krb5-workstation
#	   from the system, and may remove any packages
#	   that depend on krb5-workstation. Execute this
#	   remediation AFTER testing on a non-production
#	   system!

if rpm -q --quiet "krb5-workstation" ; then
    dnf remove -y "krb5-workstation"
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_krb5-workstation_removed" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="disable">- name: Ensure krb5-workstation is removed
  package:
    name: krb5-workstation
    state: absent
  tags:
    - disable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - package_krb5-workstation_removed
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_krb5-workstation_removed" system="urn:xccdf:fix:script:puppet" complexity="low" disruption="low" strategy="disable">include remove_krb5-workstation

class remove_krb5-workstation {
  package { 'krb5-workstation':
    ensure =&gt; 'purged',
  }
}
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_krb5-workstation_removed" system="urn:redhat:anaconda:pre" complexity="low" disruption="low" strategy="disable">
package --remove=krb5-workstation
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-package_krb5-workstation_removed:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-package_krb5-workstation_removed_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_package_tuned_removed" selected="false" role="full" severity="low">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Uninstall tuned Package</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">tuned</html:code> package can be removed with the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">
$ sudo dnf erase tuned</html:pre></description>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000095-GPOS-00049</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US"><html:code xmlns:html="http://www.w3.org/1999/xhtml">tuned</html:code> contains a daemon that tunes the system settings dynamically.
It does so by monitoring the usage of several system components periodically. Based
on that information, components will then be put into lower or higher power savings
modes to adapt to the current usage.</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_tuned_removed" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="disable">
# CAUTION: This remediation script will remove tuned
#	   from the system, and may remove any packages
#	   that depend on tuned. Execute this
#	   remediation AFTER testing on a non-production
#	   system!

if rpm -q --quiet "tuned" ; then
    dnf remove -y "tuned"
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_tuned_removed" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="disable">- name: Ensure tuned is removed
  package:
    name: tuned
    state: absent
  tags:
    - disable_strategy
    - low_complexity
    - low_disruption
    - low_severity
    - no_reboot_needed
    - package_tuned_removed
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_tuned_removed" system="urn:xccdf:fix:script:puppet" complexity="low" disruption="low" strategy="disable">include remove_tuned

class remove_tuned {
  package { 'tuned':
    ensure =&gt; 'purged',
  }
}
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_tuned_removed" system="urn:redhat:anaconda:pre" complexity="low" disruption="low" strategy="disable">
package --remove=tuned
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-package_tuned_removed:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-package_tuned_removed_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
      </Group>
      <Group id="xccdf_org.ssgproject.content_group_sudo">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Sudo</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US"><html:code xmlns:html="http://www.w3.org/1999/xhtml">Sudo</html:code>, which stands for "su 'do'", provides the ability to delegate authority
to certain users, groups of users, or system administrators. When configured for system
users and/or groups, <html:code xmlns:html="http://www.w3.org/1999/xhtml">Sudo</html:code> can allow a user or group to execute privileged commands
that normally only <html:code xmlns:html="http://www.w3.org/1999/xhtml">root</html:code> is allowed to execute.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
For more information on <html:code xmlns:html="http://www.w3.org/1999/xhtml">Sudo</html:code> and addition <html:code xmlns:html="http://www.w3.org/1999/xhtml">Sudo</html:code> configuration options, see
<html:b xmlns:html="http://www.w3.org/1999/xhtml"><html:a href="https://www.sudo.ws">https://www.sudo.ws</html:a></html:b>.</description>
        <Value id="xccdf_org.ssgproject.content_value_var_sudo_dedicated_group" type="string" interactive="true">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Group name dedicated to the use of sudo</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Specify the name of the group that should own /usr/bin/sudo.</description>
          <value>root</value>
          <value selector="sudogrp">sudogrp</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_sudo_umask" type="string">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Sudo - umask value</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Specify the sudo umask to use. The actual umask value that is used is the union
of the user's umask and the sudo umask.
The default sudo umask is 0022. This guarantess sudo never lowers the umask when
running a command.</description>
          <value>0022</value>
          <value selector="0022">0022</value>
          <value selector="0027">0027</value>
        </Value>
        <Rule id="xccdf_org.ssgproject.content_rule_package_sudo_installed" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Install sudo Package</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">sudo</html:code> package can be installed with the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">
$ sudo dnf install sudo</html:pre></description>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000324-GPOS-00125</reference>
          <reference href="">1382</reference>
          <reference href="">1384</reference>
          <reference href="">1386</reference>
          <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R19)</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US"><html:code xmlns:html="http://www.w3.org/1999/xhtml">sudo</html:code> is a program designed to allow a system administrator to give
limited root privileges to users and log root activity. The basic philosophy
is to give as few privileges as possible but still allow system users to
get their work done.</rationale>
          <platform idref="cpe:/a:machine"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_sudo_installed" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="enable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

if ! rpm -q --quiet "sudo" ; then
    dnf install -y "sudo"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_sudo_installed" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="enable">- name: Ensure sudo is installed
  package:
    name: sudo
    state: present
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-CM-6(a)
    - enable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - package_sudo_installed
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_sudo_installed" system="urn:xccdf:fix:script:puppet" complexity="low" disruption="low" strategy="enable">include install_sudo

class install_sudo {
  package { 'sudo':
    ensure =&gt; 'installed',
  }
}
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_sudo_installed" system="urn:redhat:anaconda:pre" complexity="low" disruption="low" strategy="enable">
package --add=sudo
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_sudo_installed" system="urn:redhat:osbuild:blueprint">
[[packages]]
name = "sudo"
version = "*"
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-package_sudo_installed:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-package_sudo_installed_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_sudoers_explicit_command_args" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Explicit arguments in sudo specifications</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">All commands in the sudoers file must strictly specify the arguments allowed to be used for a given user.
If the command is supposed to be executed only without arguments, pass "" as an argument in the corresponding user specification.</description>
          <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">This rule doesn't come with a remediation, as absence of arguments in the user spec doesn't mean that the command is intended to be executed with no arguments.</warning>
          <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">The rule can produce false findings when an argument contains a comma - sudoers syntax allows comma escaping using backslash, but the check doesn't support that. For example, <html:code xmlns:html="http://www.w3.org/1999/xhtml">root ALL=(ALL) echo 1\,2</html:code> allows root to execute <html:code xmlns:html="http://www.w3.org/1999/xhtml">echo 1,2</html:code>, but the check would interpret it as two commands <html:code xmlns:html="http://www.w3.org/1999/xhtml">echo 1\</html:code> and <html:code xmlns:html="http://www.w3.org/1999/xhtml">2</html:code>.</warning>
          <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R63)</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Any argument can modify quite significantly the behavior of a program, whether regarding the
realized operation (read, write, delete, etc.) or accessed resources (path in a file system tree). To
avoid any possibility of misuse of a command by a user, the ambiguities must be removed at the
level of its specification.

For example, on some systems, the kernel messages are only accessible by root.
If a user nevertheless must have the privileges to read them, the argument of the dmesg command has to be restricted
in order to prevent the user from flushing the buffer through the -c option:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">
user ALL = dmesg ""
</html:pre></rationale>
          <platform idref="cpe:/a:sudo"/>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-sudoers_explicit_command_args:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-sudoers_explicit_command_args_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_sudo_remove_no_authenticate" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure Users Re-Authenticate for Privilege Escalation - sudo !authenticate</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The sudo <html:code xmlns:html="http://www.w3.org/1999/xhtml">!authenticate</html:code> option, when specified, allows a user to execute commands using
sudo without having to authenticate. This should be disabled by making sure that the
<html:code xmlns:html="http://www.w3.org/1999/xhtml">!authenticate</html:code> option does not exist in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/sudoers</html:code> configuration file or
any sudo configuration snippets in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/sudoers.d/</html:code>.</description>
          <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R5)</reference>
          <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R59)</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-002038</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-11</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000373-GPOS-00156</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000373-GPOS-00157</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000373-GPOS-00158</reference>
          <reference href="">SRG-OS-000373-VMM-001470</reference>
          <reference href="">SRG-OS-000373-VMM-001480</reference>
          <reference href="">SRG-OS-000373-VMM-001490</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.10</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.10</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.18.1.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.6</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.3.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.3</reference>
          <reference href="https://www.cisecurity.org/controls/">1</reference>
          <reference href="https://www.cisecurity.org/controls/">12</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">16</reference>
          <reference href="https://www.cisecurity.org/controls/">5</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Without re-authentication, users may access resources or perform tasks for which they
do not have authorization.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
When operating systems provide the capability to escalate a functional capability, it
is critical that the user re-authenticate.</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sudo_remove_no_authenticate" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="restrict">
for f in $( ls /etc/sudoers /etc/sudoers.d/* 2&gt; /dev/null ) ; do
  matching_list=$(grep -P '^(?!#).*[\s]+\!authenticate.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      # comment out "!authenticate" matches to preserve user data
      sed -i "s/^${entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"

    /usr/sbin/visudo -cf $f &amp;&gt; /dev/null || echo "Fail to validate $f with visudo"
  fi
done
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sudo_remove_no_authenticate" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Find /etc/sudoers.d/ files
  find:
    paths:
      - /etc/sudoers.d/
  register: sudoers
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-11
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sudo_remove_no_authenticate

- name: Remove lines containing !authenticate from sudoers files
  replace:
    regexp: (^(?!#).*[\s]+\!authenticate.*$)
    replace: '# \g&lt;1&gt;'
    path: '{{ item.path }}'
    validate: /usr/sbin/visudo -cf %s
  with_items:
    - path: /etc/sudoers
    - '{{ sudoers.files }}'
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-11
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sudo_remove_no_authenticate
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-sudo_remove_no_authenticate:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-sudo_remove_no_authenticate_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_sudo_add_noexec" selected="false" role="full" severity="high">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure Privileged Escalated Commands Cannot Execute Other Commands - sudo NOEXEC</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The sudo <html:code xmlns:html="http://www.w3.org/1999/xhtml">NOEXEC</html:code> tag, when specified, prevents user executed
commands from executing other commands, like a shell for example.
This should be enabled by making sure that the <html:code xmlns:html="http://www.w3.org/1999/xhtml">NOEXEC</html:code> tag exists in
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/sudoers</html:code> configuration file or any sudo configuration snippets
in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/sudoers.d/</html:code>.</description>
          <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R58)</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Restricting the capability of sudo allowed commands to execute sub-commands
prevents users from running programs with privileges they wouldn't have otherwise.</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sudo_add_noexec" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="restrict">
if /usr/sbin/visudo -qcf /etc/sudoers; then
    cp /etc/sudoers /etc/sudoers.bak
    if ! grep -P "^[\s]*Defaults.*\bnoexec\b.*$" /etc/sudoers; then
        # sudoers file doesn't define Option noexec
        echo "Defaults noexec" &gt;&gt; /etc/sudoers
    fi
    
    # Check validity of sudoers and cleanup bak
    if /usr/sbin/visudo -qcf /etc/sudoers; then
        rm -f /etc/sudoers.bak
    else
        echo "Fail to validate remediated /etc/sudoers, reverting to original file."
        mv /etc/sudoers.bak /etc/sudoers
        false
    fi
else
    echo "Skipping remediation, /etc/sudoers failed to validate"
    false
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sudo_add_noexec" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Ensure noexec is enabled in /etc/sudoers
  lineinfile:
    path: /etc/sudoers
    regexp: ^[\s]*Defaults.*\bnoexec\b.*$
    line: Defaults noexec
    validate: /usr/sbin/visudo -cf %s
  tags:
    - high_severity
    - low_complexity
    - low_disruption
    - no_reboot_needed
    - restrict_strategy
    - sudo_add_noexec
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-sudo_add_noexec:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-sudo_add_noexec_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_sudoers_validate_passwd" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure invoking users password for privilege escalation when using sudo</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The sudoers security policy requires that users authenticate themselves before they can use sudo.
When sudoers requires authentication, it validates the invoking user's credentials.
The expected output for:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">sudo egrep -i '(!rootpw|!targetpw|!runaspw)' /etc/sudoers /etc/sudoers.d/* | grep -v '#'</html:pre>
<html:pre xmlns:html="http://www.w3.org/1999/xhtml"> /etc/sudoers:Defaults !targetpw
      /etc/sudoers:Defaults !rootpw
      /etc/sudoers:Defaults !runaspw </html:pre></description>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">If the rootpw, targetpw, or runaspw flags are defined and not disabled, by default the operating system will prompt
the invoking user for the "root" user password.</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sudoers_validate_passwd" system="urn:xccdf:fix:script:sh">
if [ -e "/etc/sudoers" ] ; then
    LC_ALL=C sed -i "/Defaults !targetpw/d" "/etc/sudoers"
else
    touch "/etc/sudoers"
fi
cp "/etc/sudoers" "/etc/sudoers.bak"
# Insert at the end of the file
printf '%s\n' "Defaults !targetpw" &gt;&gt; "/etc/sudoers"
# Clean up after ourselves.
rm "/etc/sudoers.bak"
if [ -e "/etc/sudoers" ] ; then
    LC_ALL=C sed -i "/Defaults !rootpw/d" "/etc/sudoers"
else
    touch "/etc/sudoers"
fi
cp "/etc/sudoers" "/etc/sudoers.bak"
# Insert at the end of the file
printf '%s\n' "Defaults !rootpw" &gt;&gt; "/etc/sudoers"
# Clean up after ourselves.
rm "/etc/sudoers.bak"
if [ -e "/etc/sudoers" ] ; then
    LC_ALL=C sed -i "/Defaults !runaspw/d" "/etc/sudoers"
else
    touch "/etc/sudoers"
fi
cp "/etc/sudoers" "/etc/sudoers.bak"
# Insert at the end of the file
printf '%s\n' "Defaults !runaspw" &gt;&gt; "/etc/sudoers"
# Clean up after ourselves.
rm "/etc/sudoers.bak"
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sudoers_validate_passwd" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Ensure that Defaults !targetpw is defined in sudoers
  lineinfile:
    path: /etc/sudoers
    create: true
    line: Defaults !targetpw
    state: present
  tags:
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sudoers_validate_passwd

- name: Ensure that Defaults !rootpw is defined in sudoers
  lineinfile:
    path: /etc/sudoers
    create: true
    line: Defaults !rootpw
    state: present
  tags:
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sudoers_validate_passwd

- name: Ensure that Defaults !runaspw is defined in sudoers
  lineinfile:
    path: /etc/sudoers
    create: true
    line: Defaults !runaspw
    state: present
  tags:
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sudoers_validate_passwd
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-sudoers_validate_passwd:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-sudoers_validate_passwd_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_sudoers_no_root_target" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Don't target root user in the sudoers file</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The targeted users of a user specification should be, as much as possible, non privileged users (i.e.: non-root).

User specifications have to explicitly list the runas spec (i.e. the list of target users that can be impersonated), and <html:code xmlns:html="http://www.w3.org/1999/xhtml">ALL</html:code> or <html:code xmlns:html="http://www.w3.org/1999/xhtml">root</html:code> should not be used.</description>
          <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">This rule doesn't come with a remediation, as the exact requirement allows exceptions, and removing lines from the sudoers file can make the system non-administrable.</warning>
          <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R60)</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">It is common that the command to be executed does not require superuser rights (editing a file
whose the owner is not root, sending a signal to an unprivileged process,etc.). In order to limit
any attempt of privilege escalation through a command, it is better to apply normal user rights.</rationale>
          <platform idref="cpe:/a:sudo"/>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-sudoers_no_root_target:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-sudoers_no_root_target_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_sudo_vdsm_nopasswd" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Only the VDSM User Can Use sudo NOPASSWD</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The sudo <html:code xmlns:html="http://www.w3.org/1999/xhtml">NOPASSWD</html:code> tag, when specified, allows a user to execute commands using sudo without having to authenticate. Only the <html:code xmlns:html="http://www.w3.org/1999/xhtml">vdsm</html:code> user should have this capability in any sudo configuration snippets in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/sudoers.d/</html:code>.</description>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Without re-authentication, users may access resources or perform tasks for which they
do not have authorization.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
When operating systems provide the capability to escalate a functional capability, it
is critical that the user re-authenticate.</rationale>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-sudo_vdsm_nopasswd:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-sudo_vdsm_nopasswd_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_sudo_add_use_pty" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure Only Users Logged In To Real tty Can Execute Sudo - sudo use_pty</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The sudo <html:code xmlns:html="http://www.w3.org/1999/xhtml">use_pty</html:code> tag, when specified, will only execute sudo
commands from users logged in to a real tty.
This should be enabled by making sure that the <html:code xmlns:html="http://www.w3.org/1999/xhtml">use_pty</html:code> tag exists in
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/sudoers</html:code> configuration file or any sudo configuration snippets
in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/sudoers.d/</html:code>.</description>
          <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R58)</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Requiring that sudo commands be run in a pseudo-terminal can prevent an attacker from retaining
access to the user's terminal after the main program has finished executing.</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sudo_add_use_pty" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="restrict">
if /usr/sbin/visudo -qcf /etc/sudoers; then
    cp /etc/sudoers /etc/sudoers.bak
    if ! grep -P "^[\s]*Defaults.*\buse_pty\b.*$" /etc/sudoers; then
        # sudoers file doesn't define Option use_pty
        echo "Defaults use_pty" &gt;&gt; /etc/sudoers
    fi
    
    # Check validity of sudoers and cleanup bak
    if /usr/sbin/visudo -qcf /etc/sudoers; then
        rm -f /etc/sudoers.bak
    else
        echo "Fail to validate remediated /etc/sudoers, reverting to original file."
        mv /etc/sudoers.bak /etc/sudoers
        false
    fi
else
    echo "Skipping remediation, /etc/sudoers failed to validate"
    false
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sudo_add_use_pty" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Ensure use_pty is enabled in /etc/sudoers
  lineinfile:
    path: /etc/sudoers
    regexp: ^[\s]*Defaults.*\buse_pty\b.*$
    line: Defaults use_pty
    validate: /usr/sbin/visudo -cf %s
  tags:
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sudo_add_use_pty
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-sudo_add_use_pty:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-sudo_add_use_pty_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_sudo_require_authentication" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure Users Re-Authenticate for Privilege Escalation - sudo</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The sudo <html:code xmlns:html="http://www.w3.org/1999/xhtml">NOPASSWD</html:code> and <html:code xmlns:html="http://www.w3.org/1999/xhtml">!authenticate</html:code> option, when
specified, allows a user to execute commands using sudo without having to
authenticate. This should be disabled by making sure that
<html:code xmlns:html="http://www.w3.org/1999/xhtml">NOPASSWD</html:code> and/or <html:code xmlns:html="http://www.w3.org/1999/xhtml">!authenticate</html:code> do not exist in
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/sudoers</html:code> configuration file or any sudo configuration snippets
in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/sudoers.d/</html:code>."</description>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-11</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.10</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.10</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.18.1.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.6</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.3.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.3</reference>
          <reference href="https://www.cisecurity.org/controls/">1</reference>
          <reference href="https://www.cisecurity.org/controls/">12</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">16</reference>
          <reference href="https://www.cisecurity.org/controls/">5</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000373-GPOS-00156</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-002038</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Without re-authentication, users may access resources or perform tasks for which they
do not have authorization.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
When operating systems provide the capability to escalate a functional capability, it
is critical that the user re-authenticate.</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sudo_require_authentication" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="restrict">
for f in $( ls /etc/sudoers /etc/sudoers.d/* 2&gt; /dev/null ) ; do
  matching_list=$(grep -P '^(?!#).*[\s]+NOPASSWD[\s]*\:.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      # comment out "NOPASSWD" matches to preserve user data
      sed -i "s/^${entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"

    /usr/sbin/visudo -cf $f &amp;&gt; /dev/null || echo "Fail to validate $f with visudo"
  fi
done

for f in $( ls /etc/sudoers /etc/sudoers.d/* 2&gt; /dev/null ) ; do
  matching_list=$(grep -P '^(?!#).*[\s]+\!authenticate.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      # comment out "!authenticate" matches to preserve user data
      sed -i "s/^${entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"

    /usr/sbin/visudo -cf $f &amp;&gt; /dev/null || echo "Fail to validate $f with visudo"
  fi
done
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sudo_require_authentication" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Find /etc/sudoers.d/ files
  find:
    paths:
      - /etc/sudoers.d/
  register: sudoers
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-11
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sudo_require_authentication

- name: Remove lines containing NOPASSWD from sudoers files
  replace:
    regexp: (^(?!#).*[\s]+NOPASSWD[\s]*\:.*$)
    replace: '# \g&lt;1&gt;'
    path: '{{ item.path }}'
    validate: /usr/sbin/visudo -cf %s
  with_items:
    - path: /etc/sudoers
    - '{{ sudoers.files }}'
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-11
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sudo_require_authentication

- name: Find /etc/sudoers.d/ files
  find:
    paths:
      - /etc/sudoers.d/
  register: sudoers
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-11
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sudo_require_authentication

- name: Remove lines containing !authenticate from sudoers files
  replace:
    regexp: (^(?!#).*[\s]+\!authenticate.*$)
    replace: '# \g&lt;1&gt;'
    path: '{{ item.path }}'
    validate: /usr/sbin/visudo -cf %s
  with_items:
    - path: /etc/sudoers
    - '{{ sudoers.files }}'
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-11
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sudo_require_authentication
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-sudo_require_authentication:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-sudo_require_authentication_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_sudo_add_requiretty" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure Only Users Logged In To Real tty Can Execute Sudo - sudo requiretty</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The sudo <html:code xmlns:html="http://www.w3.org/1999/xhtml">requiretty</html:code> tag, when specified, will only execute sudo
commands from users logged in to a real tty.
This should be enabled by making sure that the <html:code xmlns:html="http://www.w3.org/1999/xhtml">requiretty</html:code> tag exists in
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/sudoers</html:code> configuration file or any sudo configuration snippets
in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/sudoers.d/</html:code>.</description>
          <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R58)</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Restricting the use cases in which a user is allowed to execute sudo commands
reduces the attack surface.</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sudo_add_requiretty" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="restrict">
if /usr/sbin/visudo -qcf /etc/sudoers; then
    cp /etc/sudoers /etc/sudoers.bak
    if ! grep -P "^[\s]*Defaults.*\brequiretty\b.*$" /etc/sudoers; then
        # sudoers file doesn't define Option requiretty
        echo "Defaults requiretty" &gt;&gt; /etc/sudoers
    fi
    
    # Check validity of sudoers and cleanup bak
    if /usr/sbin/visudo -qcf /etc/sudoers; then
        rm -f /etc/sudoers.bak
    else
        echo "Fail to validate remediated /etc/sudoers, reverting to original file."
        mv /etc/sudoers.bak /etc/sudoers
        false
    fi
else
    echo "Skipping remediation, /etc/sudoers failed to validate"
    false
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sudo_add_requiretty" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Ensure requiretty is enabled in /etc/sudoers
  lineinfile:
    path: /etc/sudoers
    regexp: ^[\s]*Defaults.*\brequiretty\b.*$
    line: Defaults requiretty
    validate: /usr/sbin/visudo -cf %s
  tags:
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sudo_add_requiretty
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-sudo_add_requiretty:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-sudo_add_requiretty_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_sudo_remove_nopasswd" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The sudo <html:code xmlns:html="http://www.w3.org/1999/xhtml">NOPASSWD</html:code> tag, when specified, allows a user to execute
commands using sudo without having to authenticate. This should be disabled
by making sure that the <html:code xmlns:html="http://www.w3.org/1999/xhtml">NOPASSWD</html:code> tag does not exist in
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/sudoers</html:code> configuration file or any sudo configuration snippets
in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/sudoers.d/</html:code>.</description>
          <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R5)</reference>
          <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R59)</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-002038</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-11</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000373-GPOS-00156</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000373-GPOS-00157</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000373-GPOS-00158</reference>
          <reference href="">SRG-OS-000373-VMM-001470</reference>
          <reference href="">SRG-OS-000373-VMM-001480</reference>
          <reference href="">SRG-OS-000373-VMM-001490</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.10</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.10</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.18.1.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.6</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.3.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.3</reference>
          <reference href="https://www.cisecurity.org/controls/">1</reference>
          <reference href="https://www.cisecurity.org/controls/">12</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">16</reference>
          <reference href="https://www.cisecurity.org/controls/">5</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Without re-authentication, users may access resources or perform tasks for which they
do not have authorization.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
When operating systems provide the capability to escalate a functional capability, it
is critical that the user re-authenticate.</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sudo_remove_nopasswd" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="restrict">
for f in $( ls /etc/sudoers /etc/sudoers.d/* 2&gt; /dev/null ) ; do
  matching_list=$(grep -P '^(?!#).*[\s]+NOPASSWD[\s]*\:.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      # comment out "NOPASSWD" matches to preserve user data
      sed -i "s/^${entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"

    /usr/sbin/visudo -cf $f &amp;&gt; /dev/null || echo "Fail to validate $f with visudo"
  fi
done
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sudo_remove_nopasswd" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Find /etc/sudoers.d/ files
  find:
    paths:
      - /etc/sudoers.d/
  register: sudoers
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-11
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sudo_remove_nopasswd

- name: Remove lines containing NOPASSWD from sudoers files
  replace:
    regexp: (^(?!#).*[\s]+NOPASSWD[\s]*\:.*$)
    replace: '# \g&lt;1&gt;'
    path: '{{ item.path }}'
    validate: /usr/sbin/visudo -cf %s
  with_items:
    - path: /etc/sudoers
    - '{{ sudoers.files }}'
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-11
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sudo_remove_nopasswd
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-sudo_remove_nopasswd:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-sudo_remove_nopasswd_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_sudoers_no_command_negation" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Don't define allowed commands in sudoers by means of exclusion</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Policies applied by sudo through the sudoers file should not involve negation.

Each user specification in the <html:code xmlns:html="http://www.w3.org/1999/xhtml">sudoers</html:code> file contains a comma-delimited list of command specifications.
The definition can make use glob patterns, as well as of negations.
Indirect definition of those commands by means of exclusion of a set of commands is trivial to bypass, so it is not allowed to use such constructs.</description>
          <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">This rule doesn't come with a remediation, as negations indicate design issues with the sudoers user specifications design. Just removing negations doesn't increase the security - you typically have to rethink the definition of allowed commands to fix the issue.</warning>
          <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R61)</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Specifying access right using negation is inefficient and can be easily circumvented.
For example, it is expected that a specification like <html:pre xmlns:html="http://www.w3.org/1999/xhtml">
# To avoid absolutely , this rule can be easily circumvented!
user ALL = ALL ,!/ bin/sh
</html:pre> prevents the execution of the shell
but that’s not the case: just copy the binary <html:code xmlns:html="http://www.w3.org/1999/xhtml">/bin/sh</html:code> to a different name to make it executable
again through the rule keyword <html:code xmlns:html="http://www.w3.org/1999/xhtml">ALL</html:code>.</rationale>
          <platform idref="cpe:/a:sudo"/>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-sudoers_no_command_negation:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-sudoers_no_command_negation_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
      </Group>
      <Group id="xccdf_org.ssgproject.content_group_gnome">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">GNOME Desktop Environment</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">GNOME is a graphical desktop environment bundled with many Linux distributions that
allow users to easily interact with the operating system graphically rather than
textually. The GNOME Graphical Display Manager (GDM) provides login, logout, and user
switching contexts as well as display server management.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
GNOME is developed by the GNOME Project and is considered the default

Red Hat Graphical environment.

<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
For more information on GNOME and the GNOME Project, see <html:b xmlns:html="http://www.w3.org/1999/xhtml"><html:a href="https://www.gnome.org">https://www.gnome.org</html:a></html:b>.</description>
        <platform idref="cpe:/a:gdm"/>
        <Rule id="xccdf_org.ssgproject.content_rule_package_gdm_removed" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Remove the GDM Package Group</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">By removing the <html:code xmlns:html="http://www.w3.org/1999/xhtml">gdm</html:code> package, the system no longer has GNOME installed
installed. If X Windows is not installed then the system cannot boot into graphical user mode.
This prevents the system from being accidentally or maliciously booted into a <html:code xmlns:html="http://www.w3.org/1999/xhtml">graphical.target</html:code>
mode. To do so, run the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo yum remove gdm</html:pre></description>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Unnecessary service packages must not be installed to decrease the attack surface of the system.
A graphical environment is unnecessary for certain types of systems including a virtualization
hypervisor.</rationale>
          <platform idref="cpe:/a:gdm"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_gdm_removed" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="disable"># Remediation is applicable only in certain platforms
if rpm --quiet -q gdm; then

# CAUTION: This remediation script will remove gdm
#	   from the system, and may remove any packages
#	   that depend on gdm. Execute this
#	   remediation AFTER testing on a non-production
#	   system!

if rpm -q --quiet "gdm" ; then
    dnf remove -y "gdm"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_gdm_removed" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="disable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - disable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - package_gdm_removed

- name: Ensure gdm is removed
  package:
    name: gdm
    state: absent
  when: '"gdm" in ansible_facts.packages'
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - disable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - package_gdm_removed
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_gdm_removed" system="urn:xccdf:fix:script:puppet" complexity="low" disruption="low" strategy="disable">include remove_gdm

class remove_gdm {
  package { 'gdm':
    ensure =&gt; 'purged',
  }
}
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_gdm_removed" system="urn:redhat:anaconda:pre" complexity="low" disruption="low" strategy="disable">
package --remove=gdm
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-package_gdm_removed:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-package_gdm_removed_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_dconf_db_up_to_date" selected="false" role="full" severity="high">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Make sure that the dconf databases are up-to-date with regards to respective keyfiles</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">By default, DConf uses a binary database as a data backend.
The system-level database is compiled from keyfiles in the /etc/dconf/db/ directory by the <html:pre xmlns:html="http://www.w3.org/1999/xhtml">dconf update</html:pre> command.</description>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(B)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(A)</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Unlike text-based keyfiles, the binary database is impossible to check by OVAL.
Therefore, in order to evaluate dconf configuration, both have to be true at the same time -
configuration files have to be compliant, and the database needs to be more recent than those keyfiles,
which gives confidence that it reflects them.</rationale>
          <platform idref="cpe:/a:machine"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="dconf_db_up_to_date" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q gdm &amp;&amp; { [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; }; then

dconf update

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-dconf_db_up_to_date:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-dconf_db_up_to_date_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_enable_dconf_user_profile" selected="false" role="full" severity="high">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Configure GNOME3 DConf User Profile</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">By default, DConf provides a standard user profile. This profile contains a list
of DConf configuration databases. The user profile and database always take the
highest priority. As such the DConf User profile should always exist and be
configured correctly.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>

To make sure that the user profile is configured correctly, the <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/dconf/profile/user</html:code>
should be set as follows:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">user-db:user
system-db:local
system-db:site
system-db:distro
</html:pre></description>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Failure to have a functional DConf profile prevents GNOME3 configuration settings
from being enforced for all users and allows various security risks.</rationale>
          <platform idref="cpe:/a:machine"/>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-enable_dconf_user_profile:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-enable_dconf_user_profile_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Group id="xccdf_org.ssgproject.content_group_gnome_network_settings">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">GNOME Network Settings</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">GNOME network settings that apply to the graphical interface.</description>
          <platform idref="cpe:/a:gdm"/>
          <Rule id="xccdf_org.ssgproject.content_rule_dconf_gnome_disable_wifi_notification" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable WIFI Network Notification in GNOME3</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">By default, <html:code xmlns:html="http://www.w3.org/1999/xhtml">GNOME</html:code> disables WIFI notification. This should be permanently set
so that users do not connect to a wireless network when the system finds one.
While useful for mobile devices, this setting should be disabled for all other systems.
To configure the system to disable the WIFI notication, add or set
<html:code xmlns:html="http://www.w3.org/1999/xhtml">suppress-wireless-networks-available</html:code> to <html:code xmlns:html="http://www.w3.org/1999/xhtml">true</html:code> in
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/dconf/db/local.d/00-security-settings</html:code>. For example:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">[org/gnome/nm-applet]
suppress-wireless-networks-available=true
</html:pre>
Once the settings have been added, add a lock to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/dconf/db/local.d/locks/00-security-settings-lock</html:code> to prevent user modification.
For example:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">/org/gnome/nm-applet/suppress-wireless-networks-available</html:pre>
After the settings have been set, run <html:code xmlns:html="http://www.w3.org/1999/xhtml">dconf update</html:code>.</description>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.16</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Wireless network connections should not be allowed to be configured by general
users on a given system as it could open the system to backdoor attacks.</rationale>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="dconf_gnome_disable_wifi_notification" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q gdm &amp;&amp; { [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; }; then

# Check for setting in any of the DConf db directories
# If files contain ibus or distro, ignore them.
# The assignment assumes that individual filenames don't contain :
readarray -t SETTINGSFILES &lt; &lt;(grep -r "\\[org/gnome/nm-applet\\]" "/etc/dconf/db/" | grep -v 'distro\|ibus' | cut -d":" -f1)
DCONFFILE="/etc/dconf/db/local.d/00-security-settings"
DBDIR="/etc/dconf/db/local.d"

mkdir -p "${DBDIR}"

if [ "${#SETTINGSFILES[@]}" -eq 0 ]
then
    [ ! -z ${DCONFFILE} ] || echo "" &gt;&gt; ${DCONFFILE}
    printf '%s\n' "[org/gnome/nm-applet]" &gt;&gt; ${DCONFFILE}
    printf '%s=%s\n' "suppress-wireless-networks-available" "true" &gt;&gt; ${DCONFFILE}
else
    escaped_value="$(sed -e 's/\\/\\\\/g' &lt;&lt;&lt; "true")"
    if grep -q "^\\s*suppress-wireless-networks-available\\s*=" "${SETTINGSFILES[@]}"
    then
        sed -i "s/\\s*suppress-wireless-networks-available\\s*=\\s*.*/suppress-wireless-networks-available=${escaped_value}/g" "${SETTINGSFILES[@]}"
    else
        sed -i "\\|\\[org/gnome/nm-applet\\]|a\\suppress-wireless-networks-available=${escaped_value}" "${SETTINGSFILES[@]}"
    fi
fi

dconf update
# Check for setting in any of the DConf db directories
LOCKFILES=$(grep -r "^/org/gnome/nm-applet/suppress-wireless-networks-available$" "/etc/dconf/db/" | grep -v 'distro\|ibus' | cut -d":" -f1)
LOCKSFOLDER="/etc/dconf/db/local.d/locks"

mkdir -p "${LOCKSFOLDER}"

if [[ -z "${LOCKFILES}" ]]
then
    echo "/org/gnome/nm-applet/suppress-wireless-networks-available" &gt;&gt; "/etc/dconf/db/local.d/locks/00-security-settings-lock"
fi

dconf update

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="dconf_gnome_disable_wifi_notification" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="medium">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-171-3.1.16
    - dconf_gnome_disable_wifi_notification
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Disable WiFi Network Notification in GNOME3
  ini_file:
    dest: /etc/dconf/db/local.d/00-security-settings
    section: org/gnome/nm-applet
    option: suppress-wireless-networks-available
    value: 'true'
    create: true
    no_extra_spaces: true
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.16
    - dconf_gnome_disable_wifi_notification
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Prevent user modification of GNOME3 disablement of WiFi
  lineinfile:
    path: /etc/dconf/db/local.d/locks/00-security-settings-lock
    regexp: ^/org/gnome/nm-applet/suppress-wireless-networks-available
    line: /org/gnome/nm-applet/suppress-wireless-networks-available
    create: true
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.16
    - dconf_gnome_disable_wifi_notification
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Dconf Update
  command: dconf update
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.16
    - dconf_gnome_disable_wifi_notification
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-dconf_gnome_disable_wifi_notification:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-dconf_gnome_disable_wifi_notification_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_dconf_gnome_disable_wifi_create" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable WIFI Network Connection Creation in GNOME3</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US"><html:code xmlns:html="http://www.w3.org/1999/xhtml">GNOME</html:code> allows users to create ad-hoc wireless connections through the
<html:code xmlns:html="http://www.w3.org/1999/xhtml">NetworkManager</html:code> applet. Wireless connections should be disabled by
adding or setting <html:code xmlns:html="http://www.w3.org/1999/xhtml">disable-wifi-create</html:code> to <html:code xmlns:html="http://www.w3.org/1999/xhtml">true</html:code> in
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/dconf/db/local.d/00-security-settings</html:code>. For example:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">[org/gnome/nm-applet]
disable-wifi-create=true
</html:pre>
Once the settings have been added, add a lock to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/dconf/db/local.d/locks/00-security-settings-lock</html:code> to prevent user modification.
For example:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">/org/gnome/nm-applet/disable-wifi-create</html:pre>
After the settings have been set, run <html:code xmlns:html="http://www.w3.org/1999/xhtml">dconf update</html:code>.</description>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.16</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Wireless network connections should not be allowed to be configured by general
users on a given system as it could open the system to backdoor attacks.</rationale>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="dconf_gnome_disable_wifi_create" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q gdm &amp;&amp; { [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; }; then

# Check for setting in any of the DConf db directories
# If files contain ibus or distro, ignore them.
# The assignment assumes that individual filenames don't contain :
readarray -t SETTINGSFILES &lt; &lt;(grep -r "\\[org/gnome/nm-applet\\]" "/etc/dconf/db/" | grep -v 'distro\|ibus' | cut -d":" -f1)
DCONFFILE="/etc/dconf/db/local.d/00-security-settings"
DBDIR="/etc/dconf/db/local.d"

mkdir -p "${DBDIR}"

if [ "${#SETTINGSFILES[@]}" -eq 0 ]
then
    [ ! -z ${DCONFFILE} ] || echo "" &gt;&gt; ${DCONFFILE}
    printf '%s\n' "[org/gnome/nm-applet]" &gt;&gt; ${DCONFFILE}
    printf '%s=%s\n' "disable-wifi-create" "true" &gt;&gt; ${DCONFFILE}
else
    escaped_value="$(sed -e 's/\\/\\\\/g' &lt;&lt;&lt; "true")"
    if grep -q "^\\s*disable-wifi-create\\s*=" "${SETTINGSFILES[@]}"
    then
        sed -i "s/\\s*disable-wifi-create\\s*=\\s*.*/disable-wifi-create=${escaped_value}/g" "${SETTINGSFILES[@]}"
    else
        sed -i "\\|\\[org/gnome/nm-applet\\]|a\\disable-wifi-create=${escaped_value}" "${SETTINGSFILES[@]}"
    fi
fi

dconf update
# Check for setting in any of the DConf db directories
LOCKFILES=$(grep -r "^/org/gnome/nm-applet/disable-wifi-create$" "/etc/dconf/db/" | grep -v 'distro\|ibus' | cut -d":" -f1)
LOCKSFOLDER="/etc/dconf/db/local.d/locks"

mkdir -p "${LOCKSFOLDER}"

if [[ -z "${LOCKFILES}" ]]
then
    echo "/org/gnome/nm-applet/disable-wifi-create" &gt;&gt; "/etc/dconf/db/local.d/locks/00-security-settings-lock"
fi

dconf update

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="dconf_gnome_disable_wifi_create" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="medium">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-171-3.1.16
    - dconf_gnome_disable_wifi_create
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Disable WiFi Network Connection Creation in GNOME3
  ini_file:
    dest: /etc/dconf/db/local.d/00-security-settings
    section: org/gnome/nm-applet
    option: disable-wifi-create
    value: 'true'
    create: true
    no_extra_spaces: true
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.16
    - dconf_gnome_disable_wifi_create
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Prevent user modification of GNOME3 disablement of WiFi
  lineinfile:
    path: /etc/dconf/db/local.d/locks/00-security-settings-lock
    regexp: ^/org/gnome/nm-applet/disable-wifi-create
    line: /org/gnome/nm-applet/disable-wifi-create
    create: true
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.16
    - dconf_gnome_disable_wifi_create
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Dconf Update
  command: dconf update
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.16
    - dconf_gnome_disable_wifi_create
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-dconf_gnome_disable_wifi_create:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-dconf_gnome_disable_wifi_create_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
        </Group>
        <Group id="xccdf_org.ssgproject.content_group_gnome_remote_access_settings">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">GNOME Remote Access Settings</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">GNOME remote access settings that apply to the graphical interface.</description>
          <platform idref="cpe:/a:gdm"/>
          <Rule id="xccdf_org.ssgproject.content_rule_dconf_gnome_remote_access_credential_prompt" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Require Credential Prompting for Remote Access in GNOME3</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">By default, <html:code xmlns:html="http://www.w3.org/1999/xhtml">GNOME</html:code> does not require credentials when using <html:code xmlns:html="http://www.w3.org/1999/xhtml">Vino</html:code> for
remote access. To configure the system to require remote credentials, add or set
<html:code xmlns:html="http://www.w3.org/1999/xhtml">authentication-methods</html:code> to <html:code xmlns:html="http://www.w3.org/1999/xhtml">['vnc']</html:code> in
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/dconf/db/local.d/00-security-settings</html:code>. For example:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">[org/gnome/Vino]
authentication-methods=['vnc']
</html:pre>
Once the settings have been added, add a lock to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/dconf/db/local.d/locks/00-security-settings-lock</html:code> to prevent user modification.
For example:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">/org/gnome/Vino/authentication-methods</html:pre>
After the settings have been set, run <html:code xmlns:html="http://www.w3.org/1999/xhtml">dconf update</html:code>.</description>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.12</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(4)(i)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(1)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(3)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(1)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(2)(ii)</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Username and password prompting is required for remote access. Otherwise, non-authorized
and nefarious users can access the system freely.</rationale>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="dconf_gnome_remote_access_credential_prompt" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="medium">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-171-3.1.12
    - dconf_gnome_remote_access_credential_prompt
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Require Credential Prompting for Remote Access in GNOME3
  ini_file:
    dest: /etc/dconf/db/local.d/00-security-settings
    section: org/gnome/Vino
    option: authentication-methods
    value: '[''vnc'']'
    create: true
    no_extra_spaces: true
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.12
    - dconf_gnome_remote_access_credential_prompt
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Prevent user modification of GNOME3 Credential Prompting for Remote Access
  lineinfile:
    path: /etc/dconf/db/local.d/locks/00-security-settings-lock
    regexp: ^/org/gnome/Vino/authentication-methods
    line: /org/gnome/Vino/authentication-methods
    create: true
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.12
    - dconf_gnome_remote_access_credential_prompt
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Dconf Update
  command: dconf update
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.12
    - dconf_gnome_remote_access_credential_prompt
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-dconf_gnome_remote_access_credential_prompt:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-dconf_gnome_remote_access_credential_prompt_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_dconf_gnome_remote_access_encryption" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Require Encryption for Remote Access in GNOME3</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">By default, <html:code xmlns:html="http://www.w3.org/1999/xhtml">GNOME</html:code> requires encryption when using <html:code xmlns:html="http://www.w3.org/1999/xhtml">Vino</html:code> for remote access.
To prevent remote access encryption from being disabled, add or set
<html:code xmlns:html="http://www.w3.org/1999/xhtml">require-encryption</html:code> to <html:code xmlns:html="http://www.w3.org/1999/xhtml">true</html:code> in
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/dconf/db/local.d/00-security-settings</html:code>. For example:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">[org/gnome/Vino]
require-encryption=true
</html:pre>
Once the settings have been added, add a lock to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/dconf/db/local.d/locks/00-security-settings-lock</html:code> to prevent user modification.
For example:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">/org/gnome/Vino/require-encryption</html:pre>
After the settings have been set, run <html:code xmlns:html="http://www.w3.org/1999/xhtml">dconf update</html:code>.</description>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.13</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(4)(i)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(1)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(3)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(1)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(2)(ii)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(2)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-7</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.3.3</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI03.08</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI07.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.1.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.5.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.6.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.4</reference>
            <reference href="https://www.cisecurity.org/controls/">1</reference>
            <reference href="https://www.cisecurity.org/controls/">11</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">13</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">18</reference>
            <reference href="https://www.cisecurity.org/controls/">20</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">4</reference>
            <reference href="https://www.cisecurity.org/controls/">6</reference>
            <reference href="https://www.cisecurity.org/controls/">9</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Open X displays allow an attacker to capture keystrokes and to execute commands
remotely.</rationale>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="dconf_gnome_remote_access_encryption" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="medium">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-171-3.1.13
    - NIST-800-53-AC-17(2)
    - NIST-800-53-AC-17(a)
    - NIST-800-53-CM-6(a)
    - dconf_gnome_remote_access_encryption
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Require Encryption for Remote Access in GNOME3
  ini_file:
    dest: /etc/dconf/db/local.d/00-security-settings
    section: org/gnome/Vino
    option: require-encryption
    value: 'true'
    create: true
    no_extra_spaces: true
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.13
    - NIST-800-53-AC-17(2)
    - NIST-800-53-AC-17(a)
    - NIST-800-53-CM-6(a)
    - dconf_gnome_remote_access_encryption
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Prevent user modification of GNOME3 Encryption for Remote Access
  lineinfile:
    path: /etc/dconf/db/local.d/locks/00-security-settings-lock
    regexp: ^/org/gnome/Vino/require-encryption
    line: /org/gnome/Vino/require-encryption
    create: true
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.13
    - NIST-800-53-AC-17(2)
    - NIST-800-53-AC-17(a)
    - NIST-800-53-CM-6(a)
    - dconf_gnome_remote_access_encryption
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Dconf Update
  command: dconf update
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.13
    - NIST-800-53-AC-17(2)
    - NIST-800-53-AC-17(a)
    - NIST-800-53-CM-6(a)
    - dconf_gnome_remote_access_encryption
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-dconf_gnome_remote_access_encryption:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-dconf_gnome_remote_access_encryption_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
        </Group>
        <Group id="xccdf_org.ssgproject.content_group_gnome_media_settings">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">GNOME Media Settings</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">GNOME media settings that apply to the graphical interface.</description>
          <platform idref="cpe:/a:gdm"/>
          <Rule id="xccdf_org.ssgproject.content_rule_dconf_gnome_disable_automount_open" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable GNOME3 Automount Opening</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The system's default desktop environment, GNOME3, will mount
devices and removable media (such as DVDs, CDs and USB flash drives) whenever
they are inserted into the system. To disable automount-open within GNOME3, add or set
<html:code xmlns:html="http://www.w3.org/1999/xhtml">automount-open</html:code> to <html:code xmlns:html="http://www.w3.org/1999/xhtml">false</html:code> in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/dconf/db/local.d/00-security-settings</html:code>.
For example:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">[org/gnome/desktop/media-handling]
automount-open=false</html:pre>
Once the settings have been added, add a lock to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/dconf/db/local.d/locks/00-security-settings-lock</html:code> to prevent user modification.
For example:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">/org/gnome/desktop/media-handling/automount-open</html:pre>
After the settings have been set, run <html:code xmlns:html="http://www.w3.org/1999/xhtml">dconf update</html:code>.</description>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.2.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.03</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.2.6</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.7.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.2.1</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-001958</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000114-GPOS-00059</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000378-GPOS-00163</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disabling automatic mounting in GNOME3 can prevent
the introduction of malware via removable media.
It will, however, also prevent desktop users from legitimate use
of removable media.</rationale>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="dconf_gnome_disable_automount_open" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q gdm &amp;&amp; { [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; }; then

# Check for setting in any of the DConf db directories
# If files contain ibus or distro, ignore them.
# The assignment assumes that individual filenames don't contain :
readarray -t SETTINGSFILES &lt; &lt;(grep -r "\\[org/gnome/desktop/media-handling\\]" "/etc/dconf/db/" | grep -v 'distro\|ibus' | cut -d":" -f1)
DCONFFILE="/etc/dconf/db/local.d/00-security-settings"
DBDIR="/etc/dconf/db/local.d"

mkdir -p "${DBDIR}"

if [ "${#SETTINGSFILES[@]}" -eq 0 ]
then
    [ ! -z ${DCONFFILE} ] || echo "" &gt;&gt; ${DCONFFILE}
    printf '%s\n' "[org/gnome/desktop/media-handling]" &gt;&gt; ${DCONFFILE}
    printf '%s=%s\n' "automount-open" "false" &gt;&gt; ${DCONFFILE}
else
    escaped_value="$(sed -e 's/\\/\\\\/g' &lt;&lt;&lt; "false")"
    if grep -q "^\\s*automount-open\\s*=" "${SETTINGSFILES[@]}"
    then
        sed -i "s/\\s*automount-open\\s*=\\s*.*/automount-open=${escaped_value}/g" "${SETTINGSFILES[@]}"
    else
        sed -i "\\|\\[org/gnome/desktop/media-handling\\]|a\\automount-open=${escaped_value}" "${SETTINGSFILES[@]}"
    fi
fi

dconf update
# Check for setting in any of the DConf db directories
LOCKFILES=$(grep -r "^/org/gnome/desktop/media-handling/automount-open$" "/etc/dconf/db/" | grep -v 'distro\|ibus' | cut -d":" -f1)
LOCKSFOLDER="/etc/dconf/db/local.d/locks"

mkdir -p "${LOCKSFOLDER}"

if [[ -z "${LOCKFILES}" ]]
then
    echo "/org/gnome/desktop/media-handling/automount-open" &gt;&gt; "/etc/dconf/db/local.d/locks/00-security-settings-lock"
fi

dconf update

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="dconf_gnome_disable_automount_open" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="medium">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - dconf_gnome_disable_automount_open
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Disable GNOME3 Automounting - automount-open
  ini_file:
    dest: /etc/dconf/db/local.d/00-security-settings
    section: org/gnome/desktop/media-handling
    option: automount-open
    value: 'false'
    create: true
    no_extra_spaces: true
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - dconf_gnome_disable_automount_open
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Prevent user modification of GNOME3 Automounting - automount-open
  lineinfile:
    path: /etc/dconf/db/local.d/locks/00-security-settings-lock
    regexp: ^/org/gnome/desktop/media-handling/automount-open
    line: /org/gnome/desktop/media-handling/automount-open
    create: true
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - dconf_gnome_disable_automount_open
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Dconf Update
  command: dconf update
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - dconf_gnome_disable_automount_open
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-dconf_gnome_disable_automount_open:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-dconf_gnome_disable_automount_open_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_dconf_gnome_disable_automount" selected="false" role="full" severity="unknown">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable GNOME3 Automounting</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The system's default desktop environment, GNOME3, will mount
devices and removable media (such as DVDs, CDs and USB flash drives) whenever
they are inserted into the system. To disable automount within GNOME3, add or set
<html:code xmlns:html="http://www.w3.org/1999/xhtml">automount</html:code> to <html:code xmlns:html="http://www.w3.org/1999/xhtml">false</html:code> in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/dconf/db/local.d/00-security-settings</html:code>.
For example:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">[org/gnome/desktop/media-handling]
automount=false</html:pre>
Once the settings have been added, add a lock to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/dconf/db/local.d/locks/00-security-settings-lock</html:code> to prevent user modification.
For example:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">/org/gnome/desktop/media-handling/automount</html:pre>
After the settings have been set, run <html:code xmlns:html="http://www.w3.org/1999/xhtml">dconf update</html:code>.</description>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.2.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.03</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.2.6</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.7.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.2.1</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disabling automatic mounting in GNOME3 can prevent
the introduction of malware via removable media.
It will, however, also prevent desktop users from legitimate use
of removable media.</rationale>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="dconf_gnome_disable_automount" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="medium">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - dconf_gnome_disable_automount
    - low_complexity
    - medium_disruption
    - no_reboot_needed
    - unknown_severity
    - unknown_strategy

- name: Disable GNOME3 Automounting - automount
  ini_file:
    dest: /etc/dconf/db/local.d/00-security-settings
    section: org/gnome/desktop/media-handling
    option: automount
    value: 'false'
    create: true
    no_extra_spaces: true
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - dconf_gnome_disable_automount
    - low_complexity
    - medium_disruption
    - no_reboot_needed
    - unknown_severity
    - unknown_strategy

- name: Prevent user modification of GNOME3 Automounting - automount
  lineinfile:
    path: /etc/dconf/db/local.d/locks/00-security-settings-lock
    regexp: ^/org/gnome/desktop/media-handling/automount
    line: /org/gnome/desktop/media-handling/automount
    create: true
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - dconf_gnome_disable_automount
    - low_complexity
    - medium_disruption
    - no_reboot_needed
    - unknown_severity
    - unknown_strategy

- name: Dconf Update
  command: dconf update
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - dconf_gnome_disable_automount
    - low_complexity
    - medium_disruption
    - no_reboot_needed
    - unknown_severity
    - unknown_strategy
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-dconf_gnome_disable_automount:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-dconf_gnome_disable_automount_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_dconf_gnome_disable_thumbnailers" selected="false" role="full" severity="unknown">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable All GNOME3 Thumbnailers</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The system's default desktop environment, GNOME3, uses
a number of different thumbnailer programs to generate thumbnails
for any new or modified content in an opened folder. To disable the
execution of these thumbnail applications, add or set <html:code xmlns:html="http://www.w3.org/1999/xhtml">disable-all</html:code>
to <html:code xmlns:html="http://www.w3.org/1999/xhtml">true</html:code> in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/dconf/db/local.d/00-security-settings</html:code>.
For example:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">[org/gnome/desktop/thumbnailers]
disable-all=true</html:pre>
Once the settings have been added, add a lock to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/dconf/db/local.d/locks/00-security-settings-lock</html:code> to prevent user modification.
For example:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">/org/gnome/desktop/thumbnailers/disable-all</html:pre>
After the settings have been set, run <html:code xmlns:html="http://www.w3.org/1999/xhtml">dconf update</html:code>.
This effectively prevents an attacker from gaining access to a
system through a flaw in GNOME3's Nautilus thumbnail creators.</description>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.11</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.12</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.3</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.06</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.5.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.6.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
            <reference href="https://www.cisecurity.org/controls/">11</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">9</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">An attacker with knowledge of a flaw in a GNOME3 thumbnailer application could craft a malicious
file to exploit this flaw. Assuming the attacker could place the malicious file on the local filesystem
(via a web upload for example) and assuming a user browses the same location using Nautilus, the
malicious file would exploit the thumbnailer with the potential for malicious code execution. It
is best to disable these thumbnailer applications unless they are explicitly required.</rationale>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="dconf_gnome_disable_thumbnailers" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="medium">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - dconf_gnome_disable_thumbnailers
    - low_complexity
    - medium_disruption
    - no_reboot_needed
    - unknown_severity
    - unknown_strategy

- name: Disable All GNOME3 Thumbnailers
  ini_file:
    dest: /etc/dconf/db/local.d/00-security-settings
    section: org/gnome/desktop/thumbnailers
    option: disable-all
    value: 'true'
    create: true
    no_extra_spaces: true
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - dconf_gnome_disable_thumbnailers
    - low_complexity
    - medium_disruption
    - no_reboot_needed
    - unknown_severity
    - unknown_strategy

- name: Prevent user modification of GNOME3 Thumbnailers
  lineinfile:
    path: /etc/dconf/db/local.d/locks/00-security-settings-lock
    regexp: ^/org/gnome/desktop/thumbnailers/disable-all
    line: /org/gnome/desktop/thumbnailers/disable-all
    create: true
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - dconf_gnome_disable_thumbnailers
    - low_complexity
    - medium_disruption
    - no_reboot_needed
    - unknown_severity
    - unknown_strategy

- name: Dconf Update
  command: dconf update
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - dconf_gnome_disable_thumbnailers
    - low_complexity
    - medium_disruption
    - no_reboot_needed
    - unknown_severity
    - unknown_strategy
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-dconf_gnome_disable_thumbnailers:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-dconf_gnome_disable_thumbnailers_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_dconf_gnome_disable_autorun" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable GNOME3 Automount running</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The system's default desktop environment, GNOME3, will mount
devices and removable media (such as DVDs, CDs and USB flash drives) whenever
they are inserted into the system. To disable autorun-never within GNOME3, add or set
<html:code xmlns:html="http://www.w3.org/1999/xhtml">autorun-never</html:code> to <html:code xmlns:html="http://www.w3.org/1999/xhtml">true</html:code> in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/dconf/db/local.d/00-security-settings</html:code>.
For example:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">[org/gnome/desktop/media-handling]
autorun-never=true</html:pre>
Once the settings have been added, add a lock to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/dconf/db/local.d/locks/00-security-settings-lock</html:code> to prevent user modification.
For example:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">/org/gnome/desktop/media-handling/autorun-never</html:pre>
After the settings have been set, run <html:code xmlns:html="http://www.w3.org/1999/xhtml">dconf update</html:code>.</description>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.2.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.03</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.2.6</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.7.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.2.1</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-001958</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000114-GPOS-00059</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000378-GPOS-00163</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disabling automatic mount running in GNOME3 can prevent
the introduction of malware via removable media.
It will, however, also prevent desktop users from legitimate use
of removable media.</rationale>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="dconf_gnome_disable_autorun" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q gdm &amp;&amp; { [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; }; then

# Check for setting in any of the DConf db directories
# If files contain ibus or distro, ignore them.
# The assignment assumes that individual filenames don't contain :
readarray -t SETTINGSFILES &lt; &lt;(grep -r "\\[org/gnome/desktop/media-handling\\]" "/etc/dconf/db/" | grep -v 'distro\|ibus' | cut -d":" -f1)
DCONFFILE="/etc/dconf/db/local.d/00-security-settings"
DBDIR="/etc/dconf/db/local.d"

mkdir -p "${DBDIR}"

if [ "${#SETTINGSFILES[@]}" -eq 0 ]
then
    [ ! -z ${DCONFFILE} ] || echo "" &gt;&gt; ${DCONFFILE}
    printf '%s\n' "[org/gnome/desktop/media-handling]" &gt;&gt; ${DCONFFILE}
    printf '%s=%s\n' "autorun-never" "true" &gt;&gt; ${DCONFFILE}
else
    escaped_value="$(sed -e 's/\\/\\\\/g' &lt;&lt;&lt; "true")"
    if grep -q "^\\s*autorun-never\\s*=" "${SETTINGSFILES[@]}"
    then
        sed -i "s/\\s*autorun-never\\s*=\\s*.*/autorun-never=${escaped_value}/g" "${SETTINGSFILES[@]}"
    else
        sed -i "\\|\\[org/gnome/desktop/media-handling\\]|a\\autorun-never=${escaped_value}" "${SETTINGSFILES[@]}"
    fi
fi

dconf update
# Check for setting in any of the DConf db directories
LOCKFILES=$(grep -r "^/org/gnome/desktop/media-handling/autorun-never$" "/etc/dconf/db/" | grep -v 'distro\|ibus' | cut -d":" -f1)
LOCKSFOLDER="/etc/dconf/db/local.d/locks"

mkdir -p "${LOCKSFOLDER}"

if [[ -z "${LOCKFILES}" ]]
then
    echo "/org/gnome/desktop/media-handling/autorun-never" &gt;&gt; "/etc/dconf/db/local.d/locks/00-security-settings-lock"
fi

dconf update

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="dconf_gnome_disable_autorun" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="medium">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - dconf_gnome_disable_autorun
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Disable GNOME3 Automounting - autorun-never
  ini_file:
    dest: /etc/dconf/db/local.d/00-security-settings
    section: org/gnome/desktop/media-handling
    option: autorun-never
    value: 'true'
    create: true
    no_extra_spaces: true
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - dconf_gnome_disable_autorun
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Prevent user modification of GNOME3 Automounting - autorun-never
  lineinfile:
    path: /etc/dconf/db/local.d/locks/00-security-settings-lock
    regexp: ^/org/gnome/desktop/media-handling/autorun-never
    line: /org/gnome/desktop/media-handling/autorun-never
    create: true
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - dconf_gnome_disable_autorun
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Dconf Update
  command: dconf update
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - dconf_gnome_disable_autorun
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-dconf_gnome_disable_autorun:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-dconf_gnome_disable_autorun_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
        </Group>
        <Group id="xccdf_org.ssgproject.content_group_gnome_system_settings">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">GNOME System Settings</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">GNOME provides configuration and functionality to a graphical desktop environment
that changes grahical configurations or allow a user to perform
actions that users normally would not be able to do in non-graphical mode such as
remote access configuration, power policies, Geo-location, etc.
Configuring such settings in GNOME will prevent accidential graphical configuration
changes by users from taking place.</description>
          <platform idref="cpe:/a:gdm"/>
          <Rule id="xccdf_org.ssgproject.content_rule_dconf_gnome_disable_power_settings" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable Power Settings in GNOME3</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">By default, <html:code xmlns:html="http://www.w3.org/1999/xhtml">GNOME</html:code> enables a power profile designed for mobile devices
with battery usage. While useful for mobile devices, this setting should be disabled
for all other systems. To configure the system to disable the power setting, add or set
<html:code xmlns:html="http://www.w3.org/1999/xhtml">active</html:code> to <html:code xmlns:html="http://www.w3.org/1999/xhtml">false</html:code> in
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/dconf/db/local.d/00-security-settings</html:code>. For example:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">[org/gnome/settings-daemon/plugins/power]
active=false
</html:pre>
Once the settings have been added, add a lock to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/dconf/db/local.d/locks/00-security-settings-lock</html:code> to prevent user modification.
For example:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">/org/gnome/settings-daemon/plugins/power</html:pre>
After the settings have been set, run <html:code xmlns:html="http://www.w3.org/1999/xhtml">dconf update</html:code>.</description>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Power settings should not be enabled on systems that are not mobile devices.
Enabling power settings on non-mobile devices could have unintended processing
consequences on standard systems.</rationale>
            <platform idref="cpe:/a:machine"/>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-dconf_gnome_disable_power_settings:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-dconf_gnome_disable_power_settings_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_dconf_gnome_disable_ctrlaltdel_reboot" selected="false" role="full" severity="high">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable Ctrl-Alt-Del Reboot Key Sequence in GNOME3</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">By default, <html:code xmlns:html="http://www.w3.org/1999/xhtml">GNOME</html:code> will reboot the system if the
<html:code xmlns:html="http://www.w3.org/1999/xhtml">Ctrl-Alt-Del</html:code> key sequence is pressed.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
To configure the system to ignore the <html:code xmlns:html="http://www.w3.org/1999/xhtml">Ctrl-Alt-Del</html:code> key sequence
from the Graphical User Interface (GUI) instead of rebooting the system,
add or set <html:code xmlns:html="http://www.w3.org/1999/xhtml">logout</html:code> to <html:code xmlns:html="http://www.w3.org/1999/xhtml">''</html:code> in
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/dconf/db/local.d/00-security-settings</html:code>. For example:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">[org/gnome/settings-daemon/plugins/media-keys]
logout=''</html:pre>
Once the settings have been added, add a lock to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/dconf/db/local.d/locks/00-security-settings-lock</html:code> to prevent
user modification. For example:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">/org/gnome/settings-daemon/plugins/media-keys/logout</html:pre>
After the settings have been set, run <html:code xmlns:html="http://www.w3.org/1999/xhtml">dconf update</html:code>.</description>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.2</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.10.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.1.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.1.5</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.1.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.7.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.7.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.7.3.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.8.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.8.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.5</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">13</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">18</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">5</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">A locally logged-in user who presses Ctrl-Alt-Del, when at the console,
can reboot the system. If accidentally pressed, as could happen in
the case of mixed OS environment, this can create the risk of short-term
loss of availability of systems due to unintentional reboot.</rationale>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="dconf_gnome_disable_ctrlaltdel_reboot" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q gdm &amp;&amp; { [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; }; then

# Check for setting in any of the DConf db directories
# If files contain ibus or distro, ignore them.
# The assignment assumes that individual filenames don't contain :
readarray -t SETTINGSFILES &lt; &lt;(grep -r "\\[org/gnome/settings-daemon/plugins/media-keys\\]" "/etc/dconf/db/" | grep -v 'distro\|ibus' | cut -d":" -f1)
DCONFFILE="/etc/dconf/db/local.d/00-security-settings"
DBDIR="/etc/dconf/db/local.d"

mkdir -p "${DBDIR}"

if [ "${#SETTINGSFILES[@]}" -eq 0 ]
then
    [ ! -z ${DCONFFILE} ] || echo "" &gt;&gt; ${DCONFFILE}
    printf '%s\n' "[org/gnome/settings-daemon/plugins/media-keys]" &gt;&gt; ${DCONFFILE}
    printf '%s=%s\n' "logout" "''" &gt;&gt; ${DCONFFILE}
else
    escaped_value="$(sed -e 's/\\/\\\\/g' &lt;&lt;&lt; "''")"
    if grep -q "^\\s*logout\\s*=" "${SETTINGSFILES[@]}"
    then
        sed -i "s/\\s*logout\\s*=\\s*.*/logout=${escaped_value}/g" "${SETTINGSFILES[@]}"
    else
        sed -i "\\|\\[org/gnome/settings-daemon/plugins/media-keys\\]|a\\logout=${escaped_value}" "${SETTINGSFILES[@]}"
    fi
fi

dconf update
# Check for setting in any of the DConf db directories
LOCKFILES=$(grep -r "^/org/gnome/settings-daemon/plugins/media-keys/logout$" "/etc/dconf/db/" | grep -v 'distro\|ibus' | cut -d":" -f1)
LOCKSFOLDER="/etc/dconf/db/local.d/locks"

mkdir -p "${LOCKSFOLDER}"

if [[ -z "${LOCKFILES}" ]]
then
    echo "/org/gnome/settings-daemon/plugins/media-keys/logout" &gt;&gt; "/etc/dconf/db/local.d/locks/00-security-settings-lock"
fi

dconf update

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="dconf_gnome_disable_ctrlaltdel_reboot" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="medium">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-171-3.1.2
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(b)
    - dconf_gnome_disable_ctrlaltdel_reboot
    - high_severity
    - low_complexity
    - medium_disruption
    - no_reboot_needed
    - unknown_strategy

- name: Disable Ctrl-Alt-Del Reboot Key Sequence in GNOME3
  ini_file:
    dest: /etc/dconf/db/local.d/00-security-settings
    section: org/gnome/settings-daemon/plugins/media-keys
    option: logout
    value: ''''''
    create: true
    no_extra_spaces: true
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.2
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(b)
    - dconf_gnome_disable_ctrlaltdel_reboot
    - high_severity
    - low_complexity
    - medium_disruption
    - no_reboot_needed
    - unknown_strategy

- name: Prevent user modification of GNOME disablement of Ctrl-Alt-Del
  lineinfile:
    path: /etc/dconf/db/local.d/locks/00-security-settings-lock
    regexp: ^/org/gnome/settings-daemon/plugins/media-keys/logout
    line: /org/gnome/settings-daemon/plugins/media-keys/logout
    create: true
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.2
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(b)
    - dconf_gnome_disable_ctrlaltdel_reboot
    - high_severity
    - low_complexity
    - medium_disruption
    - no_reboot_needed
    - unknown_strategy

- name: Dconf Update
  command: dconf update
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.2
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(b)
    - dconf_gnome_disable_ctrlaltdel_reboot
    - high_severity
    - low_complexity
    - medium_disruption
    - no_reboot_needed
    - unknown_strategy
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-dconf_gnome_disable_ctrlaltdel_reboot:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-dconf_gnome_disable_ctrlaltdel_reboot_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_dconf_gnome_disable_user_admin" selected="false" role="full" severity="high">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable User Administration in GNOME3</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">By default, <html:code xmlns:html="http://www.w3.org/1999/xhtml">GNOME</html:code> will allow all users to have some administratrion
capability. This should be disabled so that non-administrative users are not making
configuration changes. To configure the system to disable user administration
capability in the Graphical User Interface (GUI), add or set
<html:code xmlns:html="http://www.w3.org/1999/xhtml">user-administration-disabled</html:code> to <html:code xmlns:html="http://www.w3.org/1999/xhtml">true</html:code> in
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/dconf/db/local.d/00-security-settings</html:code>. For example:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">[org/gnome/desktop/lockdown]
user-administration-disabled=true
</html:pre>
Once the settings have been added, add a lock to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/dconf/db/local.d/locks/00-security-settings-lock</html:code> to prevent user modification.
For example:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">/org/gnome/desktop/lockdown/user-administration-disabled</html:pre>
After the settings have been set, run <html:code xmlns:html="http://www.w3.org/1999/xhtml">dconf update</html:code>.</description>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.5</reference>
            <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_MOD_EXT.1</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Allowing all users to have some administratrive capabilities to the system through
the Graphical User Interface (GUI) when they would not have them otherwise could allow
unintended configuration changes as well as a nefarious user the capability to make system
changes such as adding new accounts, etc.</rationale>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="dconf_gnome_disable_user_admin" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q gdm &amp;&amp; { [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; }; then

# Check for setting in any of the DConf db directories
# If files contain ibus or distro, ignore them.
# The assignment assumes that individual filenames don't contain :
readarray -t SETTINGSFILES &lt; &lt;(grep -r "\\[org/gnome/desktop/lockdown\\]" "/etc/dconf/db/" | grep -v 'distro\|ibus' | cut -d":" -f1)
DCONFFILE="/etc/dconf/db/local.d/00-security-settings"
DBDIR="/etc/dconf/db/local.d"

mkdir -p "${DBDIR}"

if [ "${#SETTINGSFILES[@]}" -eq 0 ]
then
    [ ! -z ${DCONFFILE} ] || echo "" &gt;&gt; ${DCONFFILE}
    printf '%s\n' "[org/gnome/desktop/lockdown]" &gt;&gt; ${DCONFFILE}
    printf '%s=%s\n' "user-administration-disabled" "true" &gt;&gt; ${DCONFFILE}
else
    escaped_value="$(sed -e 's/\\/\\\\/g' &lt;&lt;&lt; "true")"
    if grep -q "^\\s*user-administration-disabled\\s*=" "${SETTINGSFILES[@]}"
    then
        sed -i "s/\\s*user-administration-disabled\\s*=\\s*.*/user-administration-disabled=${escaped_value}/g" "${SETTINGSFILES[@]}"
    else
        sed -i "\\|\\[org/gnome/desktop/lockdown\\]|a\\user-administration-disabled=${escaped_value}" "${SETTINGSFILES[@]}"
    fi
fi

dconf update
# Check for setting in any of the DConf db directories
LOCKFILES=$(grep -r "^/org/gnome/desktop/lockdown/user-administration-disabled$" "/etc/dconf/db/" | grep -v 'distro\|ibus' | cut -d":" -f1)
LOCKSFOLDER="/etc/dconf/db/local.d/locks"

mkdir -p "${LOCKSFOLDER}"

if [[ -z "${LOCKFILES}" ]]
then
    echo "/org/gnome/desktop/lockdown/user-administration-disabled" &gt;&gt; "/etc/dconf/db/local.d/locks/00-security-settings-lock"
fi

dconf update

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="dconf_gnome_disable_user_admin" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="medium">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-171-3.1.5
    - dconf_gnome_disable_user_admin
    - high_severity
    - low_complexity
    - medium_disruption
    - no_reboot_needed
    - unknown_strategy

- name: Detect if user-administration-disabled can be found on /etc/dconf/db/local.d/
  find:
    path: /etc/dconf/db/local.d/
    contains: ^\s*user-administration-disabled
  register: dconf_gnome_disable_user_admin_config_files
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.5
    - dconf_gnome_disable_user_admin
    - high_severity
    - low_complexity
    - medium_disruption
    - no_reboot_needed
    - unknown_strategy

- name: Configure user-administration-disabled - default file
  ini_file:
    dest: /etc/dconf/db/local.d//00-security-settings
    section: org/gnome/desktop/lockdown
    option: user-administration-disabled
    value: 'true'
    create: true
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - dconf_gnome_disable_user_admin_config_files is defined and dconf_gnome_disable_user_admin_config_files.matched
      == 0
  tags:
    - NIST-800-171-3.1.5
    - dconf_gnome_disable_user_admin
    - high_severity
    - low_complexity
    - medium_disruption
    - no_reboot_needed
    - unknown_strategy

- name: Configure user-administration-disabled - existing files
  ini_file:
    dest: '{{ item.path }}'
    section: org/gnome/desktop/lockdown
    option: user-administration-disabled
    value: 'true'
    create: true
  with_items: '{{ dconf_gnome_disable_user_admin_config_files.files }}'
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - dconf_gnome_disable_user_admin_config_files is defined and dconf_gnome_disable_user_admin_config_files.matched
      &gt; 0
  tags:
    - NIST-800-171-3.1.5
    - dconf_gnome_disable_user_admin
    - high_severity
    - low_complexity
    - medium_disruption
    - no_reboot_needed
    - unknown_strategy

- name: Detect if lock for user-administration-disabled can be found on /etc/dconf/db/local.d/
  find:
    path: /etc/dconf/db/local.d/locks
    contains: ^\s*user-administration-disabled
  register: dconf_gnome_disable_user_admin_lock_files
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.5
    - dconf_gnome_disable_user_admin
    - high_severity
    - low_complexity
    - medium_disruption
    - no_reboot_needed
    - unknown_strategy

- name: Prevent user modification user-administration-disabled - default file
  lineinfile:
    path: /etc/dconf/db/local.d/locks/00-security-settings-lock
    regexp: ^/org/gnome/desktop/lockdown/user-administration-disabled
    line: /org/gnome/desktop/lockdown/user-administration-disabled
    create: true
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - dconf_gnome_disable_user_admin_lock_files is defined and dconf_gnome_disable_user_admin_lock_files.matched
      == 0
  tags:
    - NIST-800-171-3.1.5
    - dconf_gnome_disable_user_admin
    - high_severity
    - low_complexity
    - medium_disruption
    - no_reboot_needed
    - unknown_strategy

- name: Prevent user modification user-administration-disabled - existing files
  lineinfile:
    path: '{{ item.path }}'
    regexp: ^/org/gnome/desktop/lockdown/user-administration-disabled
    line: /org/gnome/desktop/lockdown/user-administration-disabled
    create: true
  with_items: '{{ dconf_gnome_disable_user_admin_lock_files.files }}'
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - dconf_gnome_disable_user_admin_lock_files is defined and dconf_gnome_disable_user_admin_lock_files.matched
      &gt; 0
  tags:
    - NIST-800-171-3.1.5
    - dconf_gnome_disable_user_admin
    - high_severity
    - low_complexity
    - medium_disruption
    - no_reboot_needed
    - unknown_strategy

- name: Dconf Update - user-administration-disabled
  command: dconf update
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.5
    - dconf_gnome_disable_user_admin
    - high_severity
    - low_complexity
    - medium_disruption
    - no_reboot_needed
    - unknown_strategy
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-dconf_gnome_disable_user_admin:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-dconf_gnome_disable_user_admin_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_dconf_gnome_disable_geolocation" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable Geolocation in GNOME3</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US"><html:code xmlns:html="http://www.w3.org/1999/xhtml">GNOME</html:code> allows the clock and applications to track and access
location information. This setting should be disabled as applications
should not track system location. To configure the system to disable
location tracking, add or set <html:code xmlns:html="http://www.w3.org/1999/xhtml">enabled</html:code> to <html:code xmlns:html="http://www.w3.org/1999/xhtml">false</html:code> in
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/dconf/db/local.d/00-security-settings</html:code>. For example:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">[org/gnome/system/location]
enabled=false</html:pre>
To configure the clock to disable location tracking, add or set
<html:code xmlns:html="http://www.w3.org/1999/xhtml">geolocation</html:code> to <html:code xmlns:html="http://www.w3.org/1999/xhtml">false</html:code> in
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/dconf/db/local.d/00-security-settings</html:code>. For example:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">[org/gnome/clocks]
geolocation=false</html:pre>
Once the settings have been added, add a lock to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/dconf/db/local.d/locks/00-security-settings-lock</html:code> to prevent
user modification. For example:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">/org/gnome/system/location/enabled
/org/gnome/clocks/geolocation</html:pre>
After the settings have been set, run <html:code xmlns:html="http://www.w3.org/1999/xhtml">dconf update</html:code>.</description>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Power settings should not be enabled on systems that are not mobile devices.
Enabling power settings on non-mobile devices could have unintended processing
consequences on standard systems.</rationale>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="dconf_gnome_disable_geolocation" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="medium">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - dconf_gnome_disable_geolocation
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Disable Geolocation in GNOME3 - location tracking
  ini_file:
    dest: /etc/dconf/db/local.d/00-security-settings
    section: org/gnome/system/location
    option: enabled
    value: 'false'
    create: true
    no_extra_spaces: true
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - dconf_gnome_disable_geolocation
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Disable Geolocation in GNOME3 - clock location tracking
  ini_file:
    dest: /etc/dconf/db/local.d/00-security-settings
    section: org/gnome/clocks
    option: gelocation
    value: 'false'
    create: true
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - dconf_gnome_disable_geolocation
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Prevent user modification of GNOME geolocation - location tracking
  lineinfile:
    path: /etc/dconf/db/local.d/locks/00-security-settings-lock
    regexp: ^/org/gnome/system/location/enabled
    line: /org/gnome/system/location/enabled
    create: true
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - dconf_gnome_disable_geolocation
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Prevent user modification of GNOME geolocation - clock location tracking
  lineinfile:
    path: /etc/dconf/db/local.d/locks/00-security-settings-lock
    regexp: ^/org/gnome/clocks/geolocation
    line: /org/gnome/clocks/geolocation
    create: true
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - dconf_gnome_disable_geolocation
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Dconf Update
  command: dconf update
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - dconf_gnome_disable_geolocation
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-dconf_gnome_disable_geolocation:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-dconf_gnome_disable_geolocation_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
        </Group>
        <Group id="xccdf_org.ssgproject.content_group_gnome_screen_locking">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Configure GNOME Screen Locking</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">In the default GNOME3 desktop, the screen can be locked
by selecting the user name in the far right corner of the main panel and
selecting <html:b xmlns:html="http://www.w3.org/1999/xhtml">Lock</html:b>.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
The following sections detail commands to enforce idle activation of the screensaver,
screen locking, a blank-screen screensaver, and an idle activation time.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Because users should be trained to lock the screen when they
step away from the computer, the automatic locking feature is only
meant as a backup.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
The root account can be screen-locked; however, the root account should
<html:i xmlns:html="http://www.w3.org/1999/xhtml">never</html:i> be used to log into an X Windows environment and should only
be used to for direct login via console in emergency circumstances.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
For more information about enforcing preferences in the GNOME3 environment using the DConf
configuration system, see <html:b xmlns:html="http://www.w3.org/1999/xhtml"><html:a href="http://wiki.gnome.org/dconf">http://wiki.gnome.org/dconf</html:a></html:b> and
the man page <html:code xmlns:html="http://www.w3.org/1999/xhtml">dconf(1)</html:code>.</description>
          <platform idref="cpe:/a:gdm"/>
          <Value id="xccdf_org.ssgproject.content_value_inactivity_timeout_value" type="number">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Screensaver Inactivity timeout</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Choose allowed duration (in seconds) of inactive graphical sessions</description>
            <value selector="10_minutes">600</value>
            <value selector="15_minutes">900</value>
            <value selector="30_minutes">1800</value>
            <value selector="5_minutes">300</value>
            <value>900</value>
          </Value>
          <Value id="xccdf_org.ssgproject.content_value_var_screensaver_lock_delay" type="number">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Screensaver Lock Delay</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Choose allowed duration (in seconds) after a screensaver becomes active before displaying an authentication prompt</description>
            <value selector="10_seconds">10</value>
            <value selector="5_seconds">5</value>
            <value>0</value>
            <value selector="immediate">0</value>
          </Value>
          <Rule id="xccdf_org.ssgproject.content_rule_dconf_gnome_session_idle_user_locks" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure Users Cannot Change GNOME3 Session Idle Settings</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">If not already configured, ensure that users cannot change GNOME3 session idle settings
by adding <html:code xmlns:html="http://www.w3.org/1999/xhtml">/org/gnome/desktop/session/idle-delay</html:code>
to <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/dconf/db/local.d/locks/00-security-settings-lock</html:code> to prevent user modification.
For example:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">/org/gnome/desktop/session/idle-delay</html:pre>
After the settings have been set, run <html:code xmlns:html="http://www.w3.org/1999/xhtml">dconf update</html:code>.</description>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.10</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000057</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</reference>
            <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_MOF_EXT.1</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000029-GPOS-00010</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.10</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.10</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.18.1.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.2.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.3.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.3</reference>
            <reference href="https://www.cisecurity.org/controls/">1</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">A session time-out lock is a temporary action taken when a user stops work and moves away from the immediate
physical vicinity of the information system but does not logout because of the temporary nature of the absence.
Rather than relying on the user to manually lock their operating system session prior to vacating the vicinity,
GNOME desktops can be configured to identify when a user's session has idled and take action to initiate the
session lock. As such, users should not be allowed to change session settings.</rationale>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="dconf_gnome_session_idle_user_locks" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q gdm &amp;&amp; { [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; }; then

# Check for setting in any of the DConf db directories
LOCKFILES=$(grep -r "^/org/gnome/desktop/session/idle-delay$" "/etc/dconf/db/" | grep -v 'distro\|ibus' | cut -d":" -f1)
LOCKSFOLDER="/etc/dconf/db/local.d/locks"

mkdir -p "${LOCKSFOLDER}"

if [[ -z "${LOCKFILES}" ]]
then
    echo "/org/gnome/desktop/session/idle-delay" &gt;&gt; "/etc/dconf/db/local.d/locks/00-security-settings-lock"
fi

dconf update

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="dconf_gnome_session_idle_user_locks" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="medium">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-171-3.1.10
    - NIST-800-53-CM-6(a)
    - dconf_gnome_session_idle_user_locks
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Prevent user modification of GNOME Session idle-delay
  lineinfile:
    path: /etc/dconf/db/local.d/locks/00-security-settings-lock
    regexp: ^/org/gnome/desktop/session/idle-delay
    line: /org/gnome/desktop/session/idle-delay
    create: true
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.10
    - NIST-800-53-CM-6(a)
    - dconf_gnome_session_idle_user_locks
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Dconf Update
  command: dconf update
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.10
    - NIST-800-53-CM-6(a)
    - dconf_gnome_session_idle_user_locks
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-dconf_gnome_session_idle_user_locks:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-dconf_gnome_session_idle_user_locks_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_user_info" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable Full User Name on Splash Shield</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">By default when the screen is locked, the splash shield will show the user's
full name. This should be disabled to prevent casual observers from seeing
who has access to the system. This can be disabled by adding or setting
<html:code xmlns:html="http://www.w3.org/1999/xhtml">show-full-name-in-top-bar</html:code> to <html:code xmlns:html="http://www.w3.org/1999/xhtml">false</html:code> in
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/dconf/db/local.d/00-security-settings</html:code>. For example:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">[org/gnome/desktop/screensaver]
show-full-name-in-top-bar=false
</html:pre>
Once the settings have been added, add a lock to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/dconf/db/local.d/locks/00-security-settings-lock</html:code> to prevent user modification.
For example:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">/org/gnome/desktop/screensaver/show-full-name-in-top-bar</html:pre>
After the settings have been set, run <html:code xmlns:html="http://www.w3.org/1999/xhtml">dconf update</html:code>.</description>
            <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_MOF_EXT.1</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Setting the splash screen to not reveal the logged in user's name
conceals who has access to the system from passersby.</rationale>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="dconf_gnome_screensaver_user_info" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q gdm &amp;&amp; { [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; }; then

# Check for setting in any of the DConf db directories
# If files contain ibus or distro, ignore them.
# The assignment assumes that individual filenames don't contain :
readarray -t SETTINGSFILES &lt; &lt;(grep -r "\\[org/gnome/desktop/screensaver\\]" "/etc/dconf/db/" | grep -v 'distro\|ibus' | cut -d":" -f1)
DCONFFILE="/etc/dconf/db/local.d/00-security-settings"
DBDIR="/etc/dconf/db/local.d"

mkdir -p "${DBDIR}"

if [ "${#SETTINGSFILES[@]}" -eq 0 ]
then
    [ ! -z ${DCONFFILE} ] || echo "" &gt;&gt; ${DCONFFILE}
    printf '%s\n' "[org/gnome/desktop/screensaver]" &gt;&gt; ${DCONFFILE}
    printf '%s=%s\n' "show-full-name-in-top-bar" "false" &gt;&gt; ${DCONFFILE}
else
    escaped_value="$(sed -e 's/\\/\\\\/g' &lt;&lt;&lt; "false")"
    if grep -q "^\\s*show-full-name-in-top-bar\\s*=" "${SETTINGSFILES[@]}"
    then
        sed -i "s/\\s*show-full-name-in-top-bar\\s*=\\s*.*/show-full-name-in-top-bar=${escaped_value}/g" "${SETTINGSFILES[@]}"
    else
        sed -i "\\|\\[org/gnome/desktop/screensaver\\]|a\\show-full-name-in-top-bar=${escaped_value}" "${SETTINGSFILES[@]}"
    fi
fi

dconf update
# Check for setting in any of the DConf db directories
LOCKFILES=$(grep -r "^/org/gnome/desktop/screensaver/show-full-name-in-top-bar$" "/etc/dconf/db/" | grep -v 'distro\|ibus' | cut -d":" -f1)
LOCKSFOLDER="/etc/dconf/db/local.d/locks"

mkdir -p "${LOCKSFOLDER}"

if [[ -z "${LOCKFILES}" ]]
then
    echo "/org/gnome/desktop/screensaver/show-full-name-in-top-bar" &gt;&gt; "/etc/dconf/db/local.d/locks/00-security-settings-lock"
fi

dconf update

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="dconf_gnome_screensaver_user_info" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="medium">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - dconf_gnome_screensaver_user_info
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Disable Full Username on Splash Screen
  ini_file:
    dest: /etc/dconf/db/local.d/00-security-settings
    section: org/gnome/desktop/screensaver
    option: show-full-name-in-top-bar
    value: 'false'
    create: true
    no_extra_spaces: true
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - dconf_gnome_screensaver_user_info
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Prevent user modification of GNOME show-full-name-in-top-bar
  lineinfile:
    path: /etc/dconf/db/local.d/locks/00-security-settings-lock
    regexp: ^/org/gnome/desktop/screensaver/show-full-name-in-top-bar
    line: /org/gnome/desktop/screensaver/show-full-name-in-top-bar
    create: true
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - dconf_gnome_screensaver_user_info
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Dconf Update
  command: dconf update
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - dconf_gnome_screensaver_user_info
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-dconf_gnome_screensaver_user_info:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-dconf_gnome_screensaver_user_info_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_idle_activation_locked" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure Users Cannot Change GNOME3 Screensaver Idle Activation</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">If not already configured, ensure that users cannot change GNOME3 screensaver lock settings
by adding <html:pre xmlns:html="http://www.w3.org/1999/xhtml">/org/gnome/desktop/screensaver/idle-activation-enabled</html:pre>
to <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/dconf/db/local.d/00-security-settings</html:code>.
For example:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">/org/gnome/desktop/screensaver/idle-activation-enabled</html:pre>
After the settings have been set, run <html:code xmlns:html="http://www.w3.org/1999/xhtml">dconf update</html:code>.</description>
            <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.5</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.10</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000057</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</reference>
            <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_MOF_EXT.1</reference>
            <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-8.1.8</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000029-GPOS-00010</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.10</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.10</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.18.1.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.2.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.3.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.3</reference>
            <reference href="https://www.cisecurity.org/controls/">1</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">A session lock is a temporary action taken when a user stops work and moves away from the immediate physical vicinity
of the information system but does not want to logout because of the temporary nature of the absense.</rationale>
            <platform idref="cpe:/a:gdm"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="dconf_gnome_screensaver_idle_activation_locked" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q gdm; then

# Check for setting in any of the DConf db directories
LOCKFILES=$(grep -r "^/org/gnome/desktop/screensaver/idle-activation-enabled$" "/etc/dconf/db/" | grep -v 'distro\|ibus' | cut -d":" -f1)
LOCKSFOLDER="/etc/dconf/db/local.d/locks"

mkdir -p "${LOCKSFOLDER}"

if [[ -z "${LOCKFILES}" ]]
then
    echo "/org/gnome/desktop/screensaver/idle-activation-enabled" &gt;&gt; "/etc/dconf/db/local.d/locks/00-security-settings-lock"
fi

dconf update

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="dconf_gnome_screensaver_idle_activation_locked" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="medium">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - CJIS-5.5.5
    - NIST-800-171-3.1.10
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.1.8
    - dconf_gnome_screensaver_idle_activation_locked
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Prevent user modification of GNOME Screensaver idle-activation-enabled
  lineinfile:
    path: /etc/dconf/db/local.d/locks/00-security-settings-lock
    regexp: ^/org/gnome/desktop/screensaver/idle-activation-enabled
    line: /org/gnome/desktop/screensaver/idle-activation-enabled
    create: true
  when: '"gdm" in ansible_facts.packages'
  tags:
    - CJIS-5.5.5
    - NIST-800-171-3.1.10
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.1.8
    - dconf_gnome_screensaver_idle_activation_locked
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Dconf Update
  command: dconf update
  when: '"gdm" in ansible_facts.packages'
  tags:
    - CJIS-5.5.5
    - NIST-800-171-3.1.10
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.1.8
    - dconf_gnome_screensaver_idle_activation_locked
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-dconf_gnome_screensaver_idle_activation_locked:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-dconf_gnome_screensaver_idle_activation_locked_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_lock_locked" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure Users Cannot Change GNOME3 Screensaver Lock After Idle Period</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">If not already configured, ensure that users cannot change GNOME3 screensaver lock settings
by adding <html:pre xmlns:html="http://www.w3.org/1999/xhtml">/org/gnome/desktop/screensaver/lock-enabled</html:pre>
to <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/dconf/db/local.d/00-security-settings</html:code>.
For example:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">/org/gnome/desktop/screensaver/lock-enabled</html:pre>
After the settings have been set, run <html:code xmlns:html="http://www.w3.org/1999/xhtml">dconf update</html:code>.</description>
            <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.5</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.10</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000056</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000057</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</reference>
            <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_MOF_EXT.1</reference>
            <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-8.1.8</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000029-GPOS-00010</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.10</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.10</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.18.1.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.2.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.3.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.3</reference>
            <reference href="https://www.cisecurity.org/controls/">1</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">A session lock is a temporary action taken when a user stops work and moves away from the immediate physical vicinity
of the information system but does not want to logout because of the temporary nature of the absense.</rationale>
            <platform idref="cpe:/a:gdm"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="dconf_gnome_screensaver_lock_locked" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q gdm; then

# Check for setting in any of the DConf db directories
LOCKFILES=$(grep -r "^/org/gnome/desktop/screensaver/lock-enabled$" "/etc/dconf/db/" | grep -v 'distro\|ibus' | cut -d":" -f1)
LOCKSFOLDER="/etc/dconf/db/local.d/locks"

mkdir -p "${LOCKSFOLDER}"

if [[ -z "${LOCKFILES}" ]]
then
    echo "/org/gnome/desktop/screensaver/lock-enabled" &gt;&gt; "/etc/dconf/db/local.d/locks/00-security-settings-lock"
fi

dconf update

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="dconf_gnome_screensaver_lock_locked" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="medium">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - CJIS-5.5.5
    - NIST-800-171-3.1.10
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.1.8
    - dconf_gnome_screensaver_lock_locked
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Prevent user modification of GNOME Screensaver lock-enabled
  lineinfile:
    path: /etc/dconf/db/local.d/locks/00-security-settings-lock
    regexp: ^/org/gnome/desktop/screensaver/lock-enabled
    line: /org/gnome/desktop/screensaver/lock-enabled
    create: true
  when: '"gdm" in ansible_facts.packages'
  tags:
    - CJIS-5.5.5
    - NIST-800-171-3.1.10
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.1.8
    - dconf_gnome_screensaver_lock_locked
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Dconf Update
  command: dconf update
  when: '"gdm" in ansible_facts.packages'
  tags:
    - CJIS-5.5.5
    - NIST-800-171-3.1.10
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.1.8
    - dconf_gnome_screensaver_lock_locked
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-dconf_gnome_screensaver_lock_locked:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-dconf_gnome_screensaver_lock_locked_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_idle_delay" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Set GNOME3 Screensaver Inactivity Timeout</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The idle time-out value for inactivity in the GNOME3 desktop is configured via the <html:code xmlns:html="http://www.w3.org/1999/xhtml">idle-delay</html:code>
setting must be set under an appropriate configuration file(s) in the <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/dconf/db/local.d</html:code> directory
and locked in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/dconf/db/local.d/locks</html:code> directory to prevent user modification.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
For example, to configure the system for a 15 minute delay, add the following to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/dconf/db/local.d/00-security-settings</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">[org/gnome/desktop/session]
idle-delay=uint32 900</html:pre>
Once the setting has been added, add a lock to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/dconf/db/local.d/locks/00-security-settings-lock</html:code> to prevent user modification.
For example:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">/org/gnome/desktop/session/idle-delay</html:pre>
After the settings have been set, run <html:code xmlns:html="http://www.w3.org/1999/xhtml">dconf update</html:code>.</description>
            <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.5</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.10</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000057</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-11(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</reference>
            <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_MOF_EXT.1</reference>
            <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-8.1.8</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000029-GPOS-00010</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.10</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.10</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.18.1.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.2.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.3.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.3</reference>
            <reference href="https://www.cisecurity.org/controls/">1</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">A session time-out lock is a temporary action taken when a user stops work and moves away from
the immediate physical vicinity of the information system but does not logout because of the
temporary nature of the absence. Rather than relying on the user to manually lock their operating
system session prior to vacating the vicinity, GNOME3 can be configured to identify when
a user's session has idled and take action to initiate a session lock.</rationale>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="dconf_gnome_screensaver_idle_delay" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q gdm &amp;&amp; { [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; }; then


inactivity_timeout_value="<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_inactivity_timeout_value" use="legacy"/>"



# Check for setting in any of the DConf db directories
# If files contain ibus or distro, ignore them.
# The assignment assumes that individual filenames don't contain :
readarray -t SETTINGSFILES &lt; &lt;(grep -r "\\[org/gnome/desktop/session\\]" "/etc/dconf/db/" | grep -v 'distro\|ibus' | cut -d":" -f1)
DCONFFILE="/etc/dconf/db/local.d/00-security-settings"
DBDIR="/etc/dconf/db/local.d"

mkdir -p "${DBDIR}"

if [ "${#SETTINGSFILES[@]}" -eq 0 ]
then
    [ ! -z ${DCONFFILE} ] || echo "" &gt;&gt; ${DCONFFILE}
    printf '%s\n' "[org/gnome/desktop/session]" &gt;&gt; ${DCONFFILE}
    printf '%s=%s\n' "idle-delay" "uint32 ${inactivity_timeout_value}" &gt;&gt; ${DCONFFILE}
else
    escaped_value="$(sed -e 's/\\/\\\\/g' &lt;&lt;&lt; "uint32 ${inactivity_timeout_value}")"
    if grep -q "^\\s*idle-delay\\s*=" "${SETTINGSFILES[@]}"
    then
        sed -i "s/\\s*idle-delay\\s*=\\s*.*/idle-delay=${escaped_value}/g" "${SETTINGSFILES[@]}"
    else
        sed -i "\\|\\[org/gnome/desktop/session\\]|a\\idle-delay=${escaped_value}" "${SETTINGSFILES[@]}"
    fi
fi

dconf update
# Check for setting in any of the DConf db directories
LOCKFILES=$(grep -r "^/org/gnome/desktop/session/idle-delay$" "/etc/dconf/db/" | grep -v 'distro\|ibus' | cut -d":" -f1)
LOCKSFOLDER="/etc/dconf/db/local.d/locks"

mkdir -p "${LOCKSFOLDER}"

if [[ -z "${LOCKFILES}" ]]
then
    echo "/org/gnome/desktop/session/idle-delay" &gt;&gt; "/etc/dconf/db/local.d/locks/00-security-settings-lock"
fi

dconf update

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="dconf_gnome_screensaver_idle_delay" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="medium">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - CJIS-5.5.5
    - NIST-800-171-3.1.10
    - NIST-800-53-AC-11(a)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.1.8
    - dconf_gnome_screensaver_idle_delay
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy
- name: XCCDF Value inactivity_timeout_value # promote to variable
  set_fact:
    inactivity_timeout_value: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_inactivity_timeout_value" use="legacy"/>
  tags:
    - always

- name: Set GNOME3 Screensaver Inactivity Timeout
  ini_file:
    dest: /etc/dconf/db/local.d/00-security-settings
    section: org/gnome/desktop/session
    option: idle-delay
    value: uint32 {{ inactivity_timeout_value }}
    create: true
    no_extra_spaces: true
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.5.5
    - NIST-800-171-3.1.10
    - NIST-800-53-AC-11(a)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.1.8
    - dconf_gnome_screensaver_idle_delay
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Prevent user modification of GNOME idle-delay
  lineinfile:
    path: /etc/dconf/db/local.d/locks/00-security-settings-lock
    regexp: ^/org/gnome/desktop/session/idle-delay
    line: /org/gnome/desktop/session/idle-delay
    create: true
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.5.5
    - NIST-800-171-3.1.10
    - NIST-800-53-AC-11(a)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.1.8
    - dconf_gnome_screensaver_idle_delay
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Dconf Update
  command: dconf update
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.5.5
    - NIST-800-171-3.1.10
    - NIST-800-53-AC-11(a)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.1.8
    - dconf_gnome_screensaver_idle_delay
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-export export-name="oval:ssg-inactivity_timeout_value:var:1" value-id="xccdf_org.ssgproject.content_value_inactivity_timeout_value"/>
              <check-content-ref name="oval:ssg-dconf_gnome_screensaver_idle_delay:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-dconf_gnome_screensaver_idle_delay_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_idle_activation_enabled" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Enable GNOME3 Screensaver Idle Activation</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To activate the screensaver in the GNOME3 desktop after a period of inactivity,
add or set <html:code xmlns:html="http://www.w3.org/1999/xhtml">idle-activation-enabled</html:code> to <html:code xmlns:html="http://www.w3.org/1999/xhtml">true</html:code> in
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/dconf/db/local.d/00-security-settings</html:code>. For example:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">[org/gnome/desktop/screensaver]
idle-activation-enabled=true</html:pre>
Once the setting has been added, add a lock to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/dconf/db/local.d/locks/00-security-settings-lock</html:code> to prevent user modification.
For example:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">/org/gnome/desktop/screensaver/idle-activation-enabled</html:pre>
After the settings have been set, run <html:code xmlns:html="http://www.w3.org/1999/xhtml">dconf update</html:code>.</description>
            <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.5</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.10</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000057</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-11(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</reference>
            <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_MOF_EXT.1</reference>
            <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-8.1.8</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000029-GPOS-00010</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.10</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.10</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.18.1.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.2.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.3.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.3</reference>
            <reference href="https://www.cisecurity.org/controls/">1</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">A session time-out lock is a temporary action taken when a user stops work and moves away from the immediate
physical vicinity of the information system but does not logout because of the temporary nature of the absence.
Rather than relying on the user to manually lock their operating system session prior to vacating the vicinity,
GNOME desktops can be configured to identify when a user's session has idled and take action to initiate the
session lock.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Enabling idle activation of the screensaver ensures the screensaver will
be activated after the idle delay.  Applications requiring continuous,
real-time screen display (such as network management products) require the
login session does not have administrator rights and the display station is located in a
controlled-access area.</rationale>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="dconf_gnome_screensaver_idle_activation_enabled" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q gdm &amp;&amp; { [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; }; then

# Check for setting in any of the DConf db directories
# If files contain ibus or distro, ignore them.
# The assignment assumes that individual filenames don't contain :
readarray -t SETTINGSFILES &lt; &lt;(grep -r "\\[org/gnome/desktop/screensaver\\]" "/etc/dconf/db/" | grep -v 'distro\|ibus' | cut -d":" -f1)
DCONFFILE="/etc/dconf/db/local.d/00-security-settings"
DBDIR="/etc/dconf/db/local.d"

mkdir -p "${DBDIR}"

if [ "${#SETTINGSFILES[@]}" -eq 0 ]
then
    [ ! -z ${DCONFFILE} ] || echo "" &gt;&gt; ${DCONFFILE}
    printf '%s\n' "[org/gnome/desktop/screensaver]" &gt;&gt; ${DCONFFILE}
    printf '%s=%s\n' "idle-activation-enabled" "true" &gt;&gt; ${DCONFFILE}
else
    escaped_value="$(sed -e 's/\\/\\\\/g' &lt;&lt;&lt; "true")"
    if grep -q "^\\s*idle-activation-enabled\\s*=" "${SETTINGSFILES[@]}"
    then
        sed -i "s/\\s*idle-activation-enabled\\s*=\\s*.*/idle-activation-enabled=${escaped_value}/g" "${SETTINGSFILES[@]}"
    else
        sed -i "\\|\\[org/gnome/desktop/screensaver\\]|a\\idle-activation-enabled=${escaped_value}" "${SETTINGSFILES[@]}"
    fi
fi

dconf update
# Check for setting in any of the DConf db directories
LOCKFILES=$(grep -r "^/org/gnome/desktop/screensaver/idle-activation-enabled$" "/etc/dconf/db/" | grep -v 'distro\|ibus' | cut -d":" -f1)
LOCKSFOLDER="/etc/dconf/db/local.d/locks"

mkdir -p "${LOCKSFOLDER}"

if [[ -z "${LOCKFILES}" ]]
then
    echo "/org/gnome/desktop/screensaver/idle-activation-enabled" &gt;&gt; "/etc/dconf/db/local.d/locks/00-security-settings-lock"
fi

dconf update

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="dconf_gnome_screensaver_idle_activation_enabled" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="medium">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - CJIS-5.5.5
    - NIST-800-171-3.1.10
    - NIST-800-53-AC-11(a)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.1.8
    - dconf_gnome_screensaver_idle_activation_enabled
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Enable GNOME3 Screensaver Idle Activation
  ini_file:
    dest: /etc/dconf/db/local.d/00-security-settings
    section: org/gnome/desktop/screensaver
    option: idle_activation_enabled
    value: 'true'
    create: true
    no_extra_spaces: true
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.5.5
    - NIST-800-171-3.1.10
    - NIST-800-53-AC-11(a)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.1.8
    - dconf_gnome_screensaver_idle_activation_enabled
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Prevent user modification of GNOME idle_activation_enabled
  lineinfile:
    path: /etc/dconf/db/local.d/locks/00-security-settings-lock
    regexp: ^/org/gnome/desktop/screensaver/idle-activation-enabled
    line: /org/gnome/desktop/screensaver/idle-activation-enabled
    create: true
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.5.5
    - NIST-800-171-3.1.10
    - NIST-800-53-AC-11(a)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.1.8
    - dconf_gnome_screensaver_idle_activation_enabled
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Dconf Update
  command: dconf update
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.5.5
    - NIST-800-171-3.1.10
    - NIST-800-53-AC-11(a)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.1.8
    - dconf_gnome_screensaver_idle_activation_enabled
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-dconf_gnome_screensaver_idle_activation_enabled:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-dconf_gnome_screensaver_idle_activation_enabled_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_lock_enabled" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Enable GNOME3 Screensaver Lock After Idle Period</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">
To activate locking of the screensaver in the GNOME3 desktop when it is activated,
add or set <html:code xmlns:html="http://www.w3.org/1999/xhtml">lock-enabled</html:code> to <html:code xmlns:html="http://www.w3.org/1999/xhtml">true</html:code> in
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/dconf/db/local.d/00-security-settings</html:code>. For example:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">[org/gnome/desktop/screensaver]
lock-enabled=true
</html:pre>
Once the settings have been added, add a lock to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/dconf/db/local.d/locks/00-security-settings-lock</html:code> to prevent user modification.
For example:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">/org/gnome/desktop/screensaver/lock-enabled</html:pre>
After the settings have been set, run <html:code xmlns:html="http://www.w3.org/1999/xhtml">dconf update</html:code>.</description>
            <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.5</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.10</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000056</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000058</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000060</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</reference>
            <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_MOF_EXT.1</reference>
            <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-8.1.8</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000028-GPOS-00009</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000030-GPOS-00011</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.10</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.10</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.18.1.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.2.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.3.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.3</reference>
            <reference href="https://www.cisecurity.org/controls/">1</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">A session lock is a temporary action taken when a user stops work and moves away from the immediate physical vicinity
of the information system but does not want to logout because of the temporary nature of the absense.</rationale>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="dconf_gnome_screensaver_lock_enabled" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q gdm &amp;&amp; { [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; }; then

# Check for setting in any of the DConf db directories
# If files contain ibus or distro, ignore them.
# The assignment assumes that individual filenames don't contain :
readarray -t SETTINGSFILES &lt; &lt;(grep -r "\\[org/gnome/desktop/screensaver\\]" "/etc/dconf/db/" | grep -v 'distro\|ibus' | cut -d":" -f1)
DCONFFILE="/etc/dconf/db/local.d/00-security-settings"
DBDIR="/etc/dconf/db/local.d"

mkdir -p "${DBDIR}"

if [ "${#SETTINGSFILES[@]}" -eq 0 ]
then
    [ ! -z ${DCONFFILE} ] || echo "" &gt;&gt; ${DCONFFILE}
    printf '%s\n' "[org/gnome/desktop/screensaver]" &gt;&gt; ${DCONFFILE}
    printf '%s=%s\n' "lock-enabled" "true" &gt;&gt; ${DCONFFILE}
else
    escaped_value="$(sed -e 's/\\/\\\\/g' &lt;&lt;&lt; "true")"
    if grep -q "^\\s*lock-enabled\\s*=" "${SETTINGSFILES[@]}"
    then
        sed -i "s/\\s*lock-enabled\\s*=\\s*.*/lock-enabled=${escaped_value}/g" "${SETTINGSFILES[@]}"
    else
        sed -i "\\|\\[org/gnome/desktop/screensaver\\]|a\\lock-enabled=${escaped_value}" "${SETTINGSFILES[@]}"
    fi
fi

dconf update
# Check for setting in any of the DConf db directories
LOCKFILES=$(grep -r "^/org/gnome/desktop/screensaver/lock-enabled$" "/etc/dconf/db/" | grep -v 'distro\|ibus' | cut -d":" -f1)
LOCKSFOLDER="/etc/dconf/db/local.d/locks"

mkdir -p "${LOCKSFOLDER}"

if [[ -z "${LOCKFILES}" ]]
then
    echo "/org/gnome/desktop/screensaver/lock-enabled" &gt;&gt; "/etc/dconf/db/local.d/locks/00-security-settings-lock"
fi

dconf update

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="dconf_gnome_screensaver_lock_enabled" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="medium">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - CJIS-5.5.5
    - NIST-800-171-3.1.10
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.1.8
    - dconf_gnome_screensaver_lock_enabled
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Dconf Update
  command: dconf update
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - ansible_distribution == 'SLES'
  tags:
    - CJIS-5.5.5
    - NIST-800-171-3.1.10
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.1.8
    - dconf_gnome_screensaver_lock_enabled
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Enable GNOME3 Screensaver Lock After Idle Period
  ini_file:
    dest: /etc/dconf/db/local.d/00-security-settings
    section: org/gnome/desktop/screensaver
    option: lock-enabled
    value: 'true'
    create: true
    no_extra_spaces: true
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.5.5
    - NIST-800-171-3.1.10
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.1.8
    - dconf_gnome_screensaver_lock_enabled
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Prevent user modification of GNOME lock-enabled
  lineinfile:
    path: /etc/dconf/db/local.d/locks/00-security-settings-lock
    regexp: ^/org/gnome/desktop/screensaver/lock-enabled
    line: /org/gnome/desktop/screensaver/lock-enabled
    create: true
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.5.5
    - NIST-800-171-3.1.10
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.1.8
    - dconf_gnome_screensaver_lock_enabled
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Check GNOME3 screenserver disable-lock-screen false
  command: gsettings get org.gnome.desktop.lockdown disable-lock-screen
  register: cmd_out
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - ansible_distribution == 'SLES'
  tags:
    - CJIS-5.5.5
    - NIST-800-171-3.1.10
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.1.8
    - dconf_gnome_screensaver_lock_enabled
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Update GNOME3 screenserver disable-lock-screen false
  command: gsettings set org.gnome.desktop.lockdown disable-lock-screen false
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - ansible_distribution == 'SLES'
  tags:
    - CJIS-5.5.5
    - NIST-800-171-3.1.10
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.1.8
    - dconf_gnome_screensaver_lock_enabled
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Dconf Update
  command: dconf update
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.5.5
    - NIST-800-171-3.1.10
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.1.8
    - dconf_gnome_screensaver_lock_enabled
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-dconf_gnome_screensaver_lock_enabled:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-dconf_gnome_screensaver_lock_enabled_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_mode_blank" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Implement Blank Screensaver</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">


To set the screensaver mode in the GNOME3 desktop to a blank screen,
add or set <html:code xmlns:html="http://www.w3.org/1999/xhtml">picture-uri</html:code> to <html:code xmlns:html="http://www.w3.org/1999/xhtml">string ''</html:code> in
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/dconf/db/local.d/00-security-settings</html:code>. For example:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">[org/gnome/desktop/screensaver]
picture-uri=''
</html:pre>
Once the settings have been added, add a lock to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/dconf/db/local.d/locks/00-security-settings-lock</html:code> to prevent user modification.
For example:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">/org/gnome/desktop/screensaver/picture-uri</html:pre>
After the settings have been set, run <html:code xmlns:html="http://www.w3.org/1999/xhtml">dconf update</html:code>.</description>
            <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.5</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.10</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000060</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-11(1)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-11(1).1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000031-GPOS-00012</reference>
            <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_MOF_EXT.1</reference>
            <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-8.1.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.10</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.10</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.18.1.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.2.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.3.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.3</reference>
            <reference href="https://www.cisecurity.org/controls/">1</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Setting the screensaver mode to blank-only conceals the
contents of the display from passersby.</rationale>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="dconf_gnome_screensaver_mode_blank" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q gdm &amp;&amp; { [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; }; then

# Check for setting in any of the DConf db directories
# If files contain ibus or distro, ignore them.
# The assignment assumes that individual filenames don't contain :
readarray -t SETTINGSFILES &lt; &lt;(grep -r "\\[org/gnome/desktop/screensaver\\]" "/etc/dconf/db/" | grep -v 'distro\|ibus' | cut -d":" -f1)
DCONFFILE="/etc/dconf/db/local.d/00-security-settings"
DBDIR="/etc/dconf/db/local.d"

mkdir -p "${DBDIR}"

if [ "${#SETTINGSFILES[@]}" -eq 0 ]
then
    [ ! -z ${DCONFFILE} ] || echo "" &gt;&gt; ${DCONFFILE}
    printf '%s\n' "[org/gnome/desktop/screensaver]" &gt;&gt; ${DCONFFILE}
    printf '%s=%s\n' "picture-uri" "string ''" &gt;&gt; ${DCONFFILE}
else
    escaped_value="$(sed -e 's/\\/\\\\/g' &lt;&lt;&lt; "string ''")"
    if grep -q "^\\s*picture-uri\\s*=" "${SETTINGSFILES[@]}"
    then
        sed -i "s/\\s*picture-uri\\s*=\\s*.*/picture-uri=${escaped_value}/g" "${SETTINGSFILES[@]}"
    else
        sed -i "\\|\\[org/gnome/desktop/screensaver\\]|a\\picture-uri=${escaped_value}" "${SETTINGSFILES[@]}"
    fi
fi

dconf update
# Check for setting in any of the DConf db directories
LOCKFILES=$(grep -r "^/org/gnome/desktop/screensaver/picture-uri$" "/etc/dconf/db/" | grep -v 'distro\|ibus' | cut -d":" -f1)
LOCKSFOLDER="/etc/dconf/db/local.d/locks"

mkdir -p "${LOCKSFOLDER}"

if [[ -z "${LOCKFILES}" ]]
then
    echo "/org/gnome/desktop/screensaver/picture-uri" &gt;&gt; "/etc/dconf/db/local.d/locks/00-security-settings-lock"
fi

dconf update

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="dconf_gnome_screensaver_mode_blank" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="medium">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - CJIS-5.5.5
    - NIST-800-171-3.1.10
    - NIST-800-53-AC-11(1)
    - NIST-800-53-AC-11(1).1
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.1.8
    - dconf_gnome_screensaver_mode_blank
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Implement Blank Screensaver
  ini_file:
    dest: /etc/dconf/db/local.d/00-security-settings
    section: org/gnome/desktop/screensaver
    option: picture-uri
    value: string ''
    create: true
    no_extra_spaces: true
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.5.5
    - NIST-800-171-3.1.10
    - NIST-800-53-AC-11(1)
    - NIST-800-53-AC-11(1).1
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.1.8
    - dconf_gnome_screensaver_mode_blank
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Prevent user modification of GNOME picture-uri
  lineinfile:
    path: /etc/dconf/db/local.d/locks/00-security-settings-lock
    regexp: ^/org/gnome/desktop/screensaver/picture-uri
    line: /org/gnome/desktop/screensaver/picture-uri
    create: true
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.5.5
    - NIST-800-171-3.1.10
    - NIST-800-53-AC-11(1)
    - NIST-800-53-AC-11(1).1
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.1.8
    - dconf_gnome_screensaver_mode_blank
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Dconf Update
  command: dconf update
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.5.5
    - NIST-800-171-3.1.10
    - NIST-800-53-AC-11(1)
    - NIST-800-53-AC-11(1).1
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.1.8
    - dconf_gnome_screensaver_mode_blank
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-dconf_gnome_screensaver_mode_blank:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-dconf_gnome_screensaver_mode_blank_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_lock_delay" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Set GNOME3 Screensaver Lock Delay After Activation Period</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To activate the locking delay of the screensaver in the GNOME3 desktop when
the screensaver is activated, add or set <html:code xmlns:html="http://www.w3.org/1999/xhtml">lock-delay</html:code> to <html:code xmlns:html="http://www.w3.org/1999/xhtml" xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2">uint32 <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_screensaver_lock_delay" use="legacy"/></html:code> in
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/dconf/db/local.d/00-security-settings</html:code>. For example:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml" xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2">[org/gnome/desktop/screensaver]
lock-delay=uint32 <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_screensaver_lock_delay" use="legacy"/>
</html:pre>
Once the setting has been added, add a lock to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/dconf/db/local.d/locks/00-security-settings-lock</html:code> to prevent user modification.
For example:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">/org/gnome/desktop/screensaver/lock-delay</html:pre>
After the settings have been set, run <html:code xmlns:html="http://www.w3.org/1999/xhtml">dconf update</html:code>.</description>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.10</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000056</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000057</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-11(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</reference>
            <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_MOF_EXT.1</reference>
            <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-8.1.8</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000029-GPOS-00010</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.10</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.10</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.18.1.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.2.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.3.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.3</reference>
            <reference href="https://www.cisecurity.org/controls/">1</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">A session lock is a temporary action taken when a user stops work and moves away from the immediate physical vicinity
of the information system but does not want to logout because of the temporary nature of the absense.</rationale>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="dconf_gnome_screensaver_lock_delay" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q gdm &amp;&amp; { [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; }; then


var_screensaver_lock_delay="<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_screensaver_lock_delay" use="legacy"/>"



# Check for setting in any of the DConf db directories
# If files contain ibus or distro, ignore them.
# The assignment assumes that individual filenames don't contain :
readarray -t SETTINGSFILES &lt; &lt;(grep -r "\\[org/gnome/desktop/screensaver\\]" "/etc/dconf/db/" | grep -v 'distro\|ibus' | cut -d":" -f1)
DCONFFILE="/etc/dconf/db/local.d/00-security-settings"
DBDIR="/etc/dconf/db/local.d"

mkdir -p "${DBDIR}"

if [ "${#SETTINGSFILES[@]}" -eq 0 ]
then
    [ ! -z ${DCONFFILE} ] || echo "" &gt;&gt; ${DCONFFILE}
    printf '%s\n' "[org/gnome/desktop/screensaver]" &gt;&gt; ${DCONFFILE}
    printf '%s=%s\n' "lock-delay" "uint32 ${var_screensaver_lock_delay}" &gt;&gt; ${DCONFFILE}
else
    escaped_value="$(sed -e 's/\\/\\\\/g' &lt;&lt;&lt; "uint32 ${var_screensaver_lock_delay}")"
    if grep -q "^\\s*lock-delay\\s*=" "${SETTINGSFILES[@]}"
    then
        sed -i "s/\\s*lock-delay\\s*=\\s*.*/lock-delay=${escaped_value}/g" "${SETTINGSFILES[@]}"
    else
        sed -i "\\|\\[org/gnome/desktop/screensaver\\]|a\\lock-delay=${escaped_value}" "${SETTINGSFILES[@]}"
    fi
fi

dconf update
# Check for setting in any of the DConf db directories
LOCKFILES=$(grep -r "^/org/gnome/desktop/screensaver/lock-delay$" "/etc/dconf/db/" | grep -v 'distro\|ibus' | cut -d":" -f1)
LOCKSFOLDER="/etc/dconf/db/local.d/locks"

mkdir -p "${LOCKSFOLDER}"

if [[ -z "${LOCKFILES}" ]]
then
    echo "/org/gnome/desktop/screensaver/lock-delay" &gt;&gt; "/etc/dconf/db/local.d/locks/00-security-settings-lock"
fi

dconf update

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="dconf_gnome_screensaver_lock_delay" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="medium">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-171-3.1.10
    - NIST-800-53-AC-11(a)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.1.8
    - dconf_gnome_screensaver_lock_delay
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Set GNOME3 Screensaver Lock Delay After Activation Period
  ini_file:
    dest: /etc/dconf/db/local.d/00-security-settings
    section: org/gnome/desktop/screensaver
    option: lock-delay
    value: uint32 5
    create: true
    no_extra_spaces: true
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.10
    - NIST-800-53-AC-11(a)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.1.8
    - dconf_gnome_screensaver_lock_delay
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Prevent user modification of GNOME lock-delay
  lineinfile:
    path: /etc/dconf/db/local.d/locks/00-security-settings-lock
    regexp: ^/org/gnome/desktop/screensaver/lock-delay
    line: /org/gnome/desktop/screensaver/lock-delay
    create: true
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.10
    - NIST-800-53-AC-11(a)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.1.8
    - dconf_gnome_screensaver_lock_delay
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Dconf Update
  command: dconf update
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.10
    - NIST-800-53-AC-11(a)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.1.8
    - dconf_gnome_screensaver_lock_delay
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-export export-name="oval:ssg-var_screensaver_lock_delay:var:1" value-id="xccdf_org.ssgproject.content_value_var_screensaver_lock_delay"/>
              <check-content-ref name="oval:ssg-dconf_gnome_screensaver_lock_delay:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-dconf_gnome_screensaver_lock_delay_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_user_locks" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure Users Cannot Change GNOME3 Screensaver Settings</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">If not already configured, ensure that users cannot change GNOME3 screensaver lock settings
by adding <html:code xmlns:html="http://www.w3.org/1999/xhtml">/org/gnome/desktop/screensaver/lock-delay</html:code>
to <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/dconf/db/local.d/locks/00-security-settings-lock</html:code> to prevent user modification.
For example:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">/org/gnome/desktop/screensaver/lock-delay</html:pre>
After the settings have been set, run <html:code xmlns:html="http://www.w3.org/1999/xhtml">dconf update</html:code>.</description>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.10</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000057</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</reference>
            <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_MOF_EXT.1</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000029-GPOS-00010</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.10</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.10</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.18.1.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.2.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.3.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.3</reference>
            <reference href="https://www.cisecurity.org/controls/">1</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">A session time-out lock is a temporary action taken when a user stops work and moves away from the immediate
physical vicinity of the information system but does not logout because of the temporary nature of the absence.
Rather than relying on the user to manually lock their operating system session prior to vacating the vicinity,
GNOME desktops can be configured to identify when a user's session has idled and take action to initiate the
session lock. As such, users should not be allowed to change session settings.</rationale>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="dconf_gnome_screensaver_user_locks" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q gdm &amp;&amp; { [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; }; then

# Check for setting in any of the DConf db directories
LOCKFILES=$(grep -r "^/org/gnome/desktop/screensaver/lock-delay$" "/etc/dconf/db/" | grep -v 'distro\|ibus' | cut -d":" -f1)
LOCKSFOLDER="/etc/dconf/db/local.d/locks"

mkdir -p "${LOCKSFOLDER}"

if [[ -z "${LOCKFILES}" ]]
then
    echo "/org/gnome/desktop/screensaver/lock-delay" &gt;&gt; "/etc/dconf/db/local.d/locks/00-security-settings-lock"
fi

dconf update

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="dconf_gnome_screensaver_user_locks" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="medium">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-171-3.1.10
    - NIST-800-53-CM-6(a)
    - dconf_gnome_screensaver_user_locks
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Prevent user modification of GNOME lock-delay
  lineinfile:
    path: /etc/dconf/db/local.d/locks/00-security-settings-lock
    regexp: ^/org/gnome/desktop/screensaver/lock-delay
    line: /org/gnome/desktop/screensaver/lock-delay
    create: true
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.10
    - NIST-800-53-CM-6(a)
    - dconf_gnome_screensaver_user_locks
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Dconf Update
  command: dconf update
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.10
    - NIST-800-53-CM-6(a)
    - dconf_gnome_screensaver_user_locks
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-dconf_gnome_screensaver_user_locks:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-dconf_gnome_screensaver_user_locks_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
        </Group>
        <Group id="xccdf_org.ssgproject.content_group_gnome_login_screen">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Configure GNOME Login Screen</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">In the default GNOME desktop, the login is displayed after system boot
and can display user accounts, allow users to reboot the system, and allow users to
login automatically and/or with a guest account. The login screen should be configured
to prevent such behavior.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>

For more information about enforcing preferences in the GNOME3 environment using the DConf
configuration system, see <html:b xmlns:html="http://www.w3.org/1999/xhtml"><html:a href="https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Desktop_Migration_and_Administration_Guide/index.html">https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Desktop_Migration_and_Administration_Guide/index.html</html:a>/&gt;</html:b> and the man page <html:code xmlns:html="http://www.w3.org/1999/xhtml">dconf(1)</html:code>.</description>
          <platform idref="cpe:/a:gdm"/>
          <Rule id="xccdf_org.ssgproject.content_rule_gnome_gdm_disable_automatic_login" selected="false" role="full" severity="high">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable GDM Automatic Login</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The GNOME Display Manager (GDM) can allow users to automatically login without
user interaction or credentials. User should always be required to authenticate themselves
to the system that they are authorized to use. To disable user ability to automatically
login to the system, set the <html:code xmlns:html="http://www.w3.org/1999/xhtml">AutomaticLoginEnable</html:code> to <html:code xmlns:html="http://www.w3.org/1999/xhtml">false</html:code> in the
<html:code xmlns:html="http://www.w3.org/1999/xhtml">[daemon]</html:code> section in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/gdm/custom.conf</html:code>. For example:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">[daemon]
AutomaticLoginEnable=false</html:pre></description>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.1</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
            <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FIA_UAU.1</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00229</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.3</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.5.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.6.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.4</reference>
            <reference href="https://www.cisecurity.org/controls/">11</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">9</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Failure to restrict system access to authenticated users negatively impacts operating
system security.</rationale>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="gnome_gdm_disable_automatic_login" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q gdm &amp;&amp; { [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; }; then

if rpm --quiet -q gdm
then
	if ! grep -q "^AutomaticLoginEnable=" /etc/gdm/custom.conf
	then
		sed -i "/^\[daemon\]/a \
		AutomaticLoginEnable=False" /etc/gdm/custom.conf
	else
		sed -i "s/^AutomaticLoginEnable=.*/AutomaticLoginEnable=False/g" /etc/gdm/custom.conf
	fi
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="gnome_gdm_disable_automatic_login" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="medium">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-171-3.1.1
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(b)
    - gnome_gdm_disable_automatic_login
    - high_severity
    - low_complexity
    - medium_disruption
    - no_reboot_needed
    - unknown_strategy

- name: Disable GDM Automatic Login
  ini_file:
    dest: /etc/gdm/custom.conf
    section: daemon
    option: AutomaticLoginEnable
    value: 'false'
    no_extra_spaces: true
    create: true
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.1
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(b)
    - gnome_gdm_disable_automatic_login
    - high_severity
    - low_complexity
    - medium_disruption
    - no_reboot_needed
    - unknown_strategy
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-gnome_gdm_disable_automatic_login:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-gnome_gdm_disable_automatic_login_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_dconf_gnome_login_retries" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Set the GNOME3 Login Number of Failures</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">In the default graphical environment, the GNOME3 login
screen and be configured to restart the authentication process after
a configured number of attempts. This can be configured by setting
<html:code xmlns:html="http://www.w3.org/1999/xhtml">allowed-failures</html:code> to <html:code xmlns:html="http://www.w3.org/1999/xhtml">3</html:code> or less.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
To enable, add or edit <html:code xmlns:html="http://www.w3.org/1999/xhtml">allowed-failures</html:code> to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/dconf/db/gdm.d/00-security-settings</html:code>. For example:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">[org/gnome/login-screen]
allowed-failures=3</html:pre>
Once the setting has been added, add a lock to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/dconf/db/gdm.d/locks/00-security-settings-lock</html:code> to prevent user modification.
For example:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">/org/gnome/login-screen/allowed-failures</html:pre>
After the settings have been set, run <html:code xmlns:html="http://www.w3.org/1999/xhtml">dconf update</html:code>.</description>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.8</reference>
            <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_MOF_EXT.1</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Setting the password retry prompts that are permitted on a per-session basis to a low value
requires some software, such as SSH, to re-connect. This can slow down and
draw additional attention to some types of password-guessing attacks.</rationale>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="dconf_gnome_login_retries" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q gdm &amp;&amp; { [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; }; then

# Check for setting in any of the DConf db directories
# If files contain ibus or distro, ignore them.
# The assignment assumes that individual filenames don't contain :
readarray -t SETTINGSFILES &lt; &lt;(grep -r "\\[org/gnome/login-screen\\]" "/etc/dconf/db/" | grep -v 'distro\|ibus' | cut -d":" -f1)
DCONFFILE="/etc/dconf/db/gdm.d/00-security-settings"
DBDIR="/etc/dconf/db/gdm.d"

mkdir -p "${DBDIR}"

if [ "${#SETTINGSFILES[@]}" -eq 0 ]
then
    [ ! -z ${DCONFFILE} ] || echo "" &gt;&gt; ${DCONFFILE}
    printf '%s\n' "[org/gnome/login-screen]" &gt;&gt; ${DCONFFILE}
    printf '%s=%s\n' "allowed-failures" "3" &gt;&gt; ${DCONFFILE}
else
    escaped_value="$(sed -e 's/\\/\\\\/g' &lt;&lt;&lt; "3")"
    if grep -q "^\\s*allowed-failures\\s*=" "${SETTINGSFILES[@]}"
    then
        sed -i "s/\\s*allowed-failures\\s*=\\s*.*/allowed-failures=${escaped_value}/g" "${SETTINGSFILES[@]}"
    else
        sed -i "\\|\\[org/gnome/login-screen\\]|a\\allowed-failures=${escaped_value}" "${SETTINGSFILES[@]}"
    fi
fi

dconf update
# Check for setting in any of the DConf db directories
LOCKFILES=$(grep -r "^/org/gnome/login-screen/allowed-failures$" "/etc/dconf/db/" | grep -v 'distro\|ibus' | cut -d":" -f1)
LOCKSFOLDER="/etc/dconf/db/gdm.d/locks"

mkdir -p "${LOCKSFOLDER}"

if [[ -z "${LOCKFILES}" ]]
then
    echo "/org/gnome/login-screen/allowed-failures" &gt;&gt; "/etc/dconf/db/gdm.d/locks/00-security-settings-lock"
fi

dconf update

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="dconf_gnome_login_retries" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="medium">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-171-3.1.8
    - dconf_gnome_login_retries
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Enable the GNOME3 Login Number of Failures
  ini_file:
    dest: /etc/dconf/db/gdm.d/00-security-settings
    section: org/gnome/login-screen
    option: allowed-failures
    value: '3'
    create: true
    no_extra_spaces: true
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.8
    - dconf_gnome_login_retries
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Prevent user modification of GNOME3 Login Number of Failures
  lineinfile:
    path: /etc/dconf/db/gdm.d/locks/00-security-settings-lock
    regexp: ^/org/gnome/login-screen/allowed-failures
    line: /org/gnome/login-screen/allowed-failures
    create: true
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.8
    - dconf_gnome_login_retries
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Dconf Update
  command: dconf update
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.8
    - dconf_gnome_login_retries
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-dconf_gnome_login_retries:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-dconf_gnome_login_retries_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_gnome_gdm_disable_xdmcp" selected="false" role="full" severity="high">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable XDMCP in GDM</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">XDMCP is an unencrypted protocol, and therefore, presents a security risk, see e.g.
<html:a xmlns:html="http://www.w3.org/1999/xhtml" href="https://help.gnome.org/admin/gdm/stable/security.html.en_GB#xdmcpsecurity">XDMCP Gnome docs</html:a>.

To disable XDMCP support in Gnome, set <html:code xmlns:html="http://www.w3.org/1999/xhtml">Enable</html:code> to <html:code xmlns:html="http://www.w3.org/1999/xhtml">false</html:code> under the <html:code xmlns:html="http://www.w3.org/1999/xhtml">[xdmcp]</html:code> configuration section in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/gdm/custom.conf</html:code>. For example:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">
[xdmcp]
Enable=false
</html:pre></description>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">XDMCP provides unencrypted remote access through the Gnome Display Manager (GDM) which does
not provide for the confidentiality and integrity of user passwords or the
remote session. If a privileged user were to login using XDMCP, the
privileged user password could be compromised due to typed XEvents
and keystrokes will traversing over the network in clear text.</rationale>
            <platform idref="cpe:/a:gdm"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="gnome_gdm_disable_xdmcp" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q gdm; then

# Try find '[xdmcp]' and 'Enable' in '/etc/gdm/custom.conf', if it exists, set
# to 'false', if it isn't here, add it, if '[xdmcp]' doesn't exist, add it there
if grep -qzosP '[[:space:]]*\[xdmcp]([^\n\[]*\n+)+?[[:space:]]*Enable' '/etc/gdm/custom.conf'; then
    sed -i 's/Enable[^(\n)]*/Enable=false/' '/etc/gdm/custom.conf'
elif grep -qs '[[:space:]]*\[xdmcp]' '/etc/gdm/custom.conf'; then
    sed -i '/[[:space:]]*\[xdmcp]/a Enable=false' '/etc/gdm/custom.conf'
else
    if test -d "/etc/gdm"; then
        printf '%s\n' '[xdmcp]' 'Enable=false' &gt;&gt; '/etc/gdm/custom.conf'
    else
        echo "Config file directory '/etc/gdm' doesnt exist, not remediating, assuming non-applicability." &gt;&amp;2
    fi
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="gnome_gdm_disable_xdmcp" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="medium">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - gnome_gdm_disable_xdmcp
    - high_severity
    - low_complexity
    - medium_disruption
    - no_reboot_needed
    - unknown_strategy

- name: Disable XDMCP in GDM
  ini_file:
    path: /etc/gdm/custom.conf
    section: xdmcp
    option: Enable
    value: 'false'
    create: true
    mode: 420
  when: '"gdm" in ansible_facts.packages'
  tags:
    - gnome_gdm_disable_xdmcp
    - high_severity
    - low_complexity
    - medium_disruption
    - no_reboot_needed
    - unknown_strategy
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-gnome_gdm_disable_xdmcp:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-gnome_gdm_disable_xdmcp_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_dconf_gnome_disable_user_list" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable the GNOME3 Login User List</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">In the default graphical environment, users logging directly into the
system are greeted with a login screen that displays all known users.
This functionality should be disabled by setting <html:code xmlns:html="http://www.w3.org/1999/xhtml">disable-user-list</html:code>
to <html:code xmlns:html="http://www.w3.org/1999/xhtml">true</html:code>.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
To disable, add or edit <html:code xmlns:html="http://www.w3.org/1999/xhtml">disable-user-list</html:code> to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/dconf/db/gdm.d/00-security-settings</html:code>. For example:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">[org/gnome/login-screen]
disable-user-list=true</html:pre>
Once the setting has been added, add a lock to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/dconf/db/gdm.d/locks/00-security-settings-lock</html:code> to prevent
user modification. For example:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">/org/gnome/login-screen/disable-user-list</html:pre>
After the settings have been set, run <html:code xmlns:html="http://www.w3.org/1999/xhtml">dconf update</html:code>.</description>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-23</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Leaving the user list enabled is a security risk since it allows anyone
with physical access to the system to quickly enumerate known user accounts
without logging in.</rationale>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="dconf_gnome_disable_user_list" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="medium">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-53-AC-23
    - NIST-800-53-CM-6(a)
    - dconf_gnome_disable_user_list
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Disable the GNOME3 Login User List
  ini_file:
    dest: /etc/dconf/db/gdm.d/00-security-settings
    section: org/gnome/login-screen
    option: disable-user-list
    value: 'true'
    no_extra_spaces: true
    create: true
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-23
    - NIST-800-53-CM-6(a)
    - dconf_gnome_disable_user_list
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Prevent user modification of GNOME3 disablement of Login User List
  lineinfile:
    path: /etc/dconf/db/gdm.d/locks/00-security-settings-lock
    regexp: ^/org/gnome/login-screen/disable-user-list
    line: /org/gnome/login-screen/disable-user-list
    create: true
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-23
    - NIST-800-53-CM-6(a)
    - dconf_gnome_disable_user_list
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Dconf Update
  command: dconf update
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-23
    - NIST-800-53-CM-6(a)
    - dconf_gnome_disable_user_list
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-dconf_gnome_disable_user_list:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-dconf_gnome_disable_user_list_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_gnome_gdm_disable_guest_login" selected="false" role="full" severity="high">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable GDM Guest Login</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The GNOME Display Manager (GDM) can allow users to login without credentials
which can be useful for public kiosk scenarios. Allowing users to login without credentials
or "guest" account access has inherent security risks and should be disabled. To do disable
timed logins or guest account access, set the <html:code xmlns:html="http://www.w3.org/1999/xhtml">TimedLoginEnable</html:code> to <html:code xmlns:html="http://www.w3.org/1999/xhtml">false</html:code> in
the <html:code xmlns:html="http://www.w3.org/1999/xhtml">[daemon]</html:code> section in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/gdm/custom.conf</html:code>. For example:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">[daemon]
TimedLoginEnable=false</html:pre></description>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.1</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-2</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
            <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FIA_UAU.1</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00229</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.3</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.5.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.6.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.4</reference>
            <reference href="https://www.cisecurity.org/controls/">11</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">9</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Failure to restrict system access to authenticated users negatively impacts operating
system security.</rationale>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="gnome_gdm_disable_guest_login" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q gdm &amp;&amp; { [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; }; then

if rpm --quiet -q gdm
then
	if ! grep -q "^TimedLoginEnable=" /etc/gdm/custom.conf
	then
		sed -i "/^\[daemon\]/a \
		TimedLoginEnable=False" /etc/gdm/custom.conf
	else
		sed -i "s/^TimedLoginEnable=.*/TimedLoginEnable=False/g" /etc/gdm/custom.conf
	fi
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="gnome_gdm_disable_guest_login" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="medium">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-171-3.1.1
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-IA-2
    - gnome_gdm_disable_guest_login
    - high_severity
    - low_complexity
    - medium_disruption
    - no_reboot_needed
    - unknown_strategy

- name: Disable GDM Guest Login
  ini_file:
    dest: /etc/gdm/custom.conf
    section: daemon
    option: TimedLoginEnable
    value: 'false'
    no_extra_spaces: true
    create: true
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.1
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-IA-2
    - gnome_gdm_disable_guest_login
    - high_severity
    - low_complexity
    - medium_disruption
    - no_reboot_needed
    - unknown_strategy
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-gnome_gdm_disable_guest_login:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-gnome_gdm_disable_guest_login_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_dconf_gnome_enable_smartcard_auth" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Enable the GNOME3 Login Smartcard Authentication</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">In the default graphical environment, smart card authentication
can be enabled on the login screen by setting <html:code xmlns:html="http://www.w3.org/1999/xhtml">enable-smartcard-authentication</html:code>
to <html:code xmlns:html="http://www.w3.org/1999/xhtml">true</html:code>.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
To enable, add or edit <html:code xmlns:html="http://www.w3.org/1999/xhtml">enable-smartcard-authentication</html:code> to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/dconf/db/gdm.d/00-security-settings</html:code>. For example:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">[org/gnome/login-screen]
enable-smartcard-authentication=true</html:pre>
Once the setting has been added, add a lock to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/dconf/db/gdm.d/locks/00-security-settings-lock</html:code> to prevent user modification.
For example:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">/org/gnome/login-screen/enable-smartcard-authentication</html:pre>
After the settings have been set, run <html:code xmlns:html="http://www.w3.org/1999/xhtml">dconf update</html:code>.</description>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000765</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000766</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000767</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000768</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000771</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000772</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000884</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-001948</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-001954</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-2(3)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-2(4)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-2(8)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-2(9)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-2(11)</reference>
            <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-8.3</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000375-GPOS-00160</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000376-GPOS-00161</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000377-GPOS-00162</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Smart card login provides two-factor authentication stronger than
that provided by a username and password combination. Smart cards leverage PKI
(public key infrastructure) in order to provide and verify credentials.</rationale>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="dconf_gnome_enable_smartcard_auth" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="medium">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-53-IA-2(11)
    - NIST-800-53-IA-2(3)
    - NIST-800-53-IA-2(4)
    - NIST-800-53-IA-2(8)
    - NIST-800-53-IA-2(9)
    - PCI-DSS-Req-8.3
    - dconf_gnome_enable_smartcard_auth
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Enable the GNOME3 Login Smartcard Authentication
  ini_file:
    dest: /etc/dconf/db/gdm.d/00-security-settings
    section: org/gnome/login-screen
    option: enable-smartcard-authentication
    value: 'true'
    create: true
    no_extra_spaces: true
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-IA-2(11)
    - NIST-800-53-IA-2(3)
    - NIST-800-53-IA-2(4)
    - NIST-800-53-IA-2(8)
    - NIST-800-53-IA-2(9)
    - PCI-DSS-Req-8.3
    - dconf_gnome_enable_smartcard_auth
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Prevent user modification of GNOME3 disablement of Smartcard Authentication
  lineinfile:
    path: /etc/dconf/db/gdm.d/locks/00-security-settings-lock
    regexp: ^/org/gnome/login-screen/enable-smartcard-authentication
    line: /org/gnome/login-screen/enable-smartcard-authentication
    create: true
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-IA-2(11)
    - NIST-800-53-IA-2(3)
    - NIST-800-53-IA-2(4)
    - NIST-800-53-IA-2(8)
    - NIST-800-53-IA-2(9)
    - PCI-DSS-Req-8.3
    - dconf_gnome_enable_smartcard_auth
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Dconf Update
  command: dconf update
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-IA-2(11)
    - NIST-800-53-IA-2(3)
    - NIST-800-53-IA-2(4)
    - NIST-800-53-IA-2(8)
    - NIST-800-53-IA-2(9)
    - PCI-DSS-Req-8.3
    - dconf_gnome_enable_smartcard_auth
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-dconf_gnome_enable_smartcard_auth:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-dconf_gnome_enable_smartcard_auth_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_dconf_gnome_lock_screen_on_smartcard_removal" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Enable the GNOME3 Screen Locking On Smartcard Removal</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">In the default graphical environment, screen locking on smartcard removal
can be enabled by setting <html:code xmlns:html="http://www.w3.org/1999/xhtml">removal-action</html:code>
to <html:code xmlns:html="http://www.w3.org/1999/xhtml">lock-screen</html:code>.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
To enable, add or edit <html:code xmlns:html="http://www.w3.org/1999/xhtml">removal-action</html:code> to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/dconf/db/local.d/00-security-settings</html:code>. For example:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">[org/gnome/settings-daemon/peripherals/smartcard]
removal-action=lock-screen</html:pre>
Once the setting has been added, add a lock to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/dconf/db/local.d/locks/00-security-settings-lock</html:code> to prevent user modification.
For example:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">/org/gnome/settings-daemon/peripherals/smartcard/removal-action</html:pre>
After the settings have been set, run <html:code xmlns:html="http://www.w3.org/1999/xhtml">dconf update</html:code>.</description>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000056</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000028-GPOS-00009</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000030-GPOS-00011</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Locking the screen automatically when removing the smartcard can
prevent undesired access to system.</rationale>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="dconf_gnome_lock_screen_on_smartcard_removal" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q gdm &amp;&amp; { [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; }; then

# Check for setting in any of the DConf db directories
# If files contain ibus or distro, ignore them.
# The assignment assumes that individual filenames don't contain :
readarray -t SETTINGSFILES &lt; &lt;(grep -r "\\[org/gnome/settings-daemon/peripherals/smartcard\\]" "/etc/dconf/db/" | grep -v 'distro\|ibus' | cut -d":" -f1)
DCONFFILE="/etc/dconf/db/local.d/00-security-settings"
DBDIR="/etc/dconf/db/local.d"

mkdir -p "${DBDIR}"

if [ "${#SETTINGSFILES[@]}" -eq 0 ]
then
    [ ! -z ${DCONFFILE} ] || echo "" &gt;&gt; ${DCONFFILE}
    printf '%s\n' "[org/gnome/settings-daemon/peripherals/smartcard]" &gt;&gt; ${DCONFFILE}
    printf '%s=%s\n' "removal-action" "lock-screen" &gt;&gt; ${DCONFFILE}
else
    escaped_value="$(sed -e 's/\\/\\\\/g' &lt;&lt;&lt; "lock-screen")"
    if grep -q "^\\s*removal-action\\s*=" "${SETTINGSFILES[@]}"
    then
        sed -i "s/\\s*removal-action\\s*=\\s*.*/removal-action=${escaped_value}/g" "${SETTINGSFILES[@]}"
    else
        sed -i "\\|\\[org/gnome/settings-daemon/peripherals/smartcard\\]|a\\removal-action=${escaped_value}" "${SETTINGSFILES[@]}"
    fi
fi

dconf update
# Check for setting in any of the DConf db directories
LOCKFILES=$(grep -r "^/org/gnome/settings-daemon/peripherals/smartcard/removal-action$" "/etc/dconf/db/" | grep -v 'distro\|ibus' | cut -d":" -f1)
LOCKSFOLDER="/etc/dconf/db/local.d/locks"

mkdir -p "${LOCKSFOLDER}"

if [[ -z "${LOCKFILES}" ]]
then
    echo "/org/gnome/settings-daemon/peripherals/smartcard/removal-action" &gt;&gt; "/etc/dconf/db/local.d/locks/00-security-settings-lock"
fi

dconf update

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="dconf_gnome_lock_screen_on_smartcard_removal" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="medium">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - dconf_gnome_lock_screen_on_smartcard_removal
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Detect if removal-action can be found on /etc/dconf/db/local.d/
  find:
    path: /etc/dconf/db/local.d/
    contains: ^\s*removal-action
  register: dconf_gnome_lock_screen_on_smartcard_removal_config_files
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - dconf_gnome_lock_screen_on_smartcard_removal
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Configure removal-action - default file
  ini_file:
    dest: /etc/dconf/db/local.d//00-security-settings
    section: org/gnome/settings-daemon/peripherals/smartcard
    option: removal-action
    value: lock-screen
    create: true
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - dconf_gnome_lock_screen_on_smartcard_removal_config_files is defined and dconf_gnome_lock_screen_on_smartcard_removal_config_files.matched
      == 0
  tags:
    - dconf_gnome_lock_screen_on_smartcard_removal
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Configure removal-action - existing files
  ini_file:
    dest: '{{ item.path }}'
    section: org/gnome/settings-daemon/peripherals/smartcard
    option: removal-action
    value: lock-screen
    create: true
  with_items: '{{ dconf_gnome_lock_screen_on_smartcard_removal_config_files.files
    }}'
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - dconf_gnome_lock_screen_on_smartcard_removal_config_files is defined and dconf_gnome_lock_screen_on_smartcard_removal_config_files.matched
      &gt; 0
  tags:
    - dconf_gnome_lock_screen_on_smartcard_removal
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Detect if lock for removal-action can be found on /etc/dconf/db/local.d/
  find:
    path: /etc/dconf/db/local.d/locks
    contains: ^\s*removal-action
  register: dconf_gnome_lock_screen_on_smartcard_removal_lock_files
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - dconf_gnome_lock_screen_on_smartcard_removal
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Prevent user modification removal-action - default file
  lineinfile:
    path: /etc/dconf/db/local.d/locks/00-security-settings-lock
    regexp: ^/org/gnome/settings-daemon/peripherals/smartcard/removal-action
    line: /org/gnome/settings-daemon/peripherals/smartcard/removal-action
    create: true
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - dconf_gnome_lock_screen_on_smartcard_removal_lock_files is defined and dconf_gnome_lock_screen_on_smartcard_removal_lock_files.matched
      == 0
  tags:
    - dconf_gnome_lock_screen_on_smartcard_removal
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Prevent user modification removal-action - existing files
  lineinfile:
    path: '{{ item.path }}'
    regexp: ^/org/gnome/settings-daemon/peripherals/smartcard/removal-action
    line: /org/gnome/settings-daemon/peripherals/smartcard/removal-action
    create: true
  with_items: '{{ dconf_gnome_lock_screen_on_smartcard_removal_lock_files.files }}'
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - dconf_gnome_lock_screen_on_smartcard_removal_lock_files is defined and dconf_gnome_lock_screen_on_smartcard_removal_lock_files.matched
      &gt; 0
  tags:
    - dconf_gnome_lock_screen_on_smartcard_removal
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Dconf Update - removal-action
  command: dconf update
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - dconf_gnome_lock_screen_on_smartcard_removal
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-dconf_gnome_lock_screen_on_smartcard_removal:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-dconf_gnome_lock_screen_on_smartcard_removal_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_dconf_gnome_disable_restart_shutdown" selected="false" role="full" severity="high">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable the GNOME3 Login Restart and Shutdown Buttons</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">In the default graphical environment, users logging directly into the
system are greeted with a login screen that allows any user, known or
unknown, the ability the ability to shutdown or restart the system. This
functionality should be disabled by setting
<html:code xmlns:html="http://www.w3.org/1999/xhtml">disable-restart-buttons</html:code> to <html:code xmlns:html="http://www.w3.org/1999/xhtml">true</html:code>.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
To disable, add or edit <html:code xmlns:html="http://www.w3.org/1999/xhtml">disable-restart-buttons</html:code> to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/dconf/db/gdm.d/00-security-settings</html:code>. For example:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">[org/gnome/login-screen]
disable-restart-buttons=true</html:pre>
Once the setting has been added, add a lock to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/dconf/db/gdm.d/locks/00-security-settings-lock</html:code> to prevent
user modification. For example:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">/org/gnome/login-screen/disable-restart-buttons</html:pre>
After the settings have been set, run <html:code xmlns:html="http://www.w3.org/1999/xhtml">dconf update</html:code>.</description>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.2</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.10.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.1.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.1.5</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.1.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.7.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.7.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.7.3.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.8.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.8.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.5</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">13</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">18</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">5</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">A user who is at the console can reboot the system at the login screen. If restart or shutdown buttons
are pressed at the login screen, this can create the risk of short-term loss of availability of systems
due to reboot.</rationale>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="dconf_gnome_disable_restart_shutdown" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="medium">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-171-3.1.2
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(b)
    - dconf_gnome_disable_restart_shutdown
    - high_severity
    - low_complexity
    - medium_disruption
    - no_reboot_needed
    - unknown_strategy

- name: Disable the GNOME3 Login Restart and Shutdown Buttons
  ini_file:
    dest: /etc/dconf/db/gdm.d/00-security-settings
    section: org/gnome/login-screen
    option: disable-restart-buttons
    value: 'true'
    create: true
    no_extra_spaces: true
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.2
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(b)
    - dconf_gnome_disable_restart_shutdown
    - high_severity
    - low_complexity
    - medium_disruption
    - no_reboot_needed
    - unknown_strategy

- name: Prevent user modification of GNOME disablement of Login Restart and Shutdown
    Buttons
  lineinfile:
    path: /etc/dconf/db/gdm.d/locks/00-security-settings-lock
    regexp: ^/org/gnome/login-screen/disable-restart-buttons
    line: /org/gnome/login-screen/disable-restart-buttons
    create: true
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.2
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(b)
    - dconf_gnome_disable_restart_shutdown
    - high_severity
    - low_complexity
    - medium_disruption
    - no_reboot_needed
    - unknown_strategy

- name: Dconf Update
  command: dconf update
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.2
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(b)
    - dconf_gnome_disable_restart_shutdown
    - high_severity
    - low_complexity
    - medium_disruption
    - no_reboot_needed
    - unknown_strategy
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-dconf_gnome_disable_restart_shutdown:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-dconf_gnome_disable_restart_shutdown_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
        </Group>
      </Group>
      <Group id="xccdf_org.ssgproject.content_group_disk_partitioning">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disk Partitioning</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To ensure separation and protection of data, there
are top-level system directories which should be placed on their
own physical partition or logical volume. The installer's default
partitioning scheme creates separate logical volumes for
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/</html:code>, <html:code xmlns:html="http://www.w3.org/1999/xhtml">/boot</html:code>, and <html:code xmlns:html="http://www.w3.org/1999/xhtml">swap</html:code>.
<html:ul xmlns:html="http://www.w3.org/1999/xhtml"><html:li>If starting with any of the default layouts, check the box to
\"Review and modify partitioning.\" This allows for the easy creation
of additional logical volumes inside the volume group already
created, though it may require making <html:code>/</html:code>'s logical volume smaller to
create space. In general, using logical volumes is preferable to
using partitions because they can be more easily adjusted
later.</html:li><html:li>If creating a custom layout, create the partitions mentioned in
the previous paragraph (which the installer will require anyway),
as well as separate ones described in the following sections.</html:li></html:ul>
If a system has already been installed, and the default
partitioning
scheme was used, it is possible but nontrivial to
modify it to create separate logical volumes for the directories
listed above. The Logical Volume Manager (LVM) makes this possible.
See the LVM HOWTO at 
    <html:a xmlns:html="http://www.w3.org/1999/xhtml" href="http://tldp.org/HOWTO/LVM-HOWTO/">http://tldp.org/HOWTO/LVM-HOWTO/</html:a>
for more detailed information on LVM.</description>
        <Rule id="xccdf_org.ssgproject.content_rule_partition_for_usr" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure /usr Located On Separate Partition</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">It is recommended that the <html:code xmlns:html="http://www.w3.org/1999/xhtml">/usr</html:code> directory resides on a separate
partition.</description>
          <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R12)</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">/usr</html:code> partition contains system software, utilities and files.
Putting it on a separate partition allows limiting its size and applying
restrictions through mount options.</rationale>
          <platform idref="cpe:/a:machine"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="partition_for_usr" system="urn:redhat:anaconda:pre" complexity="low" disruption="high" strategy="enable">
part /usr
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-partition_for_usr:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-partition_for_usr_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_partition_for_tmp" selected="false" role="full" severity="low">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure /tmp Located On Separate Partition</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">/tmp</html:code> directory is a world-writable directory used
for temporary file storage. Ensure it has its own partition or
logical volume at installation time, or migrate it using LVM.</description>
          <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R12)</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-5(2)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
          <reference href="https://www.cisecurity.org/controls/">12</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">8</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">/tmp</html:code> partition is used as temporary storage by many programs.
Placing <html:code xmlns:html="http://www.w3.org/1999/xhtml">/tmp</html:code> in its own partition enables the setting of more
restrictive mount options, which can help protect programs which use it.</rationale>
          <platform idref="cpe:/a:machine"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="partition_for_tmp" system="urn:redhat:anaconda:pre" complexity="low" disruption="high" strategy="enable">
part /tmp
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-partition_for_tmp:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-partition_for_tmp_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_partition_for_home" selected="false" role="full" severity="low">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure /home Located On Separate Partition</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">If user home directories will be stored locally, create a separate partition
for <html:code xmlns:html="http://www.w3.org/1999/xhtml">/home</html:code> at installation time (or migrate it later using LVM). If
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/home</html:code> will be mounted from another system such as an NFS server, then
creating a separate partition is not necessary at installation time, and the
mountpoint can instead be configured later.</description>
          <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R12)</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-001208</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-5(2)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
          <reference href="https://www.cisecurity.org/controls/">12</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">8</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensuring that <html:code xmlns:html="http://www.w3.org/1999/xhtml">/home</html:code> is mounted on its own partition enables the
setting of more restrictive mount options, and also helps ensure that
users cannot trivially fill partitions used for log or audit data storage.</rationale>
          <platform idref="cpe:/a:machine"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="partition_for_home" system="urn:redhat:anaconda:pre" complexity="low" disruption="high" strategy="enable">
part /home
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-partition_for_home:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-partition_for_home_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_partition_for_var" selected="false" role="full" severity="low">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure /var Located On Separate Partition</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">/var</html:code> directory is used by daemons and other system
services to store frequently-changing data. Ensure that <html:code xmlns:html="http://www.w3.org/1999/xhtml">/var</html:code> has its own partition
or logical volume at installation time, or migrate it using LVM.</description>
          <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R12)</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-5(2)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
          <reference href="">SRG-OS-000341-VMM-001220</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
          <reference href="https://www.cisecurity.org/controls/">12</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">8</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensuring that <html:code xmlns:html="http://www.w3.org/1999/xhtml">/var</html:code> is mounted on its own partition enables the
setting of more restrictive mount options. This helps protect
system services such as daemons or other programs which use it.
It is not uncommon for the <html:code xmlns:html="http://www.w3.org/1999/xhtml">/var</html:code> directory to contain
world-writable directories installed by other software packages.</rationale>
          <platform idref="cpe:/a:machine"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="partition_for_var" system="urn:redhat:anaconda:pre" complexity="low" disruption="high" strategy="enable">
part /var
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-partition_for_var:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-partition_for_var_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_partition_for_var_log" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure /var/log Located On Separate Partition</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">System logs are stored in the <html:code xmlns:html="http://www.w3.org/1999/xhtml">/var/log</html:code> directory.
Ensure that it has its own partition or logical
volume at installation time, or migrate it using LVM.</description>
          <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R12)</reference>
          <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R47)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-4</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-5(2)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.4.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.4.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.4.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.4.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.7.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
          <reference href="https://www.cisecurity.org/controls/">1</reference>
          <reference href="https://www.cisecurity.org/controls/">12</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">16</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">5</reference>
          <reference href="https://www.cisecurity.org/controls/">6</reference>
          <reference href="https://www.cisecurity.org/controls/">8</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Placing <html:code xmlns:html="http://www.w3.org/1999/xhtml">/var/log</html:code> in its own partition
enables better separation between log files
and other files in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/var/</html:code>.</rationale>
          <platform idref="cpe:/a:machine"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="partition_for_var_log" system="urn:redhat:anaconda:pre" complexity="low" disruption="high" strategy="enable">
part /var/log
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-partition_for_var_log:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-partition_for_var_log_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_partition_for_boot" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure /boot Located On Separate Partition</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">It is recommended that the <html:code xmlns:html="http://www.w3.org/1999/xhtml">/boot</html:code> directory resides on a separate
partition. This makes it easier to apply restrictions e.g. through the
<html:code xmlns:html="http://www.w3.org/1999/xhtml">noexec</html:code> mount option. Eventually, the <html:code xmlns:html="http://www.w3.org/1999/xhtml">/boot</html:code> partition can
be configured not to be mounted automatically with the <html:code xmlns:html="http://www.w3.org/1999/xhtml">noauto</html:code> mount
option.</description>
          <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R12)</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">/boot</html:code> partition contains the kernel and bootloader files.
Access to this partition should be restricted.</rationale>
          <platform idref="cpe:/a:machine"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="partition_for_boot" system="urn:redhat:anaconda:pre" complexity="low" disruption="high" strategy="enable">
part /boot
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-partition_for_boot:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-partition_for_boot_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_partition_for_var_log_audit" selected="false" role="full" severity="low">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure /var/log/audit Located On Separate Partition</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Audit logs are stored in the <html:code xmlns:html="http://www.w3.org/1999/xhtml">/var/log/audit</html:code> directory.  Ensure that it
has its own partition or logical volume at installation time, or migrate it
later using LVM. Make absolutely certain that it is large enough to store all
audit logs that will be created by the auditing daemon.</description>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-001849</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(ii)</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.1.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.4.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.4.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.4.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.4.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.7.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.17.2.1</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-4</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-5(2)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000341-GPOS-00132</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
          <reference href="">SRG-OS-000341-VMM-001220</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI04.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
          <reference href="https://www.cisecurity.org/controls/">1</reference>
          <reference href="https://www.cisecurity.org/controls/">12</reference>
          <reference href="https://www.cisecurity.org/controls/">13</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">16</reference>
          <reference href="https://www.cisecurity.org/controls/">2</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">5</reference>
          <reference href="https://www.cisecurity.org/controls/">6</reference>
          <reference href="https://www.cisecurity.org/controls/">8</reference>
          <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R43)</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Placing <html:code xmlns:html="http://www.w3.org/1999/xhtml">/var/log/audit</html:code> in its own partition
enables better separation between audit files
and other files, and helps ensure that
auditing cannot be halted due to the partition running out
of space.</rationale>
          <platform idref="cpe:/a:machine"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="partition_for_var_log_audit" system="urn:redhat:anaconda:pre" complexity="low" disruption="high" strategy="enable">
part /var/log/audit
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-partition_for_var_log_audit:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-partition_for_var_log_audit_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_partition_for_opt" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure /opt Located On Separate Partition</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">It is recommended that the <html:code xmlns:html="http://www.w3.org/1999/xhtml">/opt</html:code> directory resides on a separate
partition.</description>
          <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R12)</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">/opt</html:code> partition contains additional software, usually installed
outside the packaging system. Putting this directory on a separate partition
makes it easier to apply restrictions e.g. through the <html:code xmlns:html="http://www.w3.org/1999/xhtml">nosuid</html:code> mount
option.</rationale>
          <platform idref="cpe:/a:machine"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="partition_for_opt" system="urn:redhat:anaconda:pre" complexity="low" disruption="high" strategy="enable">
part /opt
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-partition_for_opt:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-partition_for_opt_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_partition_for_srv" selected="false" role="full" severity="unknown">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure /srv Located On Separate Partition</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">If a file server (FTP, TFTP...) is hosted locally, create a separate partition
for <html:code xmlns:html="http://www.w3.org/1999/xhtml">/srv</html:code> at installation time (or migrate it later using LVM). If
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/srv</html:code> will be mounted from another system such as an NFS server, then
creating a separate partition is not necessary at installation time, and the
mountpoint can instead be configured later.</description>
          <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R12)</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Srv deserves files for local network file server such as FTP. Ensuring
that <html:code xmlns:html="http://www.w3.org/1999/xhtml">/srv</html:code> is mounted on its own partition enables the setting of
more restrictive mount options, and also helps ensure that
users cannot trivially fill partitions used for log or audit data storage.</rationale>
          <platform idref="cpe:/a:machine"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="partition_for_srv" system="urn:redhat:anaconda:pre" complexity="low" disruption="high" strategy="enable">
part /srv
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-partition_for_srv:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-partition_for_srv_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
      </Group>
      <Group id="xccdf_org.ssgproject.content_group_sap_host">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">SAP Specific Requirement</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">SAP (Systems, Applications and Products in Data Processing) is enterprise
software to manage business operations and customer relations. The
following section contains SAP specific requirement that is not part
of standard or common OS setting.</description>
        <Value id="xccdf_org.ssgproject.content_value_var_accounts_authorized_local_users_regex" operator="pattern match" type="string" interactive="true">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Accounts Authorized Local Users on the Operating System</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">List the user accounts that are authorized locally on the operating system. This list
includes both users requried by the operating system and by the installed applications.
Depending on the Operating System distribution, version, software groups and applications,
the user list is different and can be customized with scap-workbench.
OVAL regular expression is used for the user list.
The list starts with '^' and ends with '$' so that it matches exactly the
username, not any string that includes the username. Users are separated with '|'.
For example, three users: bin, oracle and sapadm are allowd, then the list is
<html:code xmlns:html="http://www.w3.org/1999/xhtml">^(bin|oracle|sapadm)$</html:code>. The user <html:code xmlns:html="http://www.w3.org/1999/xhtml">root</html:code> is the only user that is hard coded
in OVAL that is always allowed on the operating system.</description>
          <value selector="ol7forsap">^(root|bin|daemon|adm|lp|sync|shutdown|halt|mail|operator|games|ftp|nobody|pegasus|systemd-bus-proxy|systemd-network|dbus|polkitd|abrt|unbound|tss|libstoragemgmt|rpc|colord|usbmuxd$|pcp|saslauth|geoclue|setroubleshoot|rtkit|chrony|qemu|radvd|rpcuser|nfsnobody|pulse|gdm|gnome-initial-setup|postfix|avahi|ntp|sshd|tcpdump|oprofile|uuidd)$</value>
          <value selector="saponol7">^(root|bin|daemon|adm|lp|sync|shutdown|halt|mail|operator|games|ftp|nobody|pegasus|systemd-bus-proxy|systemd-network|dbus|polkitd|abrt|unbound|tss|libstoragemgmt|rpc|colord|usbmuxd$|pcp|saslauth|geoclue|setroubleshoot|rtkit|chrony|qemu|radvd|rpcuser|nfsnobody|pulse|gdm|gnome-initial-setup|postfix|avahi|ntp|sshd|tcpdump|oprofile|uuidd|[a-z][a-z0-9][a-z0-9]adm|ora[a-z][a-z0-9][a-z0-9]|sapadm|oracle)$</value>
        </Value>
      </Group>
      <Group id="xccdf_org.ssgproject.content_group_updating">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Updating Software</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">dnf</html:code> command line tool is used to install and
update software packages. The system also provides a graphical
software update tool in the <html:b xmlns:html="http://www.w3.org/1999/xhtml">System</html:b> menu, in the <html:b xmlns:html="http://www.w3.org/1999/xhtml">Administration</html:b> submenu,
called <html:b xmlns:html="http://www.w3.org/1999/xhtml">Software Update</html:b>.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Fedora systems contain an installed software catalog called
the RPM database, which records metadata of installed packages. Consistently using
<html:code xmlns:html="http://www.w3.org/1999/xhtml">dnf</html:code> or the graphical <html:b xmlns:html="http://www.w3.org/1999/xhtml">Software Update</html:b> for all software installation
allows for insight into the current inventory of installed software on the system.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/></description>
        <Rule id="xccdf_org.ssgproject.content_rule_package_dnf-automatic_installed" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Install dnf-automatic Package</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">dnf-automatic</html:code> package can be installed with the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">
$ sudo dnf install dnf-automatic</html:pre></description>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000191-GPOS-00080</reference>
          <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R8)</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US"><html:code xmlns:html="http://www.w3.org/1999/xhtml">dnf-automatic</html:code> is an alternative command line interface (CLI)
to <html:code xmlns:html="http://www.w3.org/1999/xhtml">dnf upgrade</html:code> suitable for automatic, regular execution.</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_dnf-automatic_installed" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="enable">
if ! rpm -q --quiet "dnf-automatic" ; then
    dnf install -y "dnf-automatic"
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_dnf-automatic_installed" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="enable">- name: Ensure dnf-automatic is installed
  package:
    name: dnf-automatic
    state: present
  tags:
    - enable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - package_dnf-automatic_installed
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_dnf-automatic_installed" system="urn:xccdf:fix:script:puppet" complexity="low" disruption="low" strategy="enable">include install_dnf-automatic

class install_dnf-automatic {
  package { 'dnf-automatic':
    ensure =&gt; 'installed',
  }
}
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_dnf-automatic_installed" system="urn:redhat:anaconda:pre" complexity="low" disruption="low" strategy="enable">
package --add=dnf-automatic
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_dnf-automatic_installed" system="urn:redhat:osbuild:blueprint">
[[packages]]
name = "dnf-automatic"
version = "*"
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-package_dnf-automatic_installed:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-package_dnf-automatic_installed_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_ensure_fedora_gpgkey_installed" selected="false" role="full" severity="high">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure Fedora GPG Key Installed</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To ensure the system can cryptographically verify base software
packages come from Fedora (and to connect to the Fedora Network to
receive them), the Fedora GPG key must properly be installed.
To install the Fedora GPG key, run one of the commands below, depending on your Fedora vesion:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo rpm --import /etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-31-primary</html:pre>"
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo rpm --import /etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-30-primary</html:pre>"</description>
          <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.10.4.1</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.4.8</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-001749</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(c)(1)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(c)(2)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(2)(i)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-5(3)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SI-7</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-12</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-12(3)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-6</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-8</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
          <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-6.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.4</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI06.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.11.2.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.5.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.6.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.2.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.2.4</reference>
          <reference href="https://www.cisecurity.org/controls/">11</reference>
          <reference href="https://www.cisecurity.org/controls/">2</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">9</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Changes to software components can have significant effects on the
overall security of the operating system. This requirement ensures
the software has not been tampered with and that it has been provided
by a trusted vendor. The Fedora GPG key is necessary to
cryptographically verify packages are from Fedora."</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="ensure_fedora_gpgkey_installed" system="urn:xccdf:fix:script:sh">
dnf install -y gpg

fedora_version=$(grep -oP '[[:digit:]]+' /etc/redhat-release)

function get_release_fingerprint {
    if [ "${fedora_version}" -eq "31" ]; then
        readonly FEDORA_RELEASE_FINGERPRINT="7D22D5867F2A4236474BF7B850CB390B3C3359C4"
    elif [ "${fedora_version}" -eq "30" ]; then
        readonly FEDORA_RELEASE_FINGERPRINT="F1D8EC98F241AAF20DF69420EF3C111FCFC659B9"
    elif [ "${fedora_version}" -eq "32" ]; then
        readonly FEDORA_RELEASE_FINGERPRINT="97A1AE57C3A2372CCA3A4ABA6C13026D12C944D0"
    else
        printf '%s\n' "This Fedora version '$fedora_version' is not supported anymore, please upgrade to a newer version." &gt;&amp;2
        return 1
    fi
}

# Location of the key we would like to import (once it's integrity verified)
readonly REDHAT_RELEASE_KEY="/etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-${fedora_version}-primary"

RPM_GPG_DIR_PERMS=$(stat -c %a "$(dirname "$REDHAT_RELEASE_KEY")")

function remediate_gpgkey_installed {
    # Return if there was an issue getting the release fingerprint
    get_release_fingerprint || return 1
    # Verify /etc/pki/rpm-gpg directory permissions are safe
    if [ "${RPM_GPG_DIR_PERMS}" -le "755" ]; then
        # If they are safe, try to obtain fingerprints from the key file
        # (to ensure there won't be e.g. CRC error).
        readarray -t GPG_OUT &lt; &lt;(gpg --show-keys --with-fingerprint --with-colons "${REDHAT_RELEASE_KEY}" | grep '^fpr' | cut -d ":" -f 10)
        GPG_RESULT=$?
        # No CRC error, safe to proceed
        if [ "${GPG_RESULT}" -eq "0" ]; then
            echo "${GPG_OUT}" | grep -vE "${FEDORA_RELEASE_FINGERPRINT}" || {
            # If file doesn't contain any keys with unknown fingerprint, import it
            rpm --import "${REDHAT_RELEASE_KEY}"
            }
        fi
    fi
}

remediate_gpgkey_installed
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-ensure_fedora_gpgkey_installed:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-ensure_fedora_gpgkey_installed_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_ensure_gpgcheck_never_disabled" selected="false" role="full" severity="high">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure gpgcheck Enabled for All dnf Package Repositories</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To ensure signature checking is not disabled for
any repos, remove any lines from files in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/yum.repos.d</html:code> of the form:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">gpgcheck=0</html:pre></description>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000366-GPOS-00153</reference>
          <reference href="">SRG-OS-000366-VMM-001430</reference>
          <reference href="">SRG-OS-000370-VMM-001460</reference>
          <reference href="">SRG-OS-000404-VMM-001650</reference>
          <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.10.4.1</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.4.8</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-001749</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(c)(1)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(c)(2)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(2)(i)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-5(3)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SI-7</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-12</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-12(3)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SA-12</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SA-12(10)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-11(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-11(b)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-6</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-8</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
          <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FPT_TUD_EXT.1</reference>
          <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FPT_TUD_EXT.2</reference>
          <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-6.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.4</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI06.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.11.2.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.5.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.6.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.2.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.2.4</reference>
          <reference href="https://www.cisecurity.org/controls/">11</reference>
          <reference href="https://www.cisecurity.org/controls/">2</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">9</reference>
          <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R15)</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Verifying the authenticity of the software prior to installation validates
the integrity of the patch or upgrade received from a vendor. This ensures
the software has not been tampered with and that it has been provided by a
trusted vendor. Self-signed certificates are disallowed by this
requirement. Certificates used to verify the software must be from an
approved Certificate Authority (CA)."</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="ensure_gpgcheck_never_disabled" system="urn:xccdf:fix:script:sh">sed -i 's/gpgcheck\s*=.*/gpgcheck=1/g' /etc/yum.repos.d/*
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="ensure_gpgcheck_never_disabled" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="medium" strategy="enable">- name: Grep for dnf repo section names
  shell: |
    set -o pipefail
    grep -HEr '^\[.+\]' -r /etc/yum.repos.d/
  register: repo_grep_results
  ignore_errors: true
  changed_when: false
  tags:
    - CJIS-5.10.4.1
    - NIST-800-171-3.4.8
    - NIST-800-53-CM-11(a)
    - NIST-800-53-CM-11(b)
    - NIST-800-53-CM-5(3)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-SA-12
    - NIST-800-53-SA-12(10)
    - NIST-800-53-SC-12
    - NIST-800-53-SC-12(3)
    - NIST-800-53-SI-7
    - PCI-DSS-Req-6.2
    - enable_strategy
    - ensure_gpgcheck_never_disabled
    - high_severity
    - low_complexity
    - medium_disruption
    - no_reboot_needed

- name: Set gpgcheck=1 for each dnf repo
  ini_file:
    path: '{{ item[0] }}'
    section: '{{ item[1] }}'
    option: gpgcheck
    value: '1'
    no_extra_spaces: true
  loop: '{{ repo_grep_results.stdout | regex_findall( ''(.+\.repo):\[(.+)\]\n?'' )
    }}'
  tags:
    - CJIS-5.10.4.1
    - NIST-800-171-3.4.8
    - NIST-800-53-CM-11(a)
    - NIST-800-53-CM-11(b)
    - NIST-800-53-CM-5(3)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-SA-12
    - NIST-800-53-SA-12(10)
    - NIST-800-53-SC-12
    - NIST-800-53-SC-12(3)
    - NIST-800-53-SI-7
    - PCI-DSS-Req-6.2
    - enable_strategy
    - ensure_gpgcheck_never_disabled
    - high_severity
    - low_complexity
    - medium_disruption
    - no_reboot_needed
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-ensure_gpgcheck_never_disabled:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-ensure_gpgcheck_never_disabled_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_security_patches_up_to_date" selected="false" role="full" severity="high">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure Software Patches Installed</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US"><html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
NOTE: U.S. Defense systems are required to be patched within 30 days or sooner as local policy
dictates.</description>
          <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">Fedora does not have a corresponding OVAL CVE Feed. Therefore, this will result in a "not checked" result during a scan.</warning>
          <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.10.4.1</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-001227</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SI-2(5)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SI-2(c)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.RA-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-12</reference>
          <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_MOF_EXT.1</reference>
          <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-6.2</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
          <reference href="">SRG-OS-000480-VMM-002000</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.12</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.9</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO12.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO12.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO12.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO12.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI03.10</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.6.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.16.1.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.18.2.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.18.2.3</reference>
          <reference href="https://www.cisecurity.org/controls/">18</reference>
          <reference href="https://www.cisecurity.org/controls/">20</reference>
          <reference href="https://www.cisecurity.org/controls/">4</reference>
          <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R08)</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Installing software updates is a fundamental mitigation against
the exploitation of publicly-known vulnerabilities. If the most
recent security patches and updates are not installed, unauthorized
users may take advantage of weaknesses in the unpatched software. The
lack of prompt attention to patching could result in a system compromise.</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="security_patches_up_to_date" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="high" strategy="patch">- name: Security patches are up to date
  package:
    name: '*'
    state: latest
  tags:
    - CJIS-5.10.4.1
    - NIST-800-53-CM-6(a)
    - NIST-800-53-SI-2(5)
    - NIST-800-53-SI-2(c)
    - PCI-DSS-Req-6.2
    - high_disruption
    - high_severity
    - low_complexity
    - patch_strategy
    - reboot_required
    - security_patches_up_to_date
    - skip_ansible_lint
</fix>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_dnf-automatic_security_updates_only" selected="false" role="full" severity="low">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Configure dnf-automatic to Install Only Security Updates</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To configure <html:code xmlns:html="http://www.w3.org/1999/xhtml">dnf-automatic</html:code> to install only security updates
automatically, set <html:code xmlns:html="http://www.w3.org/1999/xhtml">upgrade_type</html:code> to <html:code xmlns:html="http://www.w3.org/1999/xhtml">security</html:code> under
<html:code xmlns:html="http://www.w3.org/1999/xhtml">[commands]</html:code> section in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/dnf/automatic.conf</html:code>.</description>
          <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_SMF_EXT.1</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SI-2(5)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SI-2(c)</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000191-GPOS-00080</reference>
          <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R8)</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">By default, <html:code xmlns:html="http://www.w3.org/1999/xhtml">dnf-automatic</html:code> installs all available updates.
Reducing the amount of updated packages only to updates that were
issued as a part of a security advisory increases the system stability.</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="dnf-automatic_security_updates_only" system="urn:xccdf:fix:script:sh">
CONF="/etc/dnf/automatic.conf"
APPLY_UPDATES_REGEX="[[:space:]]*\[commands]([^\n\[]*\n+)+?[[:space:]]*upgrade_type"
COMMANDS_REGEX="[[:space:]]*\[commands]"

# Try find [commands] and upgrade_type in automatic.conf, if it exists, set
# it to security, if it isn't here, add it, if [commands] doesn't exist,
# add it there
if grep -qzosP $APPLY_UPDATES_REGEX $CONF; then
    sed -i "s/upgrade_type[^(\n)]*/upgrade_type = security/" $CONF
elif grep -qs $COMMANDS_REGEX $CONF; then
    sed -i "/$COMMANDS_REGEX/a upgrade_type = security" $CONF
else
    mkdir -p /etc/dnf
    echo -e "[commands]\nupgrade_type = security" &gt;&gt; $CONF
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="dnf-automatic_security_updates_only" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="medium">- name: Configure dnf-automatic to Install Only Security Updates
  ini_file:
    dest: /etc/dnf/automatic.conf
    section: commands
    option: upgrade_type
    value: security
    create: true
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-SI-2(5)
    - NIST-800-53-SI-2(c)
    - dnf-automatic_security_updates_only
    - low_complexity
    - low_severity
    - medium_disruption
    - no_reboot_needed
    - unknown_strategy
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-dnf-automatic_security_updates_only:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-dnf-automatic_security_updates_only_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_dnf-automatic_apply_updates" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Configure dnf-automatic to Install Available Updates Automatically</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To ensure that the packages comprising the available updates will be automatically installed by <html:code xmlns:html="http://www.w3.org/1999/xhtml">dnf-automatic</html:code>, set <html:code xmlns:html="http://www.w3.org/1999/xhtml">apply_updates</html:code> to <html:code xmlns:html="http://www.w3.org/1999/xhtml">yes</html:code> under <html:code xmlns:html="http://www.w3.org/1999/xhtml">[commands]</html:code> section in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/dnf/automatic.conf</html:code>.</description>
          <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_SMF_EXT.1</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SI-2(5)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SI-2(c)</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000191-GPOS-00080</reference>
          <reference href="">0940</reference>
          <reference href="">1144</reference>
          <reference href="">1467</reference>
          <reference href="">1472</reference>
          <reference href="">1483</reference>
          <reference href="">1493</reference>
          <reference href="">1494</reference>
          <reference href="">1495</reference>
          <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R8)</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Installing software updates is a fundamental mitigation against
the exploitation of publicly-known vulnerabilities. If the most
recent security patches and updates are not installed, unauthorized
users may take advantage of weaknesses in the unpatched software. The
lack of prompt attention to patching could result in a system compromise.
The automated installation of updates ensures that recent security patches
are applied in a timely manner.</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="dnf-automatic_apply_updates" system="urn:xccdf:fix:script:sh">
CONF="/etc/dnf/automatic.conf"
APPLY_UPDATES_REGEX="[[:space:]]*\[commands]([^\n\[]*\n+)+?[[:space:]]*apply_updates"
COMMANDS_REGEX="[[:space:]]*\[commands]"

# Try find [commands] and apply_updates in automatic.conf, if it exists, set
# to yes, if it isn't here, add it, if [commands] doesn't exist, add it there
if grep -qzosP $APPLY_UPDATES_REGEX $CONF; then
    sed -i "s/apply_updates[^(\n)]*/apply_updates = yes/" $CONF
elif grep -qs $COMMANDS_REGEX $CONF; then
    sed -i "/$COMMANDS_REGEX/a apply_updates = yes" $CONF
else
    mkdir -p /etc/dnf
    echo -e "[commands]\napply_updates = yes" &gt;&gt; $CONF
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="dnf-automatic_apply_updates" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="medium">- name: Configure dnf-automatic to Install Available Updates Automatically
  ini_file:
    dest: /etc/dnf/automatic.conf
    section: commands
    option: apply_updates
    value: 'yes'
    create: true
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-SI-2(5)
    - NIST-800-53-SI-2(c)
    - dnf-automatic_apply_updates
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-dnf-automatic_apply_updates:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-dnf-automatic_apply_updates_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_timer_dnf-automatic_enabled" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Enable dnf-automatic Timer</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">
The <html:code xmlns:html="http://www.w3.org/1999/xhtml">dnf-automatic</html:code> timer can be enabled with the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo systemctl enable dnf-automatic.timer</html:pre></description>
          <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_SMF_EXT.1</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SI-2(5)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SI-2(c)</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000191-GPOS-00080</reference>
          <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R8)</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">dnf-automatic</html:code> is an alternative command line interface (CLI) to <html:code xmlns:html="http://www.w3.org/1999/xhtml">dnf upgrade</html:code> with specific facilities to make it suitable to be executed automatically and regularly from systemd timers, cron jobs and similar.
The tool is controlled by <html:code xmlns:html="http://www.w3.org/1999/xhtml">dnf-automatic.timer</html:code> SystemD timer.</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="timer_dnf-automatic_enabled" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="enable">
SYSTEMCTL_EXEC='/usr/bin/systemctl'
"$SYSTEMCTL_EXEC" start 'dnf-automatic.timer'
"$SYSTEMCTL_EXEC" enable 'dnf-automatic.timer'
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="timer_dnf-automatic_enabled" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="enable">- name: Enable timer dnf-automatic
  block:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: Enable timer dnf-automatic
      systemd:
        name: dnf-automatic.timer
        enabled: 'yes'
        state: started
      when:
        - '"dnf-automatic" in ansible_facts.packages'
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-SI-2(5)
    - NIST-800-53-SI-2(c)
    - enable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - timer_dnf-automatic_enabled
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-timer_dnf-automatic_enabled:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-timer_dnf-automatic_enabled_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_ensure_gpgcheck_globally_activated" selected="false" role="full" severity="high">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure gpgcheck Enabled In Main dnf Configuration</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">gpgcheck</html:code> option controls whether
RPM packages' signatures are always checked prior to installation.
To configure dnf to check package signatures before installing
them, ensure the following line appears in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/dnf/dnf.conf</html:code> in
the <html:code xmlns:html="http://www.w3.org/1999/xhtml">[main]</html:code> section:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">gpgcheck=1</html:pre></description>
          <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.10.4.1</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.4.8</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-001749</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(c)(1)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(c)(2)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(2)(i)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-5(3)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SI-7</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-12</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-12(3)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SA-12</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SA-12(10)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-11(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-11(b)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-6</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-8</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
          <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FPT_TUD_EXT.1</reference>
          <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FPT_TUD_EXT.2</reference>
          <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-6.2</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000366-GPOS-00153</reference>
          <reference href="">SRG-OS-000366-VMM-001430</reference>
          <reference href="">SRG-OS-000370-VMM-001460</reference>
          <reference href="">SRG-OS-000404-VMM-001650</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.4</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI06.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.11.2.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.5.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.6.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.2.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.2.4</reference>
          <reference href="https://www.cisecurity.org/controls/">11</reference>
          <reference href="https://www.cisecurity.org/controls/">2</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">9</reference>
          <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R15)</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Changes to any software components can have significant effects on the
overall security of the operating system. This requirement ensures the
software has not been tampered with and that it has been provided by a
trusted vendor.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Accordingly, patches, service packs, device drivers, or operating system
components must be signed with a certificate recognized and approved by the
organization.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>Verifying the authenticity of the software prior to installation
validates the integrity of the patch or upgrade received from a vendor.
This ensures the software has not been tampered with and that it has been
provided by a trusted vendor. Self-signed certificates are disallowed by
this requirement. Certificates used to verify the software must be from an
approved Certificate Authority (CA).</rationale>
          <platform idref="cpe:/a:yum"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="ensure_gpgcheck_globally_activated" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q yum; then

<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_replace_or_append" use="legacy"/>
replace_or_append "/etc/dnf/dnf.conf" '^gpgcheck' '1' ''

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="ensure_gpgcheck_globally_activated" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="medium">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - CJIS-5.10.4.1
    - NIST-800-171-3.4.8
    - NIST-800-53-CM-11(a)
    - NIST-800-53-CM-11(b)
    - NIST-800-53-CM-5(3)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-SA-12
    - NIST-800-53-SA-12(10)
    - NIST-800-53-SC-12
    - NIST-800-53-SC-12(3)
    - NIST-800-53-SI-7
    - PCI-DSS-Req-6.2
    - ensure_gpgcheck_globally_activated
    - high_severity
    - low_complexity
    - medium_disruption
    - no_reboot_needed
    - unknown_strategy

- name: Check existence of yum on Fedora
  stat:
    path: /etc/yum.conf
  register: yum_config_file
  check_mode: false
  when:
    - '"yum" in ansible_facts.packages'
    - ansible_distribution == "Fedora"
  tags:
    - CJIS-5.10.4.1
    - NIST-800-171-3.4.8
    - NIST-800-53-CM-11(a)
    - NIST-800-53-CM-11(b)
    - NIST-800-53-CM-5(3)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-SA-12
    - NIST-800-53-SA-12(10)
    - NIST-800-53-SC-12
    - NIST-800-53-SC-12(3)
    - NIST-800-53-SI-7
    - PCI-DSS-Req-6.2
    - ensure_gpgcheck_globally_activated
    - high_severity
    - low_complexity
    - medium_disruption
    - no_reboot_needed
    - unknown_strategy

- name: Ensure GPG check is globally activated (yum)
  ini_file:
    dest: /etc/yum.conf
    section: main
    option: gpgcheck
    value: 1
    no_extra_spaces: true
    create: false
  when:
    - '"yum" in ansible_facts.packages'
    - (ansible_distribution == "RedHat" or ansible_distribution == "CentOS" or ansible_distribution
      == "Scientific" or yum_config_file.stat.exists)
  tags:
    - CJIS-5.10.4.1
    - NIST-800-171-3.4.8
    - NIST-800-53-CM-11(a)
    - NIST-800-53-CM-11(b)
    - NIST-800-53-CM-5(3)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-SA-12
    - NIST-800-53-SA-12(10)
    - NIST-800-53-SC-12
    - NIST-800-53-SC-12(3)
    - NIST-800-53-SI-7
    - PCI-DSS-Req-6.2
    - ensure_gpgcheck_globally_activated
    - high_severity
    - low_complexity
    - medium_disruption
    - no_reboot_needed
    - unknown_strategy

- name: Ensure GPG check is globally activated (dnf)
  ini_file:
    dest: /etc/dnf/dnf.conf
    section: main
    option: gpgcheck
    value: 1
    no_extra_spaces: true
    create: false
  when:
    - '"yum" in ansible_facts.packages'
    - ansible_distribution == "Fedora"
  tags:
    - CJIS-5.10.4.1
    - NIST-800-171-3.4.8
    - NIST-800-53-CM-11(a)
    - NIST-800-53-CM-11(b)
    - NIST-800-53-CM-5(3)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-SA-12
    - NIST-800-53-SA-12(10)
    - NIST-800-53-SC-12
    - NIST-800-53-SC-12(3)
    - NIST-800-53-SI-7
    - PCI-DSS-Req-6.2
    - ensure_gpgcheck_globally_activated
    - high_severity
    - low_complexity
    - medium_disruption
    - no_reboot_needed
    - unknown_strategy
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-ensure_gpgcheck_globally_activated:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-ensure_gpgcheck_globally_activated_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_ensure_gpgcheck_local_packages" selected="false" role="full" severity="high">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure gpgcheck Enabled for Local Packages</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US"><html:code xmlns:html="http://www.w3.org/1999/xhtml">dnf</html:code> should be configured to verify the signature(s) of local packages
prior to installation. To configure <html:code xmlns:html="http://www.w3.org/1999/xhtml">dnf</html:code> to verify signatures of local
packages, set the <html:code xmlns:html="http://www.w3.org/1999/xhtml">localpkg_gpgcheck</html:code> to <html:code xmlns:html="http://www.w3.org/1999/xhtml">1</html:code> in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/dnf/dnf.conf</html:code>.</description>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.4.8</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-001749</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(c)(1)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(c)(2)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(2)(i)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-11(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-11(b)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-5(3)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SA-12</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SA-12(10)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
          <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FPT_TUD_EXT.1</reference>
          <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FPT_TUD_EXT.2</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000366-GPOS-00153</reference>
          <reference href="">SRG-OS-000366-VMM-001430</reference>
          <reference href="">SRG-OS-000370-VMM-001460</reference>
          <reference href="">SRG-OS-000404-VMM-001650</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.3</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.5.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.6.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.2.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.2.4</reference>
          <reference href="https://www.cisecurity.org/controls/">11</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">9</reference>
          <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R15)</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Changes to any software components can have significant effects to the overall security
of the operating system. This requirement ensures the software has not been tampered and
has been provided by a trusted vendor.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Accordingly, patches, service packs, device drivers, or operating system components must
be signed with a certificate recognized and approved by the organization.</rationale>
          <platform idref="cpe:/a:yum"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="ensure_gpgcheck_local_packages" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q yum; then

<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_replace_or_append" use="legacy"/>
replace_or_append '/etc/dnf/dnf.conf' '^localpkg_gpgcheck' '1' ''

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="ensure_gpgcheck_local_packages" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="medium">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-171-3.4.8
    - NIST-800-53-CM-11(a)
    - NIST-800-53-CM-11(b)
    - NIST-800-53-CM-5(3)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-SA-12
    - NIST-800-53-SA-12(10)
    - ensure_gpgcheck_local_packages
    - high_severity
    - low_complexity
    - medium_disruption
    - no_reboot_needed
    - unknown_strategy

- name: Check existence of yum on Fedora
  stat:
    path: /etc/yum.conf
  register: yum_config_file
  check_mode: false
  when:
    - '"yum" in ansible_facts.packages'
    - ansible_distribution == "Fedora"
  tags:
    - NIST-800-171-3.4.8
    - NIST-800-53-CM-11(a)
    - NIST-800-53-CM-11(b)
    - NIST-800-53-CM-5(3)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-SA-12
    - NIST-800-53-SA-12(10)
    - ensure_gpgcheck_local_packages
    - high_severity
    - low_complexity
    - medium_disruption
    - no_reboot_needed
    - unknown_strategy

- name: Ensure GPG check Enabled for Local Packages (Yum)
  ini_file:
    dest: /etc/yum.conf
    section: main
    option: localpkg_gpgcheck
    value: 1
    create: true
  when:
    - '"yum" in ansible_facts.packages'
    - (ansible_distribution == "RedHat" or ansible_distribution == "CentOS" or ansible_distribution
      == "Scientific" or yum_config_file.stat.exists)
  tags:
    - NIST-800-171-3.4.8
    - NIST-800-53-CM-11(a)
    - NIST-800-53-CM-11(b)
    - NIST-800-53-CM-5(3)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-SA-12
    - NIST-800-53-SA-12(10)
    - ensure_gpgcheck_local_packages
    - high_severity
    - low_complexity
    - medium_disruption
    - no_reboot_needed
    - unknown_strategy

- name: Ensure GPG check Enabled for Local Packages (DNF)
  ini_file:
    dest: /etc/dnf/dnf.conf
    section: main
    option: localpkg_gpgcheck
    value: 1
    create: true
  when:
    - '"yum" in ansible_facts.packages'
    - ansible_distribution == "Fedora"
  tags:
    - NIST-800-171-3.4.8
    - NIST-800-53-CM-11(a)
    - NIST-800-53-CM-11(b)
    - NIST-800-53-CM-5(3)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-SA-12
    - NIST-800-53-SA-12(10)
    - ensure_gpgcheck_local_packages
    - high_severity
    - low_complexity
    - medium_disruption
    - no_reboot_needed
    - unknown_strategy
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-ensure_gpgcheck_local_packages:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-ensure_gpgcheck_local_packages_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
      </Group>
    </Group>
    <Group id="xccdf_org.ssgproject.content_group_accounts">
      <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Account and Access Control</title>
      <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">In traditional Unix security, if an attacker gains
shell access to a certain login account, they can perform any action
or access any file to which that account has access. Therefore,
making it more difficult for unauthorized people to gain shell
access to accounts, particularly to privileged accounts, is a
necessary part of securing a system. This section introduces
mechanisms for restricting access to accounts under
Fedora.</description>
      <Group id="xccdf_org.ssgproject.content_group_accounts-banners">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Warning Banners for System Accesses</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Each system should expose as little information about
itself as possible.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
System banners, which are typically displayed just before a
login prompt, give out information about the service or the host's
operating system. This might include the distribution name and the
system kernel version, and the particular version of a network
service. This information can assist intruders in gaining access to
the system as it can reveal whether the system is running
vulnerable software. Most network services can be configured to
limit what information is displayed.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Many organizations implement security policies that require a
system banner provide notice of the system's ownership, provide
warning to unauthorized users, and remind authorized users of their
consent to monitoring.</description>
        <Value id="xccdf_org.ssgproject.content_value_login_banner_text" type="string">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Login Banner Verbiage</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Enter an appropriate login banner for your organization. Please note that new lines must
be expressed by the '\n' character and special characters like parentheses and quotation marks must be escaped with '\\'.</description>
          <value selector="dod_banners">^(You[\s\n]+are[\s\n]+accessing[\s\n]+a[\s\n]+U\.S\.[\s\n]+Government[\s\n]+\(USG\)[\s\n]+Information[\s\n]+System[\s\n]+\(IS\)[\s\n]+that[\s\n]+is[\s\n]+provided[\s\n]+for[\s\n]+USG\-authorized[\s\n]+use[\s\n]+only\.[\s\n]+By[\s\n]+using[\s\n]+this[\s\n]+IS[\s\n]+\(which[\s\n]+includes[\s\n]+any[\s\n]+device[\s\n]+attached[\s\n]+to[\s\n]+this[\s\n]+IS\)\,[\s\n]+you[\s\n]+consent[\s\n]+to[\s\n]+the[\s\n]+following[\s\n]+conditions\:(?:[\n]+|(?:\\n)+)\-The[\s\n]+USG[\s\n]+routinely[\s\n]+intercepts[\s\n]+and[\s\n]+monitors[\s\n]+communications[\s\n]+on[\s\n]+this[\s\n]+IS[\s\n]+for[\s\n]+purposes[\s\n]+including\,[\s\n]+but[\s\n]+not[\s\n]+limited[\s\n]+to\,[\s\n]+penetration[\s\n]+testing\,[\s\n]+COMSEC[\s\n]+monitoring\,[\s\n]+network[\s\n]+operations[\s\n]+and[\s\n]+defense\,[\s\n]+personnel[\s\n]+misconduct[\s\n]+\(PM\)\,[\s\n]+law[\s\n]+enforcement[\s\n]+\(LE\)\,[\s\n]+and[\s\n]+counterintelligence[\s\n]+\(CI\)[\s\n]+investigations\.(?:[\n]+|(?:\\n)+)\-At[\s\n]+any[\s\n]+time\,[\s\n]+the[\s\n]+USG[\s\n]+may[\s\n]+inspect[\s\n]+and[\s\n]+seize[\s\n]+data[\s\n]+stored[\s\n]+on[\s\n]+this[\s\n]+IS\.(?:[\n]+|(?:\\n)+)\-Communications[\s\n]+using\,[\s\n]+or[\s\n]+data[\s\n]+stored[\s\n]+on\,[\s\n]+this[\s\n]+IS[\s\n]+are[\s\n]+not[\s\n]+private\,[\s\n]+are[\s\n]+subject[\s\n]+to[\s\n]+routine[\s\n]+monitoring\,[\s\n]+interception\,[\s\n]+and[\s\n]+search\,[\s\n]+and[\s\n]+may[\s\n]+be[\s\n]+disclosed[\s\n]+or[\s\n]+used[\s\n]+for[\s\n]+any[\s\n]+USG\-authorized[\s\n]+purpose\.(?:[\n]+|(?:\\n)+)\-This[\s\n]+IS[\s\n]+includes[\s\n]+security[\s\n]+measures[\s\n]+\(e\.g\.\,[\s\n]+authentication[\s\n]+and[\s\n]+access[\s\n]+controls\)[\s\n]+to[\s\n]+protect[\s\n]+USG[\s\n]+interests\-\-not[\s\n]+for[\s\n]+your[\s\n]+personal[\s\n]+benefit[\s\n]+or[\s\n]+privacy\.(?:[\n]+|(?:\\n)+)\-Notwithstanding[\s\n]+the[\s\n]+above\,[\s\n]+using[\s\n]+this[\s\n]+IS[\s\n]+does[\s\n]+not[\s\n]+constitute[\s\n]+consent[\s\n]+to[\s\n]+PM\,[\s\n]+LE[\s\n]+or[\s\n]+CI[\s\n]+investigative[\s\n]+searching[\s\n]+or[\s\n]+monitoring[\s\n]+of[\s\n]+the[\s\n]+content[\s\n]+of[\s\n]+privileged[\s\n]+communications\,[\s\n]+or[\s\n]+work[\s\n]+product\,[\s\n]+related[\s\n]+to[\s\n]+personal[\s\n]+representation[\s\n]+or[\s\n]+services[\s\n]+by[\s\n]+attorneys\,[\s\n]+psychotherapists\,[\s\n]+or[\s\n]+clergy\,[\s\n]+and[\s\n]+their[\s\n]+assistants\.[\s\n]+Such[\s\n]+communications[\s\n]+and[\s\n]+work[\s\n]+product[\s\n]+are[\s\n]+private[\s\n]+and[\s\n]+confidential\.[\s\n]+See[\s\n]+User[\s\n]+Agreement[\s\n]+for[\s\n]+details\.|I've[\s\n]+read[\s\n]+\&amp;[\s\n]+consent[\s\n]+to[\s\n]+terms[\s\n]+in[\s\n]+IS[\s\n]+user[\s\n]+agreem't\.)$</value>
          <value selector="dod_default">^You[\s\n]+are[\s\n]+accessing[\s\n]+a[\s\n]+U\.S\.[\s\n]+Government[\s\n]+\(USG\)[\s\n]+Information[\s\n]+System[\s\n]+\(IS\)[\s\n]+that[\s\n]+is[\s\n]+provided[\s\n]+for[\s\n]+USG\-authorized[\s\n]+use[\s\n]+only\.[\s\n]+By[\s\n]+using[\s\n]+this[\s\n]+IS[\s\n]+\(which[\s\n]+includes[\s\n]+any[\s\n]+device[\s\n]+attached[\s\n]+to[\s\n]+this[\s\n]+IS\)\,[\s\n]+you[\s\n]+consent[\s\n]+to[\s\n]+the[\s\n]+following[\s\n]+conditions\:(?:[\n]+|(?:\\n)+)\-The[\s\n]+USG[\s\n]+routinely[\s\n]+intercepts[\s\n]+and[\s\n]+monitors[\s\n]+communications[\s\n]+on[\s\n]+this[\s\n]+IS[\s\n]+for[\s\n]+purposes[\s\n]+including\,[\s\n]+but[\s\n]+not[\s\n]+limited[\s\n]+to\,[\s\n]+penetration[\s\n]+testing\,[\s\n]+COMSEC[\s\n]+monitoring\,[\s\n]+network[\s\n]+operations[\s\n]+and[\s\n]+defense\,[\s\n]+personnel[\s\n]+misconduct[\s\n]+\(PM\)\,[\s\n]+law[\s\n]+enforcement[\s\n]+\(LE\)\,[\s\n]+and[\s\n]+counterintelligence[\s\n]+\(CI\)[\s\n]+investigations\.(?:[\n]+|(?:\\n)+)\-At[\s\n]+any[\s\n]+time\,[\s\n]+the[\s\n]+USG[\s\n]+may[\s\n]+inspect[\s\n]+and[\s\n]+seize[\s\n]+data[\s\n]+stored[\s\n]+on[\s\n]+this[\s\n]+IS\.(?:[\n]+|(?:\\n)+)\-Communications[\s\n]+using\,[\s\n]+or[\s\n]+data[\s\n]+stored[\s\n]+on\,[\s\n]+this[\s\n]+IS[\s\n]+are[\s\n]+not[\s\n]+private\,[\s\n]+are[\s\n]+subject[\s\n]+to[\s\n]+routine[\s\n]+monitoring\,[\s\n]+interception\,[\s\n]+and[\s\n]+search\,[\s\n]+and[\s\n]+may[\s\n]+be[\s\n]+disclosed[\s\n]+or[\s\n]+used[\s\n]+for[\s\n]+any[\s\n]+USG\-authorized[\s\n]+purpose\.(?:[\n]+|(?:\\n)+)\-This[\s\n]+IS[\s\n]+includes[\s\n]+security[\s\n]+measures[\s\n]+\(e\.g\.\,[\s\n]+authentication[\s\n]+and[\s\n]+access[\s\n]+controls\)[\s\n]+to[\s\n]+protect[\s\n]+USG[\s\n]+interests\-\-not[\s\n]+for[\s\n]+your[\s\n]+personal[\s\n]+benefit[\s\n]+or[\s\n]+privacy\.(?:[\n]+|(?:\\n)+)\-Notwithstanding[\s\n]+the[\s\n]+above\,[\s\n]+using[\s\n]+this[\s\n]+IS[\s\n]+does[\s\n]+not[\s\n]+constitute[\s\n]+consent[\s\n]+to[\s\n]+PM\,[\s\n]+LE[\s\n]+or[\s\n]+CI[\s\n]+investigative[\s\n]+searching[\s\n]+or[\s\n]+monitoring[\s\n]+of[\s\n]+the[\s\n]+content[\s\n]+of[\s\n]+privileged[\s\n]+communications\,[\s\n]+or[\s\n]+work[\s\n]+product\,[\s\n]+related[\s\n]+to[\s\n]+personal[\s\n]+representation[\s\n]+or[\s\n]+services[\s\n]+by[\s\n]+attorneys\,[\s\n]+psychotherapists\,[\s\n]+or[\s\n]+clergy\,[\s\n]+and[\s\n]+their[\s\n]+assistants\.[\s\n]+Such[\s\n]+communications[\s\n]+and[\s\n]+work[\s\n]+product[\s\n]+are[\s\n]+private[\s\n]+and[\s\n]+confidential\.[\s\n]+See[\s\n]+User[\s\n]+Agreement[\s\n]+for[\s\n]+details\.$</value>
          <value selector="dod_short">^I've[\s\n]+read[\s\n]+\&amp;[\s\n]+consent[\s\n]+to[\s\n]+terms[\s\n]+in[\s\n]+IS[\s\n]+user[\s\n]+agreem't\.$</value>
          <value selector="dss_odaa_default">^Use[\s\n]+of[\s\n]+this[\s\n]+or[\s\n]+any[\s\n]+other[\s\n]+DoD[\s\n]+interest[\s\n]+computer[\s\n]+system[\s\n]+constitutes[\s\n]+consent[\s\n]+to[\s\n]+monitoring[\s\n]+at[\s\n]+all[\s\n]+times\.[\s\n]+This[\s\n]+is[\s\n]+a[\s\n]+DoD[\s\n]+interest[\s\n]+computer[\s\n]+system\.[\s\n]+All[\s\n]+DoD[\s\n]+interest[\s\n]+computer[\s\n]+systems[\s\n]+and[\s\n]+related[\s\n]+equipment[\s\n]+are[\s\n]+intended[\s\n]+for[\s\n]+the[\s\n]+communication\,[\s\n]+transmission\,[\s\n]+processing\,[\s\n]+and[\s\n]+storage[\s\n]+of[\s\n]+official[\s\n]+U\.S\.[\s\n]+Government[\s\n]+or[\s\n]+other[\s\n]+authorized[\s\n]+information[\s\n]+only\.[\s\n]+All[\s\n]+DoD[\s\n]+interest[\s\n]+computer[\s\n]+systems[\s\n]+are[\s\n]+subject[\s\n]+to[\s\n]+monitoring[\s\n]+at[\s\n]+all[\s\n]+times[\s\n]+to[\s\n]+ensure[\s\n]+proper[\s\n]+functioning[\s\n]+of[\s\n]+equipment[\s\n]+and[\s\n]+systems[\s\n]+including[\s\n]+security[\s\n]+devices[\s\n]+and[\s\n]+systems\,[\s\n]+to[\s\n]+prevent[\s\n]+unauthorized[\s\n]+use[\s\n]+and[\s\n]+violations[\s\n]+of[\s\n]+statutes[\s\n]+and[\s\n]+security[\s\n]+regulations\,[\s\n]+to[\s\n]+deter[\s\n]+criminal[\s\n]+activity\,[\s\n]+and[\s\n]+for[\s\n]+other[\s\n]+similar[\s\n]+purposes\.[\s\n]+Any[\s\n]+user[\s\n]+of[\s\n]+a[\s\n]+DoD[\s\n]+interest[\s\n]+computer[\s\n]+system[\s\n]+should[\s\n]+be[\s\n]+aware[\s\n]+that[\s\n]+any[\s\n]+information[\s\n]+placed[\s\n]+in[\s\n]+the[\s\n]+system[\s\n]+is[\s\n]+subject[\s\n]+to[\s\n]+monitoring[\s\n]+and[\s\n]+is[\s\n]+not[\s\n]+subject[\s\n]+to[\s\n]+any[\s\n]+expectation[\s\n]+of[\s\n]+privacy\.[\s\n]+If[\s\n]+monitoring[\s\n]+of[\s\n]+this[\s\n]+or[\s\n]+any[\s\n]+other[\s\n]+DoD[\s\n]+interest[\s\n]+computer[\s\n]+system[\s\n]+reveals[\s\n]+possible[\s\n]+evidence[\s\n]+of[\s\n]+violation[\s\n]+of[\s\n]+criminal[\s\n]+statutes\,[\s\n]+this[\s\n]+evidence[\s\n]+and[\s\n]+any[\s\n]+other[\s\n]+related[\s\n]+information\,[\s\n]+including[\s\n]+identification[\s\n]+information[\s\n]+about[\s\n]+the[\s\n]+user\,[\s\n]+may[\s\n]+be[\s\n]+provided[\s\n]+to[\s\n]+law[\s\n]+enforcement[\s\n]+officials\.[\s\n]+If[\s\n]+monitoring[\s\n]+of[\s\n]+this[\s\n]+or[\s\n]+any[\s\n]+other[\s\n]+DoD[\s\n]+interest[\s\n]+computer[\s\n]+systems[\s\n]+reveals[\s\n]+violations[\s\n]+of[\s\n]+security[\s\n]+regulations[\s\n]+or[\s\n]+unauthorized[\s\n]+use\,[\s\n]+employees[\s\n]+who[\s\n]+violate[\s\n]+security[\s\n]+regulations[\s\n]+or[\s\n]+make[\s\n]+unauthorized[\s\n]+use[\s\n]+of[\s\n]+DoD[\s\n]+interest[\s\n]+computer[\s\n]+systems[\s\n]+are[\s\n]+subject[\s\n]+to[\s\n]+appropriate[\s\n]+disciplinary[\s\n]+action\.[\s\n]+Use[\s\n]+of[\s\n]+this[\s\n]+or[\s\n]+any[\s\n]+other[\s\n]+DoD[\s\n]+interest[\s\n]+computer[\s\n]+system[\s\n]+constitutes[\s\n]+consent[\s\n]+to[\s\n]+monitoring[\s\n]+at[\s\n]+all[\s\n]+times\.$</value>
          <value selector="usgcb_default">^\-\-[\s\n]+WARNING[\s\n]+\-\-[\s\n]+This[\s\n]+system[\s\n]+is[\s\n]+for[\s\n]+the[\s\n]+use[\s\n]+of[\s\n]+authorized[\s\n]+users[\s\n]+only\.[\s\n]+Individuals[\s\n]+using[\s\n]+this[\s\n]+computer[\s\n]+system[\s\n]+without[\s\n]+authority[\s\n]+or[\s\n]+in[\s\n]+excess[\s\n]+of[\s\n]+their[\s\n]+authority[\s\n]+are[\s\n]+subject[\s\n]+to[\s\n]+having[\s\n]+all[\s\n]+their[\s\n]+activities[\s\n]+on[\s\n]+this[\s\n]+system[\s\n]+monitored[\s\n]+and[\s\n]+recorded[\s\n]+by[\s\n]+system[\s\n]+personnel\.[\s\n]+Anyone[\s\n]+using[\s\n]+this[\s\n]+system[\s\n]+expressly[\s\n]+consents[\s\n]+to[\s\n]+such[\s\n]+monitoring[\s\n]+and[\s\n]+is[\s\n]+advised[\s\n]+that[\s\n]+if[\s\n]+such[\s\n]+monitoring[\s\n]+reveals[\s\n]+possible[\s\n]+evidence[\s\n]+of[\s\n]+criminal[\s\n]+activity[\s\n]+system[\s\n]+personal[\s\n]+may[\s\n]+provide[\s\n]+the[\s\n]+evidence[\s\n]+of[\s\n]+such[\s\n]+monitoring[\s\n]+to[\s\n]+law[\s\n]+enforcement[\s\n]+officials\.$</value>
        </Value>
        <Rule id="xccdf_org.ssgproject.content_rule_file_owner_etc_issue" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Verify ownership of System Login Banner</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">
To properly set the owner of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/issue</html:code>, run the command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo chown root /etc/issue </html:pre></description>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Display of a standardized and approved use notification before granting
access to the operating system ensures privacy and security notification
verbiage used is consistent with applicable federal laws, Executive Orders,
directives, policies, regulations, standards, and guidance.<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Proper ownership will ensure that only root user can modify the banner.</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_owner_etc_issue" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="configure">

chown 0 /etc/issue
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_owner_etc_issue" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: Test for existence /etc/issue
  stat:
    path: /etc/issue
  register: file_exists
  tags:
    - configure_strategy
    - file_owner_etc_issue
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Ensure owner 0 on /etc/issue
  file:
    path: /etc/issue
    owner: '0'
  when: file_exists.stat is defined and file_exists.stat.exists
  tags:
    - configure_strategy
    - file_owner_etc_issue
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-file_owner_etc_issue:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-file_owner_etc_issue_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_file_permissions_etc_motd" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Verify permissions on Message of the Day Banner</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">
To properly set the permissions of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/motd</html:code>, run the command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo chmod 0644 /etc/motd</html:pre></description>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Display of a standardized and approved use notification before granting
access to the operating system ensures privacy and security notification
verbiage used is consistent with applicable federal laws, Executive Orders,
directives, policies, regulations, standards, and guidance.<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Proper permissions will ensure that only root user can modify the banner.</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_permissions_etc_motd" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="configure">

chmod 0644 /etc/motd
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_permissions_etc_motd" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: Test for existence /etc/motd
  stat:
    path: /etc/motd
  register: file_exists
  tags:
    - configure_strategy
    - file_permissions_etc_motd
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Ensure permission 0644 on /etc/motd
  file:
    path: /etc/motd
    mode: '0644'
  when: file_exists.stat is defined and file_exists.stat.exists
  tags:
    - configure_strategy
    - file_permissions_etc_motd
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-file_permissions_etc_motd:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-file_permissions_etc_motd_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_file_permissions_etc_issue" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Verify permissions on System Login Banner</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">
To properly set the permissions of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/issue</html:code>, run the command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo chmod 0644 /etc/issue</html:pre></description>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Display of a standardized and approved use notification before granting
access to the operating system ensures privacy and security notification
verbiage used is consistent with applicable federal laws, Executive Orders,
directives, policies, regulations, standards, and guidance.<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Proper permissions will ensure that only root user can modify the banner.</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_permissions_etc_issue" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="configure">

chmod 0644 /etc/issue
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_permissions_etc_issue" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: Test for existence /etc/issue
  stat:
    path: /etc/issue
  register: file_exists
  tags:
    - configure_strategy
    - file_permissions_etc_issue
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Ensure permission 0644 on /etc/issue
  file:
    path: /etc/issue
    mode: '0644'
  when: file_exists.stat is defined and file_exists.stat.exists
  tags:
    - configure_strategy
    - file_permissions_etc_issue
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-file_permissions_etc_issue:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-file_permissions_etc_issue_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_file_groupowner_etc_issue" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Verify Group Ownership of System Login Banner</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">
To properly set the group owner of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/issue</html:code>, run the command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo chgrp root /etc/issue</html:pre></description>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Display of a standardized and approved use notification before granting
access to the operating system ensures privacy and security notification
verbiage used is consistent with applicable federal laws, Executive Orders,
directives, policies, regulations, standards, and guidance.<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Proper group ownership will ensure that only root user can modify the banner.</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_groupowner_etc_issue" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="configure">

chgrp 0 /etc/issue
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_groupowner_etc_issue" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: Test for existence /etc/issue
  stat:
    path: /etc/issue
  register: file_exists
  tags:
    - configure_strategy
    - file_groupowner_etc_issue
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Ensure group owner 0 on /etc/issue
  file:
    path: /etc/issue
    group: '0'
  when: file_exists.stat is defined and file_exists.stat.exists
  tags:
    - configure_strategy
    - file_groupowner_etc_issue
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-file_groupowner_etc_issue:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-file_groupowner_etc_issue_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_file_owner_etc_motd" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Verify ownership of Message of the Day Banner</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">
To properly set the owner of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/motd</html:code>, run the command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo chown root /etc/motd </html:pre></description>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Display of a standardized and approved use notification before granting
access to the operating system ensures privacy and security notification
verbiage used is consistent with applicable federal laws, Executive Orders,
directives, policies, regulations, standards, and guidance.<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Proper ownership will ensure that only root user can modify the banner.</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_owner_etc_motd" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="configure">

chown 0 /etc/motd
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_owner_etc_motd" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: Test for existence /etc/motd
  stat:
    path: /etc/motd
  register: file_exists
  tags:
    - configure_strategy
    - file_owner_etc_motd
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Ensure owner 0 on /etc/motd
  file:
    path: /etc/motd
    owner: '0'
  when: file_exists.stat is defined and file_exists.stat.exists
  tags:
    - configure_strategy
    - file_owner_etc_motd
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-file_owner_etc_motd:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-file_owner_etc_motd_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_file_groupowner_etc_motd" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Verify Group Ownership of Message of the Day Banner</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">
To properly set the group owner of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/motd</html:code>, run the command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo chgrp root /etc/motd</html:pre></description>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Display of a standardized and approved use notification before granting
access to the operating system ensures privacy and security notification
verbiage used is consistent with applicable federal laws, Executive Orders,
directives, policies, regulations, standards, and guidance.<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Proper group ownership will ensure that only root user can modify the banner.</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_groupowner_etc_motd" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="configure">

chgrp 0 /etc/motd
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_groupowner_etc_motd" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: Test for existence /etc/motd
  stat:
    path: /etc/motd
  register: file_exists
  tags:
    - configure_strategy
    - file_groupowner_etc_motd
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Ensure group owner 0 on /etc/motd
  file:
    path: /etc/motd
    group: '0'
  when: file_exists.stat is defined and file_exists.stat.exists
  tags:
    - configure_strategy
    - file_groupowner_etc_motd
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-file_groupowner_etc_motd:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-file_groupowner_etc_motd_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_banner_etc_issue" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Modify the System Login Banner</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To configure the system login banner edit <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/issue</html:code>. Replace the
default text with a message compliant with the local site policy or a legal
disclaimer.

The DoD required text is either:
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
<html:code xmlns:html="http://www.w3.org/1999/xhtml">You are accessing a U.S. Government (USG) Information System (IS) that
is provided for USG-authorized use only. By using this IS (which includes
any device attached to this IS), you consent to the following conditions:
<html:br/>-The USG routinely intercepts and monitors communications on this IS
for purposes including, but not limited to, penetration testing, COMSEC
monitoring, network operations and defense, personnel misconduct (PM), law
enforcement (LE), and counterintelligence (CI) investigations.
<html:br/>-At any time, the USG may inspect and seize data stored on this IS.
<html:br/>-Communications using, or data stored on, this IS are not private,
are subject to routine monitoring, interception, and search, and may be
disclosed or used for any USG-authorized purpose.
<html:br/>-This IS includes security measures (e.g., authentication and access
controls) to protect USG interests -- not for your personal benefit or
privacy.
<html:br/>-Notwithstanding the above, using this IS does not constitute consent
to PM, LE or CI investigative searching or monitoring of the content of
privileged communications, or work product, related to personal
representation or services by attorneys, psychotherapists, or clergy, and
their assistants. Such communications and work product are private and
confidential. See User Agreement for details.</html:code>
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
OR:
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
<html:code xmlns:html="http://www.w3.org/1999/xhtml">I've read &amp; consent to terms in IS user agreem't.</html:code></description>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.9</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-000048</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-000050</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-8(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-8(c)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</reference>
          <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_MOF_EXT.1</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000023-GPOS-00006</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000024-GPOS-00007</reference>
          <reference href="">SRG-OS-000023-VMM-000060</reference>
          <reference href="">SRG-OS-000024-VMM-000070</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.10</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.10</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.18.1.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.3.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.3</reference>
          <reference href="https://www.cisecurity.org/controls/">1</reference>
          <reference href="https://www.cisecurity.org/controls/">12</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">16</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Display of a standardized and approved use notification before granting
access to the operating system ensures privacy and security notification
verbiage used is consistent with applicable federal laws, Executive Orders,
directives, policies, regulations, standards, and guidance.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
System use notifications are required only for access via login interfaces
with human users and are not required when such human interfaces do not
exist.</rationale>
          <platform idref="cpe:/a:machine"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="banner_etc_issue" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then


login_banner_text="<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_login_banner_text" use="legacy"/>"



# Multiple regexes transform the banner regex into a usable banner
# 0 - Remove anchors around the banner text
login_banner_text=$(echo "$login_banner_text" | sed 's/^\^\(.*\)\$$/\1/g')
# 1 - Keep only the first banners if there are multiple
#    (dod_banners contains the long and short banner)
login_banner_text=$(echo "$login_banner_text" | sed 's/^(\(.*\)|.*)$/\1/g')
# 2 - Add spaces ' '. (Transforms regex for "space or newline" into a " ")
login_banner_text=$(echo "$login_banner_text" | sed 's/\[\\s\\n\]+/ /g')
# 3 - Adds newlines. (Transforms "(?:\[\\n\]+|(?:\\n)+)" into "\n")
login_banner_text=$(echo "$login_banner_text" | sed 's/(?:\[\\n\]+|(?:\\n)+)/\n/g')
# 4 - Remove any leftover backslash. (From any parethesis in the banner, for example).
login_banner_text=$(echo "$login_banner_text" | sed 's/\\//g')
formatted=$(echo "$login_banner_text" | fold -sw 80)

cat &lt;&lt;EOF &gt;/etc/issue
$formatted
EOF

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="banner_etc_issue" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="medium">- name: XCCDF Value login_banner_text # promote to variable
  set_fact:
    login_banner_text: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_login_banner_text" use="legacy"/>
  tags:
    - always

- name: Modify the System Login Banner - remove incorrect banner
  file:
    state: absent
    path: /etc/issue
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.9
    - NIST-800-53-AC-8(a)
    - NIST-800-53-AC-8(c)
    - banner_etc_issue
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Modify the System Login Banner - add correct banner
  lineinfile:
    dest: /etc/issue
    line: '{{ login_banner_text | regex_replace("^\^(.*)\$$", "\1") | regex_replace("^\((.*)\|.*\)$",
      "\1") | regex_replace("\[\\s\\n\]\+"," ") | regex_replace("\(\?:\[\\n\]\+\|\(\?:\\\\n\)\+\)",
      "\n") | regex_replace("\\", "") | wordwrap() }}'
    create: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.9
    - NIST-800-53-AC-8(a)
    - NIST-800-53-AC-8(c)
    - banner_etc_issue
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export export-name="oval:ssg-login_banner_text:var:1" value-id="xccdf_org.ssgproject.content_value_login_banner_text"/>
            <check-content-ref name="oval:ssg-banner_etc_issue:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-banner_etc_issue_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_banner_etc_motd" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Modify the System Message of the Day Banner</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To configure the system message banner edit <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/motd</html:code>. Replace the
default text with a message compliant with the local site policy or a legal
disclaimer.

The DoD required text is either:
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
<html:code xmlns:html="http://www.w3.org/1999/xhtml">You are accessing a U.S. Government (USG) Information System (IS) that
is provided for USG-authorized use only. By using this IS (which includes
any device attached to this IS), you consent to the following conditions:
<html:br/>-The USG routinely intercepts and monitors communications on this IS
for purposes including, but not limited to, penetration testing, COMSEC
monitoring, network operations and defense, personnel misconduct (PM), law
enforcement (LE), and counterintelligence (CI) investigations.
<html:br/>-At any time, the USG may inspect and seize data stored on this IS.
<html:br/>-Communications using, or data stored on, this IS are not private,
are subject to routine monitoring, interception, and search, and may be
disclosed or used for any USG-authorized purpose.
<html:br/>-This IS includes security measures (e.g., authentication and access
controls) to protect USG interests -- not for your personal benefit or
privacy.
<html:br/>-Notwithstanding the above, using this IS does not constitute consent
to PM, LE or CI investigative searching or monitoring of the content of
privileged communications, or work product, related to personal
representation or services by attorneys, psychotherapists, or clergy, and
their assistants. Such communications and work product are private and
confidential. See User Agreement for details.</html:code>
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
OR:
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
<html:code xmlns:html="http://www.w3.org/1999/xhtml">I've read &amp; consent to terms in IS user agreem't.</html:code></description>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Display of a standardized and approved use notification before granting
access to the operating system ensures privacy and security notification
verbiage used is consistent with applicable federal laws, Executive Orders,
directives, policies, regulations, standards, and guidance.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
System use notifications are required only for access via login interfaces
with human users and are not required when such human interfaces do not
exist.</rationale>
          <platform idref="cpe:/a:machine"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="banner_etc_motd" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then


login_banner_text="<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_login_banner_text" use="legacy"/>"



# Multiple regexes transform the banner regex into a usable banner
# 0 - Remove anchors around the banner text
login_banner_text=$(echo "$login_banner_text" | sed 's/^\^\(.*\)\$$/\1/g')
# 1 - Keep only the first banners if there are multiple
#    (dod_banners contains the long and short banner)
login_banner_text=$(echo "$login_banner_text" | sed 's/^(\(.*\)|.*)$/\1/g')
# 2 - Add spaces ' '. (Transforms regex for "space or newline" into a " ")
login_banner_text=$(echo "$login_banner_text" | sed 's/\[\\s\\n\]+/ /g')
# 3 - Adds newlines. (Transforms "(?:\[\\n\]+|(?:\\n)+)" into "\n")
login_banner_text=$(echo "$login_banner_text" | sed 's/(?:\[\\n\]+|(?:\\n)+)/\n/g')
# 4 - Remove any leftover backslash. (From any parethesis in the banner, for example).
login_banner_text=$(echo "$login_banner_text" | sed 's/\\//g')
formatted=$(echo "$login_banner_text" | fold -sw 80)

cat &lt;&lt;EOF &gt;/etc/motd
$formatted
EOF

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="banner_etc_motd" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="medium">- name: XCCDF Value login_banner_text # promote to variable
  set_fact:
    login_banner_text: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_login_banner_text" use="legacy"/>
  tags:
    - always

- name: Modify the System Message of the Day Banner - remove incorrect banner
  file:
    state: absent
    path: /etc/motd
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - banner_etc_motd
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Modify the System Message of the Day Banner - add correct banner
  lineinfile:
    dest: /etc/motd
    line: '{{ login_banner_text | regex_replace("^\^(.*)\$$", "\1") | regex_replace("^\((.*)\|.*\)$",
      "\1") | regex_replace("\[\\s\\n\]\+"," ") | regex_replace("\(\?:\[\\n\]\+\|\(\?:\\\\n\)\+\)",
      "\n") | regex_replace("\\", "") | wordwrap() }}'
    create: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - banner_etc_motd
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export export-name="oval:ssg-login_banner_text:var:1" value-id="xccdf_org.ssgproject.content_value_login_banner_text"/>
            <check-content-ref name="oval:ssg-banner_etc_motd:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-banner_etc_motd_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Group id="xccdf_org.ssgproject.content_group_gui_login_banner">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Implement a GUI Warning Banner</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">In the default graphical environment, users logging
directly into the system are greeted with a login screen provided
by the GNOME Display Manager (GDM). The warning banner should be
displayed in this graphical environment for these users.
The following sections describe how to configure the GDM login
banner.</description>
          <platform idref="cpe:/a:gdm"/>
          <Rule id="xccdf_org.ssgproject.content_rule_dconf_gnome_login_banner_text" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Set the GNOME3 Login Warning Banner Text</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">In the default graphical environment, configuring the login warning banner text
in the GNOME Display Manager's login screen can be configured on the login
screen by setting <html:code xmlns:html="http://www.w3.org/1999/xhtml">banner-message-text</html:code> to <html:code xmlns:html="http://www.w3.org/1999/xhtml">'<html:i>APPROVED_BANNER</html:i>'</html:code>
where <html:i xmlns:html="http://www.w3.org/1999/xhtml">APPROVED_BANNER</html:i> is the approved banner for your environment.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
To enable, add or edit <html:code xmlns:html="http://www.w3.org/1999/xhtml">banner-message-text</html:code> to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/dconf/db/gdm.d/00-security-settings</html:code>. For example:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">[org/gnome/login-screen]
banner-message-text='<html:i>APPROVED_BANNER</html:i>'</html:pre>
Once the setting has been added, add a lock to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/dconf/db/gdm.d/locks/00-security-settings-lock</html:code> to prevent user modification.
For example:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">/org/gnome/login-screen/banner-message-text</html:pre>
After the settings have been set, run <html:code xmlns:html="http://www.w3.org/1999/xhtml">dconf update</html:code>.
When entering a warning banner that spans several lines, remember
to begin and end the string with <html:code xmlns:html="http://www.w3.org/1999/xhtml">'</html:code> and use <html:code xmlns:html="http://www.w3.org/1999/xhtml">\n</html:code> for new lines.</description>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.9</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000048</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-8(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-8(c)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</reference>
            <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_MOF_EXT.1</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000023-GPOS-00006</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000024-GPOS-00007</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000228-GPOS-00088</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.10</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.10</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.18.1.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.2.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.3.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.3</reference>
            <reference href="https://www.cisecurity.org/controls/">1</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">An appropriate warning message reinforces policy awareness during the logon
process and facilitates possible legal action against attackers.</rationale>
            <platform idref="cpe:/a:gdm"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="dconf_gnome_login_banner_text" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q gdm; then


login_banner_text="<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_login_banner_text" use="legacy"/>"



# Multiple regexes transform the banner regex into a usable banner
# 0 - Remove anchors around the banner text
login_banner_text=$(echo "$login_banner_text" | sed 's/^\^\(.*\)\$$/\1/g')
# 1 - Keep only the first banners if there are multiple
#    (dod_banners contains the long and short banner)
login_banner_text=$(echo "$login_banner_text" | sed 's/^(\(.*\)|.*)$/\1/g')
# 2 - Add spaces ' '. (Transforms regex for "space or newline" into a " ")
login_banner_text=$(echo "$login_banner_text" | sed 's/\[\\s\\n\]+/ /g')
# 3 - Adds newline "tokens". (Transforms "(?:\[\\n\]+|(?:\\n)+)" into "(n)*")
login_banner_text=$(echo "$login_banner_text" | sed 's/(?:\[\\n\]+|(?:\\n)+)/(n)*/g')
# 4 - Remove any leftover backslash. (From any parethesis in the banner, for example).
login_banner_text=$(echo "$login_banner_text" | sed 's/\\//g')
# 5 - Removes the newline "token." (Transforms them into newline escape sequences "\n").
#    ( Needs to be done after 4, otherwise the escapce sequence will become just "n".
login_banner_text=$(echo "$login_banner_text" | sed 's/(n)\*/\\n/g')

# Check for setting in any of the DConf db directories
# If files contain ibus or distro, ignore them.
# The assignment assumes that individual filenames don't contain :
readarray -t SETTINGSFILES &lt; &lt;(grep -r "\\[org/gnome/login-screen\\]" "/etc/dconf/db/" | grep -v 'distro\|ibus' | cut -d":" -f1)
DCONFFILE="/etc/dconf/db/gdm.d/00-security-settings"
DBDIR="/etc/dconf/db/gdm.d"

mkdir -p "${DBDIR}"

if [ "${#SETTINGSFILES[@]}" -eq 0 ]
then
    [ ! -z ${DCONFFILE} ] || echo "" &gt;&gt; ${DCONFFILE}
    printf '%s\n' "[org/gnome/login-screen]" &gt;&gt; ${DCONFFILE}
    printf '%s=%s\n' "banner-message-text" "'${login_banner_text}'" &gt;&gt; ${DCONFFILE}
else
    escaped_value="$(sed -e 's/\\/\\\\/g' &lt;&lt;&lt; "'${login_banner_text}'")"
    if grep -q "^\\s*banner-message-text\\s*=" "${SETTINGSFILES[@]}"
    then
        sed -i "s/\\s*banner-message-text\\s*=\\s*.*/banner-message-text=${escaped_value}/g" "${SETTINGSFILES[@]}"
    else
        sed -i "\\|\\[org/gnome/login-screen\\]|a\\banner-message-text=${escaped_value}" "${SETTINGSFILES[@]}"
    fi
fi

dconf update
# Check for setting in any of the DConf db directories
LOCKFILES=$(grep -r "^/org/gnome/login-screen/banner-message-text$" "/etc/dconf/db/" | grep -v 'distro\|ibus' | cut -d":" -f1)
LOCKSFOLDER="/etc/dconf/db/gdm.d/locks"

mkdir -p "${LOCKSFOLDER}"

if [[ -z "${LOCKFILES}" ]]
then
    echo "/org/gnome/login-screen/banner-message-text" &gt;&gt; "/etc/dconf/db/gdm.d/locks/00-security-settings-lock"
fi

dconf update

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="dconf_gnome_login_banner_text" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="medium">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-171-3.1.9
    - NIST-800-53-AC-8(a)
    - NIST-800-53-AC-8(c)
    - dconf_gnome_login_banner_text
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy
- name: XCCDF Value login_banner_text # promote to variable
  set_fact:
    login_banner_text: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_login_banner_text" use="legacy"/>
  tags:
    - always

- name: Set the GNOME3 Login Warning Banner Text
  file:
    path: /etc/dconf/db/{{ item }}
    owner: root
    group: root
    mode: 493
    state: directory
  with_items:
    - gdm.d
    - gdm.d/locks
  when: '"gdm" in ansible_facts.packages'
  tags:
    - NIST-800-171-3.1.9
    - NIST-800-53-AC-8(a)
    - NIST-800-53-AC-8(c)
    - dconf_gnome_login_banner_text
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Set the GNOME3 Login Warning Banner Text
  file:
    path: /etc/dconf/db/gdm.d/{{ item }}
    owner: root
    group: root
    mode: 420
    state: touch
  with_items:
    - 00-security-settings
    - locks/00-security-settings-lock
  when: '"gdm" in ansible_facts.packages'
  tags:
    - NIST-800-171-3.1.9
    - NIST-800-53-AC-8(a)
    - NIST-800-53-AC-8(c)
    - dconf_gnome_login_banner_text
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Set the GNOME3 Login Warning Banner Text
  ini_file:
    dest: /etc/dconf/db/gdm.d/00-security-settings
    section: org/gnome/login-screen
    option: banner-message-text
    value: '''{{ login_banner_text | regex_replace("^\^(.*)\$$", "\1") | regex_replace("^\((.*)\|.*\)$",
      "\1") | regex_replace("\[\\s\\n\]\+"," ") | regex_replace("\(\?:\[\\n\]\+\|\(\?:\\\\n\)\+\)",
      "(n)*") | regex_replace("\\", "") | regex_replace("\(n\)\*", "\\n") }}'''
    create: true
    no_extra_spaces: true
  when: '"gdm" in ansible_facts.packages'
  tags:
    - NIST-800-171-3.1.9
    - NIST-800-53-AC-8(a)
    - NIST-800-53-AC-8(c)
    - dconf_gnome_login_banner_text
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Prevent user modification of the GNOME3 Login Warning Banner Text
  lineinfile:
    path: /etc/dconf/db/gdm.d/locks/00-security-settings-lock
    regexp: ^/org/gnome/login-screen/banner-message-text$
    line: /org/gnome/login-screen/banner-message-text
    create: true
    state: present
  when: '"gdm" in ansible_facts.packages'
  tags:
    - NIST-800-171-3.1.9
    - NIST-800-53-AC-8(a)
    - NIST-800-53-AC-8(c)
    - dconf_gnome_login_banner_text
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Dconf Update
  command: dconf update
  when: '"gdm" in ansible_facts.packages'
  tags:
    - NIST-800-171-3.1.9
    - NIST-800-53-AC-8(a)
    - NIST-800-53-AC-8(c)
    - dconf_gnome_login_banner_text
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-export export-name="oval:ssg-login_banner_text:var:1" value-id="xccdf_org.ssgproject.content_value_login_banner_text"/>
              <check-content-ref name="oval:ssg-dconf_gnome_login_banner_text:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-dconf_gnome_login_banner_text_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_dconf_gnome_banner_enabled" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Enable GNOME3 Login Warning Banner</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">In the default graphical environment, displaying a login warning banner
in the GNOME Display Manager's login screen can be enabled on the login
screen by setting <html:code xmlns:html="http://www.w3.org/1999/xhtml">banner-message-enable</html:code> to <html:code xmlns:html="http://www.w3.org/1999/xhtml">true</html:code>.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
To enable, add or edit <html:code xmlns:html="http://www.w3.org/1999/xhtml">banner-message-enable</html:code> to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/dconf/db/gdm.d/00-security-settings</html:code>. For example:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">[org/gnome/login-screen]
banner-message-enable=true</html:pre>
Once the setting has been added, add a lock to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/dconf/db/gdm.d/locks/00-security-settings-lock</html:code> to prevent user modification.
For example:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">/org/gnome/login-screen/banner-message-enable</html:pre>
After the settings have been set, run <html:code xmlns:html="http://www.w3.org/1999/xhtml">dconf update</html:code>.
The banner text must also be set.</description>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.9</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000048</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000050</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-001384</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-001385</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-001386</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-001387</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-001388</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-8(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-8(b)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-8(c)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</reference>
            <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_MOF_EXT.1</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000023-GPOS-00006</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000024-GPOS-00007</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000228-GPOS-00088</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.10</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.10</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.18.1.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.2.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.3.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.3</reference>
            <reference href="https://www.cisecurity.org/controls/">1</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Display of a standardized and approved use notification before granting access to the operating system
ensures privacy and security notification verbiage used is consistent with applicable federal laws,
Executive Orders, directives, policies, regulations, standards, and guidance.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
For U.S. Government systems, system use notifications are required only for access via login interfaces
with human users and are not required when such human interfaces do not exist.</rationale>
            <platform idref="cpe:/a:gdm"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="dconf_gnome_banner_enabled" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q gdm; then

# Check for setting in any of the DConf db directories
# If files contain ibus or distro, ignore them.
# The assignment assumes that individual filenames don't contain :
readarray -t SETTINGSFILES &lt; &lt;(grep -r "\\[org/gnome/login-screen\\]" "/etc/dconf/db/" | grep -v 'distro\|ibus' | cut -d":" -f1)
DCONFFILE="/etc/dconf/db/gdm.d/00-security-settings"
DBDIR="/etc/dconf/db/gdm.d"

mkdir -p "${DBDIR}"

if [ "${#SETTINGSFILES[@]}" -eq 0 ]
then
    [ ! -z ${DCONFFILE} ] || echo "" &gt;&gt; ${DCONFFILE}
    printf '%s\n' "[org/gnome/login-screen]" &gt;&gt; ${DCONFFILE}
    printf '%s=%s\n' "banner-message-enable" "true" &gt;&gt; ${DCONFFILE}
else
    escaped_value="$(sed -e 's/\\/\\\\/g' &lt;&lt;&lt; "true")"
    if grep -q "^\\s*banner-message-enable\\s*=" "${SETTINGSFILES[@]}"
    then
        sed -i "s/\\s*banner-message-enable\\s*=\\s*.*/banner-message-enable=${escaped_value}/g" "${SETTINGSFILES[@]}"
    else
        sed -i "\\|\\[org/gnome/login-screen\\]|a\\banner-message-enable=${escaped_value}" "${SETTINGSFILES[@]}"
    fi
fi

dconf update
# Check for setting in any of the DConf db directories
LOCKFILES=$(grep -r "^/org/gnome/login-screen/banner-message-enable$" "/etc/dconf/db/" | grep -v 'distro\|ibus' | cut -d":" -f1)
LOCKSFOLDER="/etc/dconf/db/gdm.d/locks"

mkdir -p "${LOCKSFOLDER}"

if [[ -z "${LOCKFILES}" ]]
then
    echo "/org/gnome/login-screen/banner-message-enable" &gt;&gt; "/etc/dconf/db/gdm.d/locks/00-security-settings-lock"
fi

dconf update

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="dconf_gnome_banner_enabled" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="medium">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-171-3.1.9
    - NIST-800-53-AC-8(a)
    - NIST-800-53-AC-8(b)
    - NIST-800-53-AC-8(c)
    - dconf_gnome_banner_enabled
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Enable GNOME3 Login Warning Banner
  ini_file:
    dest: /etc/dconf/db/gdm.d/00-security-settings
    section: org/gnome/login-screen
    option: banner-message-enable
    value: 'true'
    create: true
    no_extra_spaces: true
  when: '"gdm" in ansible_facts.packages'
  tags:
    - NIST-800-171-3.1.9
    - NIST-800-53-AC-8(a)
    - NIST-800-53-AC-8(b)
    - NIST-800-53-AC-8(c)
    - dconf_gnome_banner_enabled
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Prevent user modification of GNOME banner-message-enabled
  lineinfile:
    path: /etc/dconf/db/gdm.d/locks/00-security-settings-lock
    regexp: ^/org/gnome/login-screen/banner-message-enable
    line: /org/gnome/login-screen/banner-message-enable
    create: true
  when: '"gdm" in ansible_facts.packages'
  tags:
    - NIST-800-171-3.1.9
    - NIST-800-53-AC-8(a)
    - NIST-800-53-AC-8(b)
    - NIST-800-53-AC-8(c)
    - dconf_gnome_banner_enabled
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Dconf Update
  command: dconf update
  when: '"gdm" in ansible_facts.packages'
  tags:
    - NIST-800-171-3.1.9
    - NIST-800-53-AC-8(a)
    - NIST-800-53-AC-8(b)
    - NIST-800-53-AC-8(c)
    - dconf_gnome_banner_enabled
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-dconf_gnome_banner_enabled:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-dconf_gnome_banner_enabled_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
        </Group>
      </Group>
      <Group id="xccdf_org.ssgproject.content_group_accounts-pam">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Protect Accounts by Configuring PAM</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">PAM, or Pluggable Authentication Modules, is a system
which implements modular authentication for Linux programs. PAM provides
a flexible and configurable architecture for authentication, and it should be configured
to minimize exposure to unnecessary risk. This section contains
guidance on how to accomplish that.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
PAM is implemented as a set of shared objects which are
loaded and invoked whenever an application wishes to authenticate a
user. Typically, the application must be running as root in order
to take advantage of PAM, because PAM's modules often need to be able
to access sensitive stores of account information, such as /etc/shadow.
Traditional privileged network listeners
(e.g. sshd) or SUID programs (e.g. sudo) already meet this
requirement. An SUID root application, userhelper, is provided so
that programs which are not SUID or privileged themselves can still
take advantage of PAM.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
PAM looks in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/pam.d</html:code> for
application-specific configuration information. For instance, if
the program login attempts to authenticate a user, then PAM's
libraries follow the instructions in the file <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/pam.d/login</html:code>
to determine what actions should be taken.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
One very important file in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/pam.d</html:code> is
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/pam.d/system-auth</html:code>. This file, which is included by
many other PAM configuration files, defines 'default' system authentication
measures. Modifying this file is a good way to make far-reaching
authentication changes, for instance when implementing a
centralized authentication service.</description>
        <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="functionality">Be careful when making changes to PAM's configuration files.
The syntax for these files is complex, and modifications can
have unexpected consequences. The default configurations shipped
with applications should be sufficient for most users.</warning>
        <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="functionality">Running <html:code xmlns:html="http://www.w3.org/1999/xhtml">authconfig</html:code> or <html:code xmlns:html="http://www.w3.org/1999/xhtml">system-config-authentication</html:code>
will re-write the PAM configuration files, destroying any manually
made changes and replacing them with a series of system defaults.
One reference to the configuration file syntax can be found at

<html:a xmlns:html="http://www.w3.org/1999/xhtml" href="http://www.linux-pam.org/Linux-PAM-html/sag-configuration-file.html">http://www.linux-pam.org/Linux-PAM-html/sag-configuration-file.html</html:a>.</warning>
        <Value id="xccdf_org.ssgproject.content_value_var_password_hashing_algorithm" type="string">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Password Hashing algorithm</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Specify the system default encryption algorithm for encrypting passwords.
Defines the value set as ENCRYPT_METHOD in /etc/login.defs.</description>
          <value>SHA512</value>
          <value selector="SHA512">SHA512</value>
          <value selector="SHA256">SHA256</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_password_pam_unix_remember" type="number">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">remember</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The last n passwords for each user are saved in
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/security/opasswd</html:code> in order to force password change history and
keep the user from alternating between the same password too
frequently.</description>
          <value selector="0">0</value>
          <value selector="10">10</value>
          <value selector="24">24</value>
          <value selector="2">2</value>
          <value selector="4">4</value>
          <value selector="5">5</value>
          <value>5</value>
        </Value>
        <Rule id="xccdf_org.ssgproject.content_rule_enable_pam_namespace" selected="false" role="full" severity="low">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Set Up a Private Namespace in PAM Configuration</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To setup a private namespace add the following line to <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/pam.d/login</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">session    required     pam_namespace.so</html:pre></description>
          <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R39)</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The pam_namespace PAM module sets up a private namespace for a
session with polyinstantiated directories. A polyinstantiated directory
provides a different instance of itself based on user name, or when using
SELinux, user name, security context or both. The polyinstatied directories
can be used to dedicate separate temporary directories to each account.</rationale>
          <platform idref="cpe:/a:pam"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="enable_pam_namespace" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q pam; then

if ! grep -Eq '^\s*session\s+required\s+pam_namespace.so\s*$' '/etc/pam.d/login' ; then
    echo "session    required     pam_namespace.so" &gt;&gt; "/etc/pam.d/login"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="enable_pam_namespace" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - enable_pam_namespace
    - low_complexity
    - low_disruption
    - low_severity
    - no_reboot_needed
    - restrict_strategy

- name: Make changes to /etc/pam.d/login
  lineinfile:
    path: /etc/pam.d/login
    create: false
    regexp: ^\s*session\s+required\s+pam_namespace.so\s*$
    line: session    required     pam_namespace.so
    state: present
  when: '"pam" in ansible_facts.packages'
  tags:
    - enable_pam_namespace
    - low_complexity
    - low_disruption
    - low_severity
    - no_reboot_needed
    - restrict_strategy
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-enable_pam_namespace:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-enable_pam_namespace_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_display_login_attempts" selected="false" role="full" severity="low">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure PAM Displays Last Logon/Access Notification</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To configure the system to notify users of last logon/access
using <html:code xmlns:html="http://www.w3.org/1999/xhtml">pam_lastlog</html:code>, add or correct the <html:code xmlns:html="http://www.w3.org/1999/xhtml">pam_lastlog</html:code>
settings in

<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/pam.d/postlogin</html:code> to read as follows:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">session     [success=1 default=ignore] pam_succeed_if.so service !~ gdm* service !~ su* quiet
session     [default=1]   pam_lastlog.so nowtmp showfailed
session     optional      pam_lastlog.so silent noupdate showfailed</html:pre></description>
          <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.2</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-9(1)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</reference>
          <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.2.4</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.10</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.10</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.18.1.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.3.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.3</reference>
          <reference href="https://www.cisecurity.org/controls/">1</reference>
          <reference href="https://www.cisecurity.org/controls/">12</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">16</reference>
          <reference href="">0582</reference>
          <reference href="">0584</reference>
          <reference href="">05885</reference>
          <reference href="">0586</reference>
          <reference href="">0846</reference>
          <reference href="">0957</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Users need to be aware of activity that occurs regarding
their account. Providing users with information regarding the number
of unsuccessful attempts that were made to login to their account
allows the user to determine if any unauthorized activity has occurred
and gives them an opportunity to notify administrators.</rationale>
          <platform idref="cpe:/a:pam"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="display_login_attempts" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q pam; then

if grep -q "^session.*pam_lastlog.so" /etc/pam.d/postlogin; then
	sed -i --follow-symlinks "/pam_lastlog.so/d" /etc/pam.d/postlogin
fi

echo "session     [default=1]   pam_lastlog.so nowtmp showfailed" &gt;&gt; /etc/pam.d/postlogin
echo "session     optional      pam_lastlog.so silent noupdate showfailed" &gt;&gt; /etc/pam.d/postlogin

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-display_login_attempts:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-display_login_attempts_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Group id="xccdf_org.ssgproject.content_group_locking_out_password_attempts">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Set Lockouts for Failed Password Attempts</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">pam_faillock</html:code> PAM module provides the capability to
lock out user accounts after a number of failed login attempts. Its
documentation is available in
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/usr/share/doc/pam-VERSION/txts/README.pam_faillock</html:code>.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/></description>
          <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">Locking out user accounts presents the
risk of a denial-of-service attack. The lockout policy
must weigh whether the risk of such a
denial-of-service attack outweighs the benefits of thwarting
password guessing attacks.</warning>
          <Value id="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_deny" type="number">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">fail_deny</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Number of failed login attempts before account lockout</description>
            <value selector="10">10</value>
            <value selector="3">3</value>
            <value selector="5">5</value>
            <value selector="6">6</value>
            <value>3</value>
          </Value>
          <Value id="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_fail_interval" type="number">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">fail_interval</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Interval for counting failed login attempts before account lockout</description>
            <value selector="100000000">100000000</value>
            <value selector="1800">1800</value>
            <value selector="3600">3600</value>
            <value selector="86400">86400</value>
            <value selector="900">900</value>
            <value>900</value>
          </Value>
          <Value id="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_unlock_time" type="number">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">fail_unlock_time</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Seconds before automatic unlocking or permanently locking after excessive failed logins</description>
            <value selector="1800">1800</value>
            <value selector="3600">3600</value>
            <value selector="600">600</value>
            <value selector="604800">604800</value>
            <value selector="86400">86400</value>
            <value selector="900">900</value>
            <value>0</value>
            <value selector="never">0</value>
          </Value>
          <Value id="xccdf_org.ssgproject.content_value_var_password_pam_delay" type="number">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">faildelay_delay</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Delay next login attempt after a failed login</description>
            <value selector="0">0</value>
            <value selector="4000000">4000000</value>
            <value>4000000</value>
          </Value>
          <Value id="xccdf_org.ssgproject.content_value_var_password_pam_remember" type="number">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">pwhistory_remember</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Prevent password re-use using password history lookup</description>
            <value selector="0">0</value>
            <value selector="5">5</value>
            <value selector="6">6</value>
            <value selector="7">7</value>
            <value selector="8">8</value>
            <value selector="9">9</value>
            <value>5</value>
          </Value>
          <Rule id="xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_deny_root" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Configure the root Account for Failed Password Attempts</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To configure the system to lock out the <html:code xmlns:html="http://www.w3.org/1999/xhtml">root</html:code> account after a
number of incorrect login attempts using <html:code xmlns:html="http://www.w3.org/1999/xhtml">pam_faillock.so</html:code>, modify
the content of both <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/pam.d/system-auth</html:code> and
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/pam.d/password-auth</html:code> as follows:
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
<html:ul xmlns:html="http://www.w3.org/1999/xhtml" xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2"><html:li>Modify the following line in the <html:code>AUTH</html:code> section to add
<html:code>even_deny_root</html:code>:
<html:pre>auth required pam_faillock.so preauth silent <html:b>even_deny_root</html:b> deny=<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_deny" use="legacy"/> unlock_time=<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_unlock_time" use="legacy"/> fail_interval=<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_fail_interval" use="legacy"/></html:pre></html:li><html:li>Modify the following line in the <html:code>AUTH</html:code> section to add
<html:code>even_deny_root</html:code>:
<html:pre>auth [default=die] pam_faillock.so authfail <html:b>even_deny_root</html:b> deny=<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_deny" use="legacy"/> unlock_time=<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_unlock_time" use="legacy"/> fail_interval=<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_fail_interval" use="legacy"/></html:pre>
</html:li></html:ul></description>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-002238</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000044</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-7(b)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(c)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</reference>
            <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_MOF_EXT.1</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000329-GPOS-00128</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000021-GPOS-00005</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.10</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.10</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.18.1.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.2.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.3.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.3</reference>
            <reference href="https://www.cisecurity.org/controls/">1</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="">0421</reference>
            <reference href="">0422</reference>
            <reference href="">0431</reference>
            <reference href="">0974</reference>
            <reference href="">1173</reference>
            <reference href="">1401</reference>
            <reference href="">1504</reference>
            <reference href="">1505</reference>
            <reference href="">1546</reference>
            <reference href="">1557</reference>
            <reference href="">1558</reference>
            <reference href="">1559</reference>
            <reference href="">1560</reference>
            <reference href="">1561</reference>
            <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R18)</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">By limiting the number of failed logon attempts, the risk of unauthorized system access via user password
guessing, otherwise known as brute-forcing, is reduced. Limits are imposed by locking the account.</rationale>
            <platform idref="cpe:/a:pam"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="accounts_passwords_pam_faillock_deny_root" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q pam; then

AUTH_FILES[0]="/etc/pam.d/system-auth"
AUTH_FILES[1]="/etc/pam.d/password-auth"

# This script fixes absence of pam_faillock.so in PAM stack or the
# absense of even_deny_root in pam_faillock.so arguments
# When inserting auth pam_faillock.so entries,
# the entry with preauth argument will be added before pam_unix.so module
# and entry with authfail argument will be added before pam_deny.so module.

# The placement of pam_faillock.so entries will not be changed
# if they are already present

for pamFile in "${AUTH_FILES[@]}"
do
	# if PAM file is missing, system is not using PAM or broken
	if [ ! -f $pamFile ]; then
		continue
	fi

	# is 'auth required' here?
	if grep -q "^auth.*required.*pam_faillock.so.*" $pamFile; then
		# has 'auth required' even_deny_root option?
		if ! grep -q "^auth.*required.*pam_faillock.so.*preauth.*even_deny_root" $pamFile; then
			# even_deny_root is not present
			sed -i --follow-symlinks "s/\(^auth.*required.*pam_faillock.so.*preauth.*\).*/\1 even_deny_root/" $pamFile
		fi
	else
		# no 'auth required', add it
		sed -i --follow-symlinks "/^auth.*pam_unix.so.*/i auth required pam_faillock.so preauth silent even_deny_root" $pamFile
	fi

	# is 'auth [default=die]' here?
	if grep -q "^auth.*\[default=die\].*pam_faillock.so.*" $pamFile; then
		# has 'auth [default=die]' even_deny_root option?
		if ! grep -q "^auth.*\[default=die\].*pam_faillock.so.*authfail.*even_deny_root" $pamFile; then
			# even_deny_root is not present
			sed -i --follow-symlinks "s/\(^auth.*\[default=die\].*pam_faillock.so.*authfail.*\).*/\1 even_deny_root/" $pamFile
		fi
	else
		# no 'auth [default=die]', add it
		sed -i --follow-symlinks "/^auth.*pam_unix.so.*/a auth [default=die] pam_faillock.so authfail silent even_deny_root" $pamFile
	fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="accounts_passwords_pam_faillock_deny_root" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-53-AC-7(b)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(c)
    - accounts_passwords_pam_faillock_deny_root
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Add auth pam_faillock preauth even_deny_root before pam_unix.so
  pamd:
    name: '{{ item }}'
    type: auth
    control: sufficient
    module_path: pam_unix.so
    new_type: auth
    new_control: required
    new_module_path: pam_faillock.so
    module_arguments: preauth silent even_deny_root
    state: before
  loop:
    - system-auth
    - password-auth
  when: '"pam" in ansible_facts.packages'
  tags:
    - NIST-800-53-AC-7(b)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(c)
    - accounts_passwords_pam_faillock_deny_root
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Add even_deny_root argument to auth pam_faillock preauth
  pamd:
    name: '{{ item }}'
    type: auth
    control: required
    module_path: pam_faillock.so
    module_arguments: preauth silent even_deny_root
    state: args_present
  loop:
    - system-auth
    - password-auth
  when: '"pam" in ansible_facts.packages'
  tags:
    - NIST-800-53-AC-7(b)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(c)
    - accounts_passwords_pam_faillock_deny_root
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Add auth pam_faillock authfail even_deny_root after pam_unix.so
  pamd:
    name: '{{ item }}'
    type: auth
    control: sufficient
    module_path: pam_unix.so
    new_type: auth
    new_control: '[default=die]'
    new_module_path: pam_faillock.so
    module_arguments: authfail even_deny_root
    state: after
  loop:
    - system-auth
    - password-auth
  when: '"pam" in ansible_facts.packages'
  tags:
    - NIST-800-53-AC-7(b)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(c)
    - accounts_passwords_pam_faillock_deny_root
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Add even_deny_root argument to auth pam_faillock authfail
  pamd:
    name: '{{ item }}'
    type: auth
    control: '[default=die]'
    module_path: pam_faillock.so
    module_arguments: authfail even_deny_root
    state: args_present
  loop:
    - system-auth
    - password-auth
  when: '"pam" in ansible_facts.packages'
  tags:
    - NIST-800-53-AC-7(b)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(c)
    - accounts_passwords_pam_faillock_deny_root
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Add account pam_faillock before pam_unix.so
  pamd:
    name: '{{ item }}'
    type: account
    control: required
    module_path: pam_unix.so
    new_type: account
    new_control: required
    new_module_path: pam_faillock.so
    state: before
  loop:
    - system-auth
    - password-auth
  when: '"pam" in ansible_facts.packages'
  tags:
    - NIST-800-53-AC-7(b)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(c)
    - accounts_passwords_pam_faillock_deny_root
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-accounts_passwords_pam_faillock_deny_root:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-accounts_passwords_pam_faillock_deny_root_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_enforce_local" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Enforce pam_faillock for Local Accounts Only</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The pam_faillock module's <html:code xmlns:html="http://www.w3.org/1999/xhtml">local_users_only</html:code> parameter controls requirements for
enforcing failed lockout attempts only for local user accounts and ignoring
centralized user account management failed attempt configurations. Enable the <html:code xmlns:html="http://www.w3.org/1999/xhtml">local_users_only</html:code>
setting in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/security/faillock.conf</html:code> to require failed password attempts
for only local user accounts.</description>
            <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="management">Using this rule bypasses pam_faillock's functionality and should be used in cases
where centralized management such as LDAP or Active Directory is in use.</warning>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000015</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-2(1)</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000001-GPOS-00001</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The operating system must provide automated mechanisms for supporting account management
functions. Enterprise environments make application account management challenging and
complex. A manual process for account management functions adds the risk of a potential
oversight or other error.</rationale>
            <platform idref="cpe:/a:pam"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="accounts_passwords_pam_faillock_enforce_local" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="restrict"># Remediation is applicable only in certain platforms
if rpm --quiet -q pam; then

if [ -e "/etc/security/faillock.conf" ] ; then
    LC_ALL=C sed -i "/^\s*local_users_only/Id" "/etc/security/faillock.conf"
else
    touch "/etc/security/faillock.conf"
fi
cp "/etc/security/faillock.conf" "/etc/security/faillock.conf.bak"
# Insert at the end of the file
printf '%s\n' "local_users_only" &gt;&gt; "/etc/security/faillock.conf"
# Clean up after ourselves.
rm "/etc/security/faillock.conf.bak"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="accounts_passwords_pam_faillock_enforce_local" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-53-AC-2(1)
    - accounts_passwords_pam_faillock_enforce_local
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Enforce pam_faillock for Local Accounts Only
  lineinfile:
    path: /etc/security/faillock.conf
    create: true
    line: local_users_only
    state: present
  when: '"pam" in ansible_facts.packages'
  tags:
    - NIST-800-53-AC-2(1)
    - accounts_passwords_pam_faillock_enforce_local
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-accounts_passwords_pam_faillock_enforce_local:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-accounts_passwords_pam_faillock_enforce_local_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_interval" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Set Interval For Counting Failed Password Attempts</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Utilizing <html:code xmlns:html="http://www.w3.org/1999/xhtml">pam_faillock.so</html:code>, the <html:code xmlns:html="http://www.w3.org/1999/xhtml">fail_interval</html:code> directive
configures the system to lock out an account after a number of incorrect
login attempts within a specified time period. Modify the content of both
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/pam.d/system-auth</html:code> and <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/pam.d/password-auth</html:code>
as follows:
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
<html:ul xmlns:html="http://www.w3.org/1999/xhtml" xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2"><html:li>Add the following line immediately <html:code>before</html:code> the
    <html:code>pam_unix.so</html:code> statement in the <html:code>AUTH</html:code> section:
<html:pre>auth required pam_faillock.so preauth silent deny=<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_deny" use="legacy"/> unlock_time=<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_unlock_time" use="legacy"/> fail_interval=<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_fail_interval" use="legacy"/></html:pre>
</html:li><html:li>Add the following line immediately <html:code>after</html:code> the
    <html:code>pam_unix.so</html:code> statement in the <html:code>AUTH</html:code> section:
<html:pre>auth [default=die] pam_faillock.so authfail deny=<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_deny" use="legacy"/> unlock_time=<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_unlock_time" use="legacy"/> fail_interval=<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_fail_interval" use="legacy"/>
</html:pre>
</html:li><html:li>Add the following line immediately <html:code>before</html:code> the
    <html:code>pam_unix.so</html:code> statement in the <html:code>ACCOUNT</html:code> section:
<html:pre>account required pam_faillock.so</html:pre>
</html:li></html:ul></description>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000044</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-002236</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-002237</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-002238</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-7(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</reference>
            <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FIA_AFL.1</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000329-GPOS-00128</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000021-GPOS-00005</reference>
            <reference href="">SRG-OS-000021-VMM-000050</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.10</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.10</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.18.1.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.2.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.3.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.3</reference>
            <reference href="https://www.cisecurity.org/controls/">1</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="">0421</reference>
            <reference href="">0422</reference>
            <reference href="">0431</reference>
            <reference href="">0974</reference>
            <reference href="">1173</reference>
            <reference href="">1401</reference>
            <reference href="">1504</reference>
            <reference href="">1505</reference>
            <reference href="">1546</reference>
            <reference href="">1557</reference>
            <reference href="">1558</reference>
            <reference href="">1559</reference>
            <reference href="">1560</reference>
            <reference href="">1561</reference>
            <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R18)</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">By limiting the number of failed logon attempts the risk of unauthorized system
access via user password guessing, otherwise known as brute-forcing, is reduced.
Limits are imposed by locking the account.</rationale>
            <platform idref="cpe:/a:pam"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="accounts_passwords_pam_faillock_interval" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q pam; then

# include our remediation functions library

var_accounts_passwords_pam_faillock_fail_interval="<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_fail_interval" use="legacy"/>"



AUTH_FILES=("/etc/pam.d/system-auth" "/etc/pam.d/password-auth")

for pam_file in "${AUTH_FILES[@]}"
do
    # is auth required pam_faillock.so preauth present?
    if grep -qE '^\s*auth\s+required\s+pam_faillock\.so\s+preauth.*$' "$pam_file" ; then
        # is the option set?
        if grep -qE '^\s*auth\s+required\s+pam_faillock\.so\s+preauth.*'"fail_interval"'=([0-9]*).*$' "$pam_file" ; then
            # just change the value of option to a correct value
            sed -i --follow-symlinks 's/\(^auth.*required.*pam_faillock.so.*preauth.*silent.*\)\('"fail_interval"' *= *\).*/\1\2'"$var_accounts_passwords_pam_faillock_fail_interval"'/' "$pam_file"
        # the option is not set.
        else
            # append the option
            sed -i --follow-symlinks '/^auth.*required.*pam_faillock.so.*preauth.*silent.*/ s/$/ '"fail_interval"'='"$var_accounts_passwords_pam_faillock_fail_interval"'/' "$pam_file"
        fi
    # auth required pam_faillock.so preauth is not present, insert the whole line
    else
        sed -i --follow-symlinks '/^auth.*sufficient.*pam_unix.so.*/i auth        required      pam_faillock.so preauth silent '"fail_interval"'='"$var_accounts_passwords_pam_faillock_fail_interval" "$pam_file"
    fi
    # is auth default pam_faillock.so authfail present?
    if grep -qE '^\s*auth\s+(\[default=die\])\s+pam_faillock\.so\s+authfail.*$' "$pam_file" ; then
        # is the option set?
        if grep -qE '^\s*auth\s+(\[default=die\])\s+pam_faillock\.so\s+authfail.*'"fail_interval"'=([0-9]*).*$' "$pam_file" ; then
            # just change the value of option to a correct value
            sed -i --follow-symlinks 's/\(^auth.*[default=die].*pam_faillock.so.*authfail.*\)\('"fail_interval"' *= *\).*/\1\2'"$var_accounts_passwords_pam_faillock_fail_interval"'/' "$pam_file"
        # the option is not set.
        else
            # append the option
            sed -i --follow-symlinks '/^auth.*[default=die].*pam_faillock.so.*authfail.*/ s/$/ '"fail_interval"'='"$var_accounts_passwords_pam_faillock_fail_interval"'/' "$pam_file"
        fi
    # auth default pam_faillock.so authfail is not present, insert the whole line
    else
        sed -i --follow-symlinks '/^auth.*sufficient.*pam_unix.so.*/a auth        [default=die] pam_faillock.so authfail '"fail_interval"'='"$var_accounts_passwords_pam_faillock_fail_interval" "$pam_file"
    fi
    if ! grep -qE '^\s*account\s+required\s+pam_faillock\.so.*$' "$pam_file" ; then
        sed -E -i --follow-symlinks '/^\s*account\s*required\s*pam_unix.so/i account     required      pam_faillock.so' "$pam_file"
    fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="accounts_passwords_pam_faillock_interval" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-53-AC-7(a)
    - NIST-800-53-CM-6(a)
    - accounts_passwords_pam_faillock_interval
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
- name: XCCDF Value var_accounts_passwords_pam_faillock_fail_interval # promote to variable
  set_fact:
    var_accounts_passwords_pam_faillock_fail_interval: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_fail_interval" use="legacy"/>
  tags:
    - always

- name: Add auth pam_faillock preauth fail_interval before pam_unix.so
  pamd:
    name: '{{ item }}'
    type: auth
    control: sufficient
    module_path: pam_unix.so
    new_type: auth
    new_control: required
    new_module_path: pam_faillock.so
    module_arguments: preauth silent fail_interval={{ var_accounts_passwords_pam_faillock_fail_interval
      }}
    state: before
  loop:
    - system-auth
    - password-auth
  when: '"pam" in ansible_facts.packages'
  tags:
    - NIST-800-53-AC-7(a)
    - NIST-800-53-CM-6(a)
    - accounts_passwords_pam_faillock_interval
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Add fail_interval argument to auth pam_faillock preauth
  pamd:
    name: '{{ item }}'
    type: auth
    control: required
    module_path: pam_faillock.so
    module_arguments: preauth silent fail_interval={{ var_accounts_passwords_pam_faillock_fail_interval
      }}
    state: args_present
  loop:
    - system-auth
    - password-auth
  when: '"pam" in ansible_facts.packages'
  tags:
    - NIST-800-53-AC-7(a)
    - NIST-800-53-CM-6(a)
    - accounts_passwords_pam_faillock_interval
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Add auth pam_faillock aufthfail fail_interval after pam_unix.so
  pamd:
    name: '{{ item }}'
    type: auth
    control: sufficient
    module_path: pam_unix.so
    new_type: auth
    new_control: '[default=die]'
    new_module_path: pam_faillock.so
    module_arguments: authfail fail_interval={{ var_accounts_passwords_pam_faillock_fail_interval
      }}
    state: after
  loop:
    - system-auth
    - password-auth
  when: '"pam" in ansible_facts.packages'
  tags:
    - NIST-800-53-AC-7(a)
    - NIST-800-53-CM-6(a)
    - accounts_passwords_pam_faillock_interval
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Add fail_interval argument to auth pam_faillock authfail
  pamd:
    name: '{{ item }}'
    type: auth
    control: '[default=die]'
    module_path: pam_faillock.so
    module_arguments: authfail fail_interval={{ var_accounts_passwords_pam_faillock_fail_interval
      }}
    state: args_present
  loop:
    - system-auth
    - password-auth
  when: '"pam" in ansible_facts.packages'
  tags:
    - NIST-800-53-AC-7(a)
    - NIST-800-53-CM-6(a)
    - accounts_passwords_pam_faillock_interval
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Add account pam_faillock before pam_unix.so
  pamd:
    name: '{{ item }}'
    type: account
    control: required
    module_path: pam_unix.so
    new_type: account
    new_control: required
    new_module_path: pam_faillock.so
    state: before
  loop:
    - system-auth
    - password-auth
  when: '"pam" in ansible_facts.packages'
  tags:
    - NIST-800-53-AC-7(a)
    - NIST-800-53-CM-6(a)
    - accounts_passwords_pam_faillock_interval
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-export export-name="oval:ssg-var_accounts_passwords_pam_faillock_fail_interval:var:1" value-id="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_fail_interval"/>
              <check-content-ref name="oval:ssg-accounts_passwords_pam_faillock_interval:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-accounts_passwords_pam_faillock_interval_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_accounts_password_pam_unix_remember" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Limit Password Reuse</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Do not allow users to reuse recent passwords. This can be
accomplished by using the <html:code xmlns:html="http://www.w3.org/1999/xhtml">remember</html:code> option for the <html:code xmlns:html="http://www.w3.org/1999/xhtml">pam_unix</html:code>
or <html:code xmlns:html="http://www.w3.org/1999/xhtml">pam_pwhistory</html:code> PAM modules.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
In the file <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/pam.d/system-auth</html:code>, append <html:code xmlns:html="http://www.w3.org/1999/xhtml" xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2">remember=<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_password_pam_unix_remember" use="legacy"/></html:code>
to the line which refers to the <html:code xmlns:html="http://www.w3.org/1999/xhtml">pam_unix.so</html:code> or <html:code xmlns:html="http://www.w3.org/1999/xhtml">pam_pwhistory.so</html:code>module, as shown below:
<html:ul xmlns:html="http://www.w3.org/1999/xhtml" xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2"><html:li>for the <html:code>pam_unix.so</html:code> case:
<html:pre>password sufficient pam_unix.so <html:i>...existing_options...</html:i> remember=<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_password_pam_unix_remember" use="legacy"/></html:pre>
</html:li><html:li>for the <html:code>pam_pwhistory.so</html:code> case:
<html:pre>password requisite pam_pwhistory.so <html:i>...existing_options...</html:i> remember=<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_password_pam_unix_remember" use="legacy"/></html:pre>
</html:li></html:ul>
The DoD STIG requirement is 5 passwords.</description>
            <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.6.2.1.1</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.5.8</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000200</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(f)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(1)(e)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</reference>
            <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-8.2.5</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000077-GPOS-00045</reference>
            <reference href="">SRG-OS-000077-VMM-000440</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.2.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.10</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.10</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.18.1.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.7.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.2.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.2.6</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.3.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.3</reference>
            <reference href="https://www.cisecurity.org/controls/">1</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">5</reference>
            <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R18)</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Preventing re-use of previous passwords helps ensure that a compromised password is not re-used by a user.</rationale>
            <platform idref="cpe:/a:pam"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="accounts_password_pam_unix_remember" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q pam; then


var_password_pam_unix_remember="<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_password_pam_unix_remember" use="legacy"/>"



AUTH_FILES[0]="/etc/pam.d/system-auth"
AUTH_FILES[1]="/etc/pam.d/password-auth"

for pamFile in "${AUTH_FILES[@]}"
do
	if grep -q "remember=" $pamFile; then
		sed -i --follow-symlinks "s/\(^password.*sufficient.*pam_unix.so.*\)\(\(remember *= *\)[^ $]*\)/\1remember=$var_password_pam_unix_remember/" $pamFile
	else
		sed -i --follow-symlinks "/^password[[:space:]]\+sufficient[[:space:]]\+pam_unix.so/ s/$/ remember=$var_password_pam_unix_remember/" $pamFile
	fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="accounts_password_pam_unix_remember" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="medium" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - CJIS-5.6.2.1.1
    - NIST-800-171-3.5.8
    - NIST-800-53-IA-5(1)(e)
    - NIST-800-53-IA-5(f)
    - PCI-DSS-Req-8.2.5
    - accounts_password_pam_unix_remember
    - configure_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
- name: XCCDF Value var_password_pam_unix_remember # promote to variable
  set_fact:
    var_password_pam_unix_remember: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_password_pam_unix_remember" use="legacy"/>
  tags:
    - always

- name: Do not allow users to reuse recent passwords - system-auth (change)
  replace:
    dest: /etc/pam.d/system-auth
    regexp: ^(password\s+sufficient\s+pam_unix\.so\s.*remember\s*=\s*)(\S+)(.*)$
    replace: \g&lt;1&gt;{{ var_password_pam_unix_remember }}\g&lt;3&gt;
  when: '"pam" in ansible_facts.packages'
  tags:
    - CJIS-5.6.2.1.1
    - NIST-800-171-3.5.8
    - NIST-800-53-IA-5(1)(e)
    - NIST-800-53-IA-5(f)
    - PCI-DSS-Req-8.2.5
    - accounts_password_pam_unix_remember
    - configure_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed

- name: Do not allow users to reuse recent passwords - system-auth (add)
  replace:
    dest: /etc/pam.d/system-auth
    regexp: ^password\s+sufficient\s+pam_unix\.so\s(?!.*remember\s*=\s*).*$
    replace: \g&lt;0&gt; remember={{ var_password_pam_unix_remember }}
  when: '"pam" in ansible_facts.packages'
  tags:
    - CJIS-5.6.2.1.1
    - NIST-800-171-3.5.8
    - NIST-800-53-IA-5(1)(e)
    - NIST-800-53-IA-5(f)
    - PCI-DSS-Req-8.2.5
    - accounts_password_pam_unix_remember
    - configure_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-export export-name="oval:ssg-var_password_pam_unix_remember:var:1" value-id="xccdf_org.ssgproject.content_value_var_password_pam_unix_remember"/>
              <check-content-ref name="oval:ssg-accounts_password_pam_unix_remember:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-accounts_password_pam_unix_remember_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_unlock_time" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Set Lockout Time for Failed Password Attempts</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To configure the system to lock out accounts after a number of incorrect login
attempts and require an administrator to unlock the account using <html:code xmlns:html="http://www.w3.org/1999/xhtml">pam_faillock.so</html:code>,
modify the content of both <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/pam.d/system-auth</html:code> and <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/pam.d/password-auth</html:code> as follows:
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
<html:ul xmlns:html="http://www.w3.org/1999/xhtml" xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2"><html:li> add the following line immediately <html:code>before</html:code> the <html:code>pam_unix.so</html:code> statement in the <html:code>AUTH</html:code> section:
<html:pre>auth required pam_faillock.so preauth silent deny=<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_deny" use="legacy"/> unlock_time=<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_unlock_time" use="legacy"/> fail_interval=<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_fail_interval" use="legacy"/></html:pre></html:li><html:li> add the following line immediately <html:code>after</html:code> the <html:code>pam_unix.so</html:code> statement in the <html:code>AUTH</html:code> section:
<html:pre>auth [default=die] pam_faillock.so authfail deny=<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_deny" use="legacy"/> unlock_time=<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_unlock_time" use="legacy"/> fail_interval=<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_fail_interval" use="legacy"/></html:pre></html:li><html:li> add the following line immediately <html:code>before</html:code> the <html:code>pam_unix.so</html:code> statement in the <html:code>ACCOUNT</html:code> section:
<html:pre>account required pam_faillock.so</html:pre></html:li></html:ul>
If <html:code xmlns:html="http://www.w3.org/1999/xhtml">unlock_time</html:code> is set to <html:code xmlns:html="http://www.w3.org/1999/xhtml">0</html:code>, manual intervention by an administrator is required to unlock a user.</description>
            <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.3</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.8</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000044</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-002236</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-002237</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-002238</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-7(b)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</reference>
            <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FIA_AFL.1</reference>
            <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-8.1.7</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000329-GPOS-00128</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000021-GPOS-00005</reference>
            <reference href="">SRG-OS-000329-VMM-001180</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.10</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.10</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.18.1.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.2.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.3.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.3</reference>
            <reference href="https://www.cisecurity.org/controls/">1</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="">0421</reference>
            <reference href="">0422</reference>
            <reference href="">0431</reference>
            <reference href="">0974</reference>
            <reference href="">1173</reference>
            <reference href="">1401</reference>
            <reference href="">1504</reference>
            <reference href="">1505</reference>
            <reference href="">1546</reference>
            <reference href="">1557</reference>
            <reference href="">1558</reference>
            <reference href="">1559</reference>
            <reference href="">1560</reference>
            <reference href="">1561</reference>
            <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R18)</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Locking out user accounts after a number of incorrect attempts
prevents direct password guessing attacks. Ensuring that an administrator is
involved in unlocking locked accounts draws appropriate attention to such
situations.</rationale>
            <platform idref="cpe:/a:pam"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="accounts_passwords_pam_faillock_unlock_time" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q pam; then


var_accounts_passwords_pam_faillock_unlock_time="<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_unlock_time" use="legacy"/>"



AUTH_FILES=("/etc/pam.d/system-auth" "/etc/pam.d/password-auth")

for pam_file in "${AUTH_FILES[@]}"
do
    # is auth required pam_faillock.so preauth present?
    if grep -qE '^\s*auth\s+required\s+pam_faillock\.so\s+preauth.*$' "$pam_file" ; then
        # is the option set?
        if grep -qE '^\s*auth\s+required\s+pam_faillock\.so\s+preauth.*'"unlock_time"'=([0-9]*).*$' "$pam_file" ; then
            # just change the value of option to a correct value
            sed -i --follow-symlinks 's/\(^auth.*required.*pam_faillock.so.*preauth.*silent.*\)\('"unlock_time"' *= *\).*/\1\2'"$var_accounts_passwords_pam_faillock_unlock_time"'/' "$pam_file"
        # the option is not set.
        else
            # append the option
            sed -i --follow-symlinks '/^auth.*required.*pam_faillock.so.*preauth.*silent.*/ s/$/ '"unlock_time"'='"$var_accounts_passwords_pam_faillock_unlock_time"'/' "$pam_file"
        fi
    # auth required pam_faillock.so preauth is not present, insert the whole line
    else
        sed -i --follow-symlinks '/^auth.*sufficient.*pam_unix.so.*/i auth        required      pam_faillock.so preauth silent '"unlock_time"'='"$var_accounts_passwords_pam_faillock_unlock_time" "$pam_file"
    fi
    # is auth default pam_faillock.so authfail present?
    if grep -qE '^\s*auth\s+(\[default=die\])\s+pam_faillock\.so\s+authfail.*$' "$pam_file" ; then
        # is the option set?
        if grep -qE '^\s*auth\s+(\[default=die\])\s+pam_faillock\.so\s+authfail.*'"unlock_time"'=([0-9]*).*$' "$pam_file" ; then
            # just change the value of option to a correct value
            sed -i --follow-symlinks 's/\(^auth.*[default=die].*pam_faillock.so.*authfail.*\)\('"unlock_time"' *= *\).*/\1\2'"$var_accounts_passwords_pam_faillock_unlock_time"'/' "$pam_file"
        # the option is not set.
        else
            # append the option
            sed -i --follow-symlinks '/^auth.*[default=die].*pam_faillock.so.*authfail.*/ s/$/ '"unlock_time"'='"$var_accounts_passwords_pam_faillock_unlock_time"'/' "$pam_file"
        fi
    # auth default pam_faillock.so authfail is not present, insert the whole line
    else
        sed -i --follow-symlinks '/^auth.*sufficient.*pam_unix.so.*/a auth        [default=die] pam_faillock.so authfail '"unlock_time"'='"$var_accounts_passwords_pam_faillock_unlock_time" "$pam_file"
    fi
    if ! grep -qE '^\s*account\s+required\s+pam_faillock\.so.*$' "$pam_file" ; then
        sed -E -i --follow-symlinks '/^\s*account\s*required\s*pam_unix.so/i account     required      pam_faillock.so' "$pam_file"
    fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="accounts_passwords_pam_faillock_unlock_time" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - CJIS-5.5.3
    - NIST-800-171-3.1.8
    - NIST-800-53-AC-7(b)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.1.7
    - accounts_passwords_pam_faillock_unlock_time
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
- name: XCCDF Value var_accounts_passwords_pam_faillock_unlock_time # promote to variable
  set_fact:
    var_accounts_passwords_pam_faillock_unlock_time: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_unlock_time" use="legacy"/>
  tags:
    - always

- name: Add auth pam_faillock preauth unlock_time before pam_unix.so
  pamd:
    name: '{{ item }}'
    type: auth
    control: sufficient
    module_path: pam_unix.so
    new_type: auth
    new_control: required
    new_module_path: pam_faillock.so
    module_arguments: preauth silent unlock_time={{ var_accounts_passwords_pam_faillock_unlock_time
      }}
    state: before
  loop:
    - system-auth
    - password-auth
  when: '"pam" in ansible_facts.packages'
  tags:
    - CJIS-5.5.3
    - NIST-800-171-3.1.8
    - NIST-800-53-AC-7(b)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.1.7
    - accounts_passwords_pam_faillock_unlock_time
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Add unlock_time argument to pam_faillock preauth
  pamd:
    name: '{{ item }}'
    type: auth
    control: required
    module_path: pam_faillock.so
    module_arguments: preauth silent unlock_time={{ var_accounts_passwords_pam_faillock_unlock_time
      }}
    state: args_present
  loop:
    - system-auth
    - password-auth
  when: '"pam" in ansible_facts.packages'
  tags:
    - CJIS-5.5.3
    - NIST-800-171-3.1.8
    - NIST-800-53-AC-7(b)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.1.7
    - accounts_passwords_pam_faillock_unlock_time
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Add auth pam_faillock authfail unlock_interval after pam_unix.so
  pamd:
    name: '{{ item }}'
    type: auth
    control: sufficient
    module_path: pam_unix.so
    new_type: auth
    new_control: '[default=die]'
    new_module_path: pam_faillock.so
    module_arguments: authfail unlock_time={{ var_accounts_passwords_pam_faillock_unlock_time
      }}
    state: after
  loop:
    - system-auth
    - password-auth
  when: '"pam" in ansible_facts.packages'
  tags:
    - CJIS-5.5.3
    - NIST-800-171-3.1.8
    - NIST-800-53-AC-7(b)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.1.7
    - accounts_passwords_pam_faillock_unlock_time
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Add unlock_time argument to auth pam_faillock authfail
  pamd:
    name: '{{ item }}'
    type: auth
    control: '[default=die]'
    module_path: pam_faillock.so
    module_arguments: authfail unlock_time={{ var_accounts_passwords_pam_faillock_unlock_time
      }}
    state: args_present
  loop:
    - system-auth
    - password-auth
  when: '"pam" in ansible_facts.packages'
  tags:
    - CJIS-5.5.3
    - NIST-800-171-3.1.8
    - NIST-800-53-AC-7(b)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.1.7
    - accounts_passwords_pam_faillock_unlock_time
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Add account pam_faillock before pam_unix.so
  pamd:
    name: '{{ item }}'
    type: account
    control: required
    module_path: pam_unix.so
    new_type: account
    new_control: required
    new_module_path: pam_faillock.so
    state: before
  loop:
    - system-auth
    - password-auth
  when: '"pam" in ansible_facts.packages'
  tags:
    - CJIS-5.5.3
    - NIST-800-171-3.1.8
    - NIST-800-53-AC-7(b)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.1.7
    - accounts_passwords_pam_faillock_unlock_time
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-export export-name="oval:ssg-var_accounts_passwords_pam_faillock_unlock_time:var:1" value-id="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_unlock_time"/>
              <check-content-ref name="oval:ssg-accounts_passwords_pam_faillock_unlock_time:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-accounts_passwords_pam_faillock_unlock_time_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_deny" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Set Deny For Failed Password Attempts</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To configure the system to lock out accounts after a number of incorrect login
attempts using <html:code xmlns:html="http://www.w3.org/1999/xhtml">pam_faillock.so</html:code>, modify the content of both
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/pam.d/system-auth</html:code> and <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/pam.d/password-auth</html:code> as follows:
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
<html:ul xmlns:html="http://www.w3.org/1999/xhtml" xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2"><html:li> add the following line immediately <html:code>before</html:code> the <html:code>pam_unix.so</html:code> statement in the <html:code>AUTH</html:code> section:
<html:pre>auth required pam_faillock.so preauth silent deny=<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_deny" use="legacy"/> unlock_time=<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_unlock_time" use="legacy"/> fail_interval=<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_fail_interval" use="legacy"/></html:pre></html:li><html:li> add the following line immediately <html:code>after</html:code> the <html:code>pam_unix.so</html:code> statement in the <html:code>AUTH</html:code> section:
<html:pre>auth [default=die] pam_faillock.so authfail deny=<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_deny" use="legacy"/> unlock_time=<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_unlock_time" use="legacy"/> fail_interval=<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_fail_interval" use="legacy"/></html:pre></html:li><html:li> add the following line immediately <html:code>before</html:code> the <html:code>pam_unix.so</html:code> statement in the <html:code>ACCOUNT</html:code> section:
<html:pre>account required pam_faillock.so</html:pre></html:li></html:ul></description>
            <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.3</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.8</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000044</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-002236</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-002237</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-002238</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-7(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</reference>
            <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FIA_AFL.1</reference>
            <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-8.1.6</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000329-GPOS-00128</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000021-GPOS-00005</reference>
            <reference href="">SRG-OS-000021-VMM-000050</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.10</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.10</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.18.1.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.2.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.3.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.3</reference>
            <reference href="https://www.cisecurity.org/controls/">1</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="">0421</reference>
            <reference href="">0422</reference>
            <reference href="">0431</reference>
            <reference href="">0974</reference>
            <reference href="">1173</reference>
            <reference href="">1401</reference>
            <reference href="">1504</reference>
            <reference href="">1505</reference>
            <reference href="">1546</reference>
            <reference href="">1557</reference>
            <reference href="">1558</reference>
            <reference href="">1559</reference>
            <reference href="">1560</reference>
            <reference href="">1561</reference>
            <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R18)</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Locking out user accounts after a number of incorrect attempts
prevents direct password guessing attacks.</rationale>
            <platform idref="cpe:/a:pam"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="accounts_passwords_pam_faillock_deny" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q pam; then


var_accounts_passwords_pam_faillock_deny="<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_deny" use="legacy"/>"



AUTH_FILES=("/etc/pam.d/system-auth" "/etc/pam.d/password-auth")

for pam_file in "${AUTH_FILES[@]}"
do
    # is auth required pam_faillock.so preauth present?
    if grep -qE '^\s*auth\s+required\s+pam_faillock\.so\s+preauth.*$' "$pam_file" ; then
        # is the option set?
        if grep -qE '^\s*auth\s+required\s+pam_faillock\.so\s+preauth.*'"deny"'=([0-9]*).*$' "$pam_file" ; then
            # just change the value of option to a correct value
            sed -i --follow-symlinks 's/\(^auth.*required.*pam_faillock.so.*preauth.*silent.*\)\('"deny"' *= *\).*/\1\2'"$var_accounts_passwords_pam_faillock_deny"'/' "$pam_file"
        # the option is not set.
        else
            # append the option
            sed -i --follow-symlinks '/^auth.*required.*pam_faillock.so.*preauth.*silent.*/ s/$/ '"deny"'='"$var_accounts_passwords_pam_faillock_deny"'/' "$pam_file"
        fi
    # auth required pam_faillock.so preauth is not present, insert the whole line
    else
        sed -i --follow-symlinks '/^auth.*sufficient.*pam_unix.so.*/i auth        required      pam_faillock.so preauth silent '"deny"'='"$var_accounts_passwords_pam_faillock_deny" "$pam_file"
    fi
    # is auth default pam_faillock.so authfail present?
    if grep -qE '^\s*auth\s+(\[default=die\])\s+pam_faillock\.so\s+authfail.*$' "$pam_file" ; then
        # is the option set?
        if grep -qE '^\s*auth\s+(\[default=die\])\s+pam_faillock\.so\s+authfail.*'"deny"'=([0-9]*).*$' "$pam_file" ; then
            # just change the value of option to a correct value
            sed -i --follow-symlinks 's/\(^auth.*[default=die].*pam_faillock.so.*authfail.*\)\('"deny"' *= *\).*/\1\2'"$var_accounts_passwords_pam_faillock_deny"'/' "$pam_file"
        # the option is not set.
        else
            # append the option
            sed -i --follow-symlinks '/^auth.*[default=die].*pam_faillock.so.*authfail.*/ s/$/ '"deny"'='"$var_accounts_passwords_pam_faillock_deny"'/' "$pam_file"
        fi
    # auth default pam_faillock.so authfail is not present, insert the whole line
    else
        sed -i --follow-symlinks '/^auth.*sufficient.*pam_unix.so.*/a auth        [default=die] pam_faillock.so authfail '"deny"'='"$var_accounts_passwords_pam_faillock_deny" "$pam_file"
    fi
    if ! grep -qE '^\s*account\s+required\s+pam_faillock\.so.*$' "$pam_file" ; then
        sed -E -i --follow-symlinks '/^\s*account\s*required\s*pam_unix.so/i account     required      pam_faillock.so' "$pam_file"
    fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="accounts_passwords_pam_faillock_deny" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - CJIS-5.5.3
    - NIST-800-171-3.1.8
    - NIST-800-53-AC-7(a)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.1.6
    - accounts_passwords_pam_faillock_deny
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
- name: XCCDF Value var_accounts_passwords_pam_faillock_deny # promote to variable
  set_fact:
    var_accounts_passwords_pam_faillock_deny: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_deny" use="legacy"/>
  tags:
    - always

- name: Add auth pam_faillock preauth deny before pam_unix.so
  pamd:
    name: '{{ item }}'
    type: auth
    control: sufficient
    module_path: pam_unix.so
    new_type: auth
    new_control: required
    new_module_path: pam_faillock.so
    module_arguments: preauth silent deny={{ var_accounts_passwords_pam_faillock_deny
      }}
    state: before
  loop:
    - system-auth
    - password-auth
  when: '"pam" in ansible_facts.packages'
  tags:
    - CJIS-5.5.3
    - NIST-800-171-3.1.8
    - NIST-800-53-AC-7(a)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.1.6
    - accounts_passwords_pam_faillock_deny
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Add deny argument to auth pam_faillock preauth
  pamd:
    name: '{{ item }}'
    type: auth
    control: required
    module_path: pam_faillock.so
    module_arguments: preauth silent deny={{ var_accounts_passwords_pam_faillock_deny
      }}
    state: args_present
  loop:
    - system-auth
    - password-auth
  when: '"pam" in ansible_facts.packages'
  tags:
    - CJIS-5.5.3
    - NIST-800-171-3.1.8
    - NIST-800-53-AC-7(a)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.1.6
    - accounts_passwords_pam_faillock_deny
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Add auth pam_faillock authfail deny after pam_unix.so
  pamd:
    name: '{{ item }}'
    type: auth
    control: sufficient
    module_path: pam_unix.so
    new_type: auth
    new_control: '[default=die]'
    new_module_path: pam_faillock.so
    module_arguments: authfail deny={{ var_accounts_passwords_pam_faillock_deny }}
    state: after
  loop:
    - system-auth
    - password-auth
  when: '"pam" in ansible_facts.packages'
  tags:
    - CJIS-5.5.3
    - NIST-800-171-3.1.8
    - NIST-800-53-AC-7(a)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.1.6
    - accounts_passwords_pam_faillock_deny
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Add deny argument to auth pam_faillock authfail
  pamd:
    name: '{{ item }}'
    type: auth
    new_type: auth
    control: '[default=die]'
    module_path: pam_faillock.so
    module_arguments: authfail deny={{ var_accounts_passwords_pam_faillock_deny }}
    state: args_present
  loop:
    - system-auth
    - password-auth
  when: '"pam" in ansible_facts.packages'
  tags:
    - CJIS-5.5.3
    - NIST-800-171-3.1.8
    - NIST-800-53-AC-7(a)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.1.6
    - accounts_passwords_pam_faillock_deny
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Add account pam_faillock before pam_unix.so
  pamd:
    name: '{{ item }}'
    type: account
    control: required
    module_path: pam_unix.so
    new_type: account
    new_control: required
    new_module_path: pam_faillock.so
    state: before
  loop:
    - system-auth
    - password-auth
  when: '"pam" in ansible_facts.packages'
  tags:
    - CJIS-5.5.3
    - NIST-800-171-3.1.8
    - NIST-800-53-AC-7(a)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.1.6
    - accounts_passwords_pam_faillock_deny
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-export export-name="oval:ssg-var_accounts_passwords_pam_faillock_deny:var:1" value-id="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_deny"/>
              <check-content-ref name="oval:ssg-accounts_passwords_pam_faillock_deny:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-accounts_passwords_pam_faillock_deny_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
        </Group>
        <Group id="xccdf_org.ssgproject.content_group_password_quality">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Set Password Quality Requirements</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The default <html:code xmlns:html="http://www.w3.org/1999/xhtml">pam_pwquality</html:code> PAM module provides strength
checking for passwords. It performs a number of checks, such as
making sure passwords are not similar to dictionary words, are of
at least a certain length, are not the previous password reversed,
and are not simply a change of case from the previous password. It
can also require passwords to be in certain character classes. The
<html:code xmlns:html="http://www.w3.org/1999/xhtml">pam_pwquality</html:code> module is the preferred way of configuring
password requirements.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
The man pages <html:code xmlns:html="http://www.w3.org/1999/xhtml">pam_pwquality(8)</html:code>
provide information on the capabilities and configuration of
each.</description>
          <Group id="xccdf_org.ssgproject.content_group_password_quality_pwquality">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Set Password Quality Requirements with pam_pwquality</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">pam_pwquality</html:code> PAM module can be configured to meet
requirements for a variety of policies.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
For example, to configure <html:code xmlns:html="http://www.w3.org/1999/xhtml">pam_pwquality</html:code> to require at least one uppercase
character, lowercase character, digit, and other (special)
character, make sure that <html:code xmlns:html="http://www.w3.org/1999/xhtml">pam_pwquality</html:code> exists in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/pam.d/system-auth</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">password    requisite     pam_pwquality.so try_first_pass local_users_only retry=3 authtok_type=</html:pre>
If no such line exists, add one as the first line of the password section in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/pam.d/system-auth</html:code>.
Next, modify the settings in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/security/pwquality.conf</html:code> to match the following:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">difok = 4
minlen = 14
dcredit = -1
ucredit = -1
lcredit = -1
ocredit = -1
maxrepeat = 3</html:pre>
The arguments can be modified to ensure compliance with
your organization's security policy. Discussion of each parameter follows.</description>
            <Value id="xccdf_org.ssgproject.content_value_var_password_pam_dcredit" type="number">
              <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">dcredit</title>
              <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Minimum number of digits in password</description>
              <value selector="0">0</value>
              <value selector="1">-1</value>
              <value selector="2">-2</value>
              <value>-1</value>
            </Value>
            <Value id="xccdf_org.ssgproject.content_value_var_password_pam_difok" type="number">
              <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">difok</title>
              <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Minimum number of characters not present in old
password</description>
              <value selector="15">15</value>
              <value selector="1">1</value>
              <value selector="2">2</value>
              <value selector="3">3</value>
              <value selector="4">4</value>
              <value selector="5">5</value>
              <value selector="6">6</value>
              <value selector="7">7</value>
              <value selector="8">8</value>
              <value>8</value>
            </Value>
            <Value id="xccdf_org.ssgproject.content_value_var_password_pam_lcredit" type="number">
              <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">lcredit</title>
              <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Minimum number of lower case in password</description>
              <value selector="0">0</value>
              <value selector="1">-1</value>
              <value selector="2">-2</value>
              <value>-1</value>
            </Value>
            <Value id="xccdf_org.ssgproject.content_value_var_password_pam_maxclassrepeat" type="number">
              <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">maxclassrepeat</title>
              <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Maximum Number of Consecutive Repeating Characters in a Password From the Same Character Class</description>
              <value selector="1">1</value>
              <value selector="2">2</value>
              <value selector="3">3</value>
              <value selector="4">4</value>
              <value>4</value>
            </Value>
            <Value id="xccdf_org.ssgproject.content_value_var_password_pam_maxrepeat" type="number">
              <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">maxrepeat</title>
              <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Maximum Number of Consecutive Repeating Characters in a Password</description>
              <value selector="1">1</value>
              <value selector="2">2</value>
              <value selector="3">3</value>
              <value>3</value>
            </Value>
            <Value id="xccdf_org.ssgproject.content_value_var_password_pam_minclass" type="number">
              <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">minclass</title>
              <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Minimum number of categories of characters that must exist in a password</description>
              <value selector="1">1</value>
              <value selector="2">2</value>
              <value selector="3">3</value>
              <value selector="4">4</value>
              <value>3</value>
            </Value>
            <Value id="xccdf_org.ssgproject.content_value_var_password_pam_minlen" type="number">
              <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">minlen</title>
              <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Minimum number of characters in password</description>
              <value selector="10">10</value>
              <value selector="12">12</value>
              <value selector="14">14</value>
              <value selector="15">15</value>
              <value selector="18">18</value>
              <value selector="20">20</value>
              <value selector="6">6</value>
              <value selector="7">7</value>
              <value selector="8">8</value>
              <value>15</value>
            </Value>
            <Value id="xccdf_org.ssgproject.content_value_var_password_pam_ocredit" type="number">
              <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">ocredit</title>
              <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Minimum number of other (special characters) in
password</description>
              <value selector="0">0</value>
              <value selector="1">-1</value>
              <value selector="2">-2</value>
              <value>-1</value>
            </Value>
            <Value id="xccdf_org.ssgproject.content_value_var_password_pam_retry" type="number">
              <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">retry</title>
              <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Number of retry attempts before erroring out</description>
              <value selector="1">1</value>
              <value selector="2">2</value>
              <value selector="3">3</value>
              <value selector="4">4</value>
              <value selector="5">5</value>
              <value>3</value>
            </Value>
            <Value id="xccdf_org.ssgproject.content_value_var_password_pam_ucredit" type="number">
              <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">ucredit</title>
              <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Minimum number of upper case in password</description>
              <value selector="0">0</value>
              <value selector="1">-1</value>
              <value selector="2">-2</value>
              <value>-1</value>
            </Value>
            <Rule id="xccdf_org.ssgproject.content_rule_accounts_password_pam_difok" selected="false" role="full" severity="medium">
              <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure PAM Enforces Password Requirements - Minimum Different Characters</title>
              <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The pam_pwquality module's <html:code xmlns:html="http://www.w3.org/1999/xhtml">difok</html:code> parameter sets the number of characters
in a password that must not be present in and old password during a password change.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Modify the <html:code xmlns:html="http://www.w3.org/1999/xhtml">difok</html:code> setting in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/security/pwquality.conf</html:code>
to equal <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_password_pam_difok" use="legacy"/> to require differing characters
when changing passwords.</description>
              <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.6.2.1.1</reference>
              <reference href="https://public.cyber.mil/stigs/cci/">CCI-000195</reference>
              <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(c)</reference>
              <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(1)(b)</reference>
              <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
              <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(4)</reference>
              <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</reference>
              <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</reference>
              <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</reference>
              <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000072-GPOS-00040</reference>
              <reference href="">SRG-OS-000072-VMM-000390</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.2.2</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS05.10</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS06.03</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS06.10</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.18.1.4</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.7.1.1</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.9.2.1</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.9.2.2</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.9.2.3</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.9.2.4</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.9.2.6</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.9.3.1</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.9.4.2</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.9.4.3</reference>
              <reference href="https://www.cisecurity.org/controls/">1</reference>
              <reference href="https://www.cisecurity.org/controls/">12</reference>
              <reference href="https://www.cisecurity.org/controls/">15</reference>
              <reference href="https://www.cisecurity.org/controls/">16</reference>
              <reference href="https://www.cisecurity.org/controls/">5</reference>
              <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Use of a complex password helps to increase the time and resources
required to compromise the password. Password complexity, or strength,
is a measure of the effectiveness of a password in resisting attempts
at guessing and brute–force attacks.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Password complexity is one factor of several that determines how long
it takes to crack a password. The more complex the password, the
greater the number of possible combinations that need to be tested
before the password is compromised.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Requiring a minimum number of different characters during password changes ensures that
newly changed passwords should not resemble previously compromised ones.
Note that passwords which are changed on compromised systems will still be compromised, however.</rationale>
              <platform idref="cpe:/a:pam"/>
              <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="accounts_password_pam_difok" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="restrict"># Remediation is applicable only in certain platforms
if rpm --quiet -q pam; then


var_password_pam_difok="<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_password_pam_difok" use="legacy"/>"
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_replace_or_append" use="legacy"/>
replace_or_append '/etc/security/pwquality.conf' '^difok' $var_password_pam_difok '' '%s = %s'

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
              <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="accounts_password_pam_difok" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - CJIS-5.6.2.1.1
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(1)(b)
    - NIST-800-53-IA-5(4)
    - NIST-800-53-IA-5(c)
    - accounts_password_pam_difok
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
- name: XCCDF Value var_password_pam_difok # promote to variable
  set_fact:
    var_password_pam_difok: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_password_pam_difok" use="legacy"/>
  tags:
    - always

- name: Ensure PAM variable difok is set accordingly
  lineinfile:
    create: true
    dest: /etc/security/pwquality.conf
    regexp: ^#?\s*difok
    line: difok = {{ var_password_pam_difok }}
  when: '"pam" in ansible_facts.packages'
  tags:
    - CJIS-5.6.2.1.1
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(1)(b)
    - NIST-800-53-IA-5(4)
    - NIST-800-53-IA-5(c)
    - accounts_password_pam_difok
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</fix>
              <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <check-export export-name="oval:ssg-var_password_pam_difok:var:1" value-id="xccdf_org.ssgproject.content_value_var_password_pam_difok"/>
                <check-content-ref name="oval:ssg-accounts_password_pam_difok:def:1" href="ssg-fedora-oval.xml"/>
              </check>
              <check system="http://scap.nist.gov/schema/ocil/2">
                <check-content-ref name="ocil:ssg-accounts_password_pam_difok_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
              </check>
            </Rule>
            <Rule id="xccdf_org.ssgproject.content_rule_accounts_password_pam_retry" selected="false" role="full" severity="medium">
              <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure PAM Enforces Password Requirements - Authentication Retry Prompts Permitted Per-Session</title>
              <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To configure the number of retry prompts that are permitted per-session:
Edit the <html:code xmlns:html="http://www.w3.org/1999/xhtml">pam_pwquality.so</html:code> statement in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/pam.d/system-auth</html:code> to
show <html:code xmlns:html="http://www.w3.org/1999/xhtml" xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2">retry=<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_password_pam_retry" use="legacy"/></html:code>, or a lower value if
site policy is more restrictive.
The DoD requirement is a maximum of 3 prompts per session.</description>
              <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.3</reference>
              <reference href="https://public.cyber.mil/stigs/cci/">CCI-000192</reference>
              <reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</reference>
              <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
              <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-7(a)</reference>
              <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(4)</reference>
              <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</reference>
              <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</reference>
              <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</reference>
              <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
              <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_MOF_EXT.1</reference>
              <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00225</reference>
              <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000069-GPOS-00037</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.2.2</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.2</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.3</reference>
              <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
              <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
              <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
              <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS05.10</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS06.03</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS06.10</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.12.1.2</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.12.5.1</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.12.6.2</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.14.2.2</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.14.2.3</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.14.2.4</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.18.1.4</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.7.1.1</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.9.2.1</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.9.2.2</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.9.2.3</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.9.2.4</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.9.2.6</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.9.3.1</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.9.4.2</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.9.4.3</reference>
              <reference href="https://www.cisecurity.org/controls/">1</reference>
              <reference href="https://www.cisecurity.org/controls/">11</reference>
              <reference href="https://www.cisecurity.org/controls/">12</reference>
              <reference href="https://www.cisecurity.org/controls/">15</reference>
              <reference href="https://www.cisecurity.org/controls/">16</reference>
              <reference href="https://www.cisecurity.org/controls/">3</reference>
              <reference href="https://www.cisecurity.org/controls/">5</reference>
              <reference href="https://www.cisecurity.org/controls/">9</reference>
              <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Setting the password retry prompts that are permitted on a per-session basis to a low value
requires some software, such as SSH, to re-connect. This can slow down and
draw additional attention to some types of password-guessing attacks. Note that this
is different from account lockout, which is provided by the pam_faillock module.</rationale>
              <platform idref="cpe:/a:pam"/>
              <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="accounts_password_pam_retry" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q pam; then


var_password_pam_retry="<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_password_pam_retry" use="legacy"/>"



if grep -q "retry=" /etc/pam.d/system-auth ; then
	sed -i --follow-symlinks "s/\(retry *= *\).*/\1$var_password_pam_retry/" /etc/pam.d/system-auth
else
	sed -i --follow-symlinks "/pam_pwquality.so/ s/$/ retry=$var_password_pam_retry/" /etc/pam.d/system-auth
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
              <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="accounts_password_pam_retry" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="medium" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - CJIS-5.5.3
    - NIST-800-53-AC-7(a)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(4)
    - accounts_password_pam_retry
    - configure_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
- name: XCCDF Value var_password_pam_retry # promote to variable
  set_fact:
    var_password_pam_retry: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_password_pam_retry" use="legacy"/>
  tags:
    - always

- name: Set Password Retry Prompts Permitted Per-Session - system-auth (change)
  replace:
    dest: /etc/pam.d/system-auth
    regexp: (^.*\spam_pwquality.so\s.*retry\s*=\s*)(\S+)(.*$)
    replace: \g&lt;1&gt;{{ var_password_pam_retry }}\g&lt;3&gt;
  when: '"pam" in ansible_facts.packages'
  tags:
    - CJIS-5.5.3
    - NIST-800-53-AC-7(a)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(4)
    - accounts_password_pam_retry
    - configure_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed

- name: Set Password Retry Prompts Permitted Per-Session - system-auth (add)
  replace:
    dest: /etc/pam.d/system-auth
    regexp: ^.*\spam_pwquality.so\s(?!.*retry\s*=\s*).*$
    replace: \g&lt;0&gt; retry={{ var_password_pam_retry }}
  when: '"pam" in ansible_facts.packages'
  tags:
    - CJIS-5.5.3
    - NIST-800-53-AC-7(a)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(4)
    - accounts_password_pam_retry
    - configure_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
</fix>
              <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <check-export export-name="oval:ssg-var_password_pam_retry:var:1" value-id="xccdf_org.ssgproject.content_value_var_password_pam_retry"/>
                <check-content-ref name="oval:ssg-accounts_password_pam_retry:def:1" href="ssg-fedora-oval.xml"/>
              </check>
              <check system="http://scap.nist.gov/schema/ocil/2">
                <check-content-ref name="ocil:ssg-accounts_password_pam_retry_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
              </check>
            </Rule>
            <Rule id="xccdf_org.ssgproject.content_rule_accounts_password_pam_minlen" selected="false" role="full" severity="medium">
              <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure PAM Enforces Password Requirements - Minimum Length</title>
              <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The pam_pwquality module's <html:code xmlns:html="http://www.w3.org/1999/xhtml">minlen</html:code> parameter controls requirements for
minimum characters required in a password. Add <html:code xmlns:html="http://www.w3.org/1999/xhtml" xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2">minlen=<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_password_pam_minlen" use="legacy"/></html:code>
after pam_pwquality to set minimum password length requirements.</description>
              <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.6.2.1.1</reference>
              <reference href="https://public.cyber.mil/stigs/cci/">CCI-000205</reference>
              <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(c)</reference>
              <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(1)(a)</reference>
              <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
              <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(4)</reference>
              <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</reference>
              <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</reference>
              <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</reference>
              <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_MOF_EXT.1</reference>
              <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-8.2.3</reference>
              <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000078-GPOS-00046</reference>
              <reference href="">SRG-OS-000072-VMM-000390</reference>
              <reference href="">SRG-OS-000078-VMM-000450</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.2.2</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS05.10</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS06.03</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS06.10</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.18.1.4</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.7.1.1</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.9.2.1</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.9.2.2</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.9.2.3</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.9.2.4</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.9.2.6</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.9.3.1</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.9.4.2</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.9.4.3</reference>
              <reference href="https://www.cisecurity.org/controls/">1</reference>
              <reference href="https://www.cisecurity.org/controls/">12</reference>
              <reference href="https://www.cisecurity.org/controls/">15</reference>
              <reference href="https://www.cisecurity.org/controls/">16</reference>
              <reference href="https://www.cisecurity.org/controls/">5</reference>
              <reference href="">0421</reference>
              <reference href="">0422</reference>
              <reference href="">0431</reference>
              <reference href="">0974</reference>
              <reference href="">1173</reference>
              <reference href="">1401</reference>
              <reference href="">1504</reference>
              <reference href="">1505</reference>
              <reference href="">1546</reference>
              <reference href="">1557</reference>
              <reference href="">1558</reference>
              <reference href="">1559</reference>
              <reference href="">1560</reference>
              <reference href="">1561</reference>
              <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R18)</reference>
              <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The shorter the password, the lower the number of possible combinations
that need to be tested before the password is compromised.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Password complexity, or strength, is a measure of the effectiveness of a
password in resisting attempts at guessing and brute-force attacks.
Password length is one factor of several that helps to determine strength
and how long it takes to crack a password. Use of more characters in a password
helps to exponentially increase the time and/or resources required to
compromose the password.</rationale>
              <platform idref="cpe:/a:pam"/>
              <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="accounts_password_pam_minlen" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="restrict"># Remediation is applicable only in certain platforms
if rpm --quiet -q pam; then


var_password_pam_minlen="<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_password_pam_minlen" use="legacy"/>"
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_replace_or_append" use="legacy"/>
replace_or_append '/etc/security/pwquality.conf' '^minlen' $var_password_pam_minlen '' '%s = %s'

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
              <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="accounts_password_pam_minlen" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - CJIS-5.6.2.1.1
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(1)(a)
    - NIST-800-53-IA-5(4)
    - NIST-800-53-IA-5(c)
    - PCI-DSS-Req-8.2.3
    - accounts_password_pam_minlen
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
- name: XCCDF Value var_password_pam_minlen # promote to variable
  set_fact:
    var_password_pam_minlen: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_password_pam_minlen" use="legacy"/>
  tags:
    - always

- name: Ensure PAM variable minlen is set accordingly
  lineinfile:
    create: true
    dest: /etc/security/pwquality.conf
    regexp: ^#?\s*minlen
    line: minlen = {{ var_password_pam_minlen }}
  when: '"pam" in ansible_facts.packages'
  tags:
    - CJIS-5.6.2.1.1
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(1)(a)
    - NIST-800-53-IA-5(4)
    - NIST-800-53-IA-5(c)
    - PCI-DSS-Req-8.2.3
    - accounts_password_pam_minlen
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</fix>
              <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <check-export export-name="oval:ssg-var_password_pam_minlen:var:1" value-id="xccdf_org.ssgproject.content_value_var_password_pam_minlen"/>
                <check-content-ref name="oval:ssg-accounts_password_pam_minlen:def:1" href="ssg-fedora-oval.xml"/>
              </check>
              <check system="http://scap.nist.gov/schema/ocil/2">
                <check-content-ref name="ocil:ssg-accounts_password_pam_minlen_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
              </check>
            </Rule>
            <Rule id="xccdf_org.ssgproject.content_rule_accounts_password_pam_maxrepeat" selected="false" role="full" severity="medium">
              <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Set Password Maximum Consecutive Repeating Characters</title>
              <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The pam_pwquality module's <html:code xmlns:html="http://www.w3.org/1999/xhtml">maxrepeat</html:code> parameter controls requirements for
consecutive repeating characters. When set to a positive number, it will reject passwords
which contain more than that number of consecutive characters. Modify the <html:code xmlns:html="http://www.w3.org/1999/xhtml">maxrepeat</html:code> setting
in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/security/pwquality.conf</html:code> to equal <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_password_pam_maxrepeat" use="legacy"/> to prevent a
run of (<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_password_pam_maxrepeat" use="legacy"/> + 1) or more identical characters.</description>
              <reference href="https://public.cyber.mil/stigs/cci/">CCI-000195</reference>
              <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(c)</reference>
              <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
              <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(4)</reference>
              <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</reference>
              <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</reference>
              <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</reference>
              <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000072-GPOS-00040</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.2.2</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS05.10</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS06.03</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS06.10</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.18.1.4</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.7.1.1</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.9.2.1</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.9.2.2</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.9.2.3</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.9.2.4</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.9.2.6</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.9.3.1</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.9.4.2</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.9.4.3</reference>
              <reference href="https://www.cisecurity.org/controls/">1</reference>
              <reference href="https://www.cisecurity.org/controls/">12</reference>
              <reference href="https://www.cisecurity.org/controls/">15</reference>
              <reference href="https://www.cisecurity.org/controls/">16</reference>
              <reference href="https://www.cisecurity.org/controls/">5</reference>
              <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Use of a complex password helps to increase the time and resources required to compromise the password.
Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at
guessing and brute-force attacks.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Password complexity is one factor of several that determines how long it takes to crack a password. The more
complex the password, the greater the number of possible combinations that need to be tested before the
password is compromised.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Passwords with excessive repeating characters may be more vulnerable to password-guessing attacks.</rationale>
              <platform idref="cpe:/a:pam"/>
              <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="accounts_password_pam_maxrepeat" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="restrict"># Remediation is applicable only in certain platforms
if rpm --quiet -q pam; then


var_password_pam_maxrepeat="<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_password_pam_maxrepeat" use="legacy"/>"
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_replace_or_append" use="legacy"/>
replace_or_append '/etc/security/pwquality.conf' '^maxrepeat' $var_password_pam_maxrepeat '' '%s = %s'

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
              <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="accounts_password_pam_maxrepeat" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(4)
    - NIST-800-53-IA-5(c)
    - accounts_password_pam_maxrepeat
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
- name: XCCDF Value var_password_pam_maxrepeat # promote to variable
  set_fact:
    var_password_pam_maxrepeat: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_password_pam_maxrepeat" use="legacy"/>
  tags:
    - always

- name: Ensure PAM variable maxrepeat is set accordingly
  lineinfile:
    create: true
    dest: /etc/security/pwquality.conf
    regexp: ^#?\s*maxrepeat
    line: maxrepeat = {{ var_password_pam_maxrepeat }}
  when: '"pam" in ansible_facts.packages'
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(4)
    - NIST-800-53-IA-5(c)
    - accounts_password_pam_maxrepeat
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</fix>
              <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <check-export export-name="oval:ssg-var_password_pam_maxrepeat:var:1" value-id="xccdf_org.ssgproject.content_value_var_password_pam_maxrepeat"/>
                <check-content-ref name="oval:ssg-accounts_password_pam_maxrepeat:def:1" href="ssg-fedora-oval.xml"/>
              </check>
              <check system="http://scap.nist.gov/schema/ocil/2">
                <check-content-ref name="ocil:ssg-accounts_password_pam_maxrepeat_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
              </check>
            </Rule>
            <Rule id="xccdf_org.ssgproject.content_rule_accounts_password_pam_ucredit" selected="false" role="full" severity="medium">
              <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure PAM Enforces Password Requirements - Minimum Uppercase Characters</title>
              <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The pam_pwquality module's <html:code xmlns:html="http://www.w3.org/1999/xhtml">ucredit=</html:code> parameter controls requirements for
usage of uppercase letters in a password. When set to a negative number, any password will be required to
contain that many uppercase characters. When set to a positive number, pam_pwquality will grant +1 additional
length credit for each uppercase character. Modify the <html:code xmlns:html="http://www.w3.org/1999/xhtml">ucredit</html:code> setting in
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/security/pwquality.conf</html:code> to require the use of an uppercase character in passwords.</description>
              <reference href="https://public.cyber.mil/stigs/cci/">CCI-000192</reference>
              <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(c)</reference>
              <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(1)(a)</reference>
              <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
              <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(4)</reference>
              <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</reference>
              <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</reference>
              <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</reference>
              <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_MOF_EXT.1</reference>
              <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-8.2.3</reference>
              <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000069-GPOS-00037</reference>
              <reference href="">SRG-OS-000069-VMM-000360</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.2.2</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS05.10</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS06.03</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS06.10</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.18.1.4</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.7.1.1</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.9.2.1</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.9.2.2</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.9.2.3</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.9.2.4</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.9.2.6</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.9.3.1</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.9.4.2</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.9.4.3</reference>
              <reference href="https://www.cisecurity.org/controls/">1</reference>
              <reference href="https://www.cisecurity.org/controls/">12</reference>
              <reference href="https://www.cisecurity.org/controls/">15</reference>
              <reference href="https://www.cisecurity.org/controls/">16</reference>
              <reference href="https://www.cisecurity.org/controls/">5</reference>
              <reference href="">0421</reference>
              <reference href="">0422</reference>
              <reference href="">0431</reference>
              <reference href="">0974</reference>
              <reference href="">1173</reference>
              <reference href="">1401</reference>
              <reference href="">1504</reference>
              <reference href="">1505</reference>
              <reference href="">1546</reference>
              <reference href="">1557</reference>
              <reference href="">1558</reference>
              <reference href="">1559</reference>
              <reference href="">1560</reference>
              <reference href="">1561</reference>
              <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R18)</reference>
              <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Use of a complex password helps to increase the time and resources reuiqred to compromise the password.
Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts
at guessing and brute-force attacks.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Password complexity is one factor of several that determines how long it takes to crack a password. The more
complex the password, the greater the number of possible combinations that need to be tested before
the password is compromised.</rationale>
              <platform idref="cpe:/a:pam"/>
              <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="accounts_password_pam_ucredit" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="restrict"># Remediation is applicable only in certain platforms
if rpm --quiet -q pam; then


var_password_pam_ucredit="<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_password_pam_ucredit" use="legacy"/>"
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_replace_or_append" use="legacy"/>
replace_or_append '/etc/security/pwquality.conf' '^ucredit' $var_password_pam_ucredit '' '%s = %s'

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
              <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="accounts_password_pam_ucredit" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(1)(a)
    - NIST-800-53-IA-5(4)
    - NIST-800-53-IA-5(c)
    - PCI-DSS-Req-8.2.3
    - accounts_password_pam_ucredit
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
- name: XCCDF Value var_password_pam_ucredit # promote to variable
  set_fact:
    var_password_pam_ucredit: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_password_pam_ucredit" use="legacy"/>
  tags:
    - always

- name: Ensure PAM variable ucredit is set accordingly
  lineinfile:
    create: true
    dest: /etc/security/pwquality.conf
    regexp: ^#?\s*ucredit
    line: ucredit = {{ var_password_pam_ucredit }}
  when: '"pam" in ansible_facts.packages'
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(1)(a)
    - NIST-800-53-IA-5(4)
    - NIST-800-53-IA-5(c)
    - PCI-DSS-Req-8.2.3
    - accounts_password_pam_ucredit
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</fix>
              <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <check-export export-name="oval:ssg-var_password_pam_ucredit:var:1" value-id="xccdf_org.ssgproject.content_value_var_password_pam_ucredit"/>
                <check-content-ref name="oval:ssg-accounts_password_pam_ucredit:def:1" href="ssg-fedora-oval.xml"/>
              </check>
              <check system="http://scap.nist.gov/schema/ocil/2">
                <check-content-ref name="ocil:ssg-accounts_password_pam_ucredit_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
              </check>
            </Rule>
            <Rule id="xccdf_org.ssgproject.content_rule_accounts_password_pam_minclass" selected="false" role="full" severity="medium">
              <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure PAM Enforces Password Requirements - Minimum Different Categories</title>
              <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The pam_pwquality module's <html:code xmlns:html="http://www.w3.org/1999/xhtml">minclass</html:code> parameter controls
requirements for usage of different character classes, or types, of character
that must exist in a password before it is considered valid. For example,
setting this value to three (3) requires that any password must have characters
from at least three different categories in order to be approved. The default
value is zero (0), meaning there are no required classes. There are four
categories available:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">
* Upper-case characters
* Lower-case characters
* Digits
* Special characters (for example, punctuation)
</html:pre>
Modify the <html:code xmlns:html="http://www.w3.org/1999/xhtml">minclass</html:code> setting in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/security/pwquality.conf</html:code> entry
to require <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_password_pam_minclass" use="legacy"/>
differing categories of characters when changing passwords.</description>
              <reference href="https://public.cyber.mil/stigs/cci/">CCI-000195</reference>
              <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(c)</reference>
              <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(1)(a)</reference>
              <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
              <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(4)</reference>
              <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</reference>
              <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</reference>
              <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</reference>
              <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000072-GPOS-00040</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.2.2</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS05.10</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS06.03</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS06.10</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.18.1.4</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.7.1.1</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.9.2.1</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.9.2.2</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.9.2.3</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.9.2.4</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.9.2.6</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.9.3.1</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.9.4.2</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.9.4.3</reference>
              <reference href="https://www.cisecurity.org/controls/">1</reference>
              <reference href="https://www.cisecurity.org/controls/">12</reference>
              <reference href="https://www.cisecurity.org/controls/">15</reference>
              <reference href="https://www.cisecurity.org/controls/">16</reference>
              <reference href="https://www.cisecurity.org/controls/">5</reference>
              <reference href="">0421</reference>
              <reference href="">0422</reference>
              <reference href="">0431</reference>
              <reference href="">0974</reference>
              <reference href="">1173</reference>
              <reference href="">1401</reference>
              <reference href="">1504</reference>
              <reference href="">1505</reference>
              <reference href="">1546</reference>
              <reference href="">1557</reference>
              <reference href="">1558</reference>
              <reference href="">1559</reference>
              <reference href="">1560</reference>
              <reference href="">1561</reference>
              <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Use of a complex password helps to increase the time and resources required to compromise the password.
Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts
at guessing and brute-force attacks.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Password complexity is one factor of several that determines how long it takes to crack a password. The
more complex the password, the greater the number of possible combinations that need to be tested before
the password is compromised.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Requiring a minimum number of character categories makes password guessing attacks more difficult
by ensuring a larger search space.</rationale>
              <platform idref="cpe:/a:pam"/>
              <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="accounts_password_pam_minclass" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="restrict"># Remediation is applicable only in certain platforms
if rpm --quiet -q pam; then


var_password_pam_minclass="<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_password_pam_minclass" use="legacy"/>"
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_replace_or_append" use="legacy"/>
replace_or_append '/etc/security/pwquality.conf' '^minclass' $var_password_pam_minclass '' '%s = %s'

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
              <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="accounts_password_pam_minclass" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(1)(a)
    - NIST-800-53-IA-5(4)
    - NIST-800-53-IA-5(c)
    - accounts_password_pam_minclass
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
- name: XCCDF Value var_password_pam_minclass # promote to variable
  set_fact:
    var_password_pam_minclass: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_password_pam_minclass" use="legacy"/>
  tags:
    - always

- name: Ensure PAM variable minclass is set accordingly
  lineinfile:
    create: true
    dest: /etc/security/pwquality.conf
    regexp: ^#?\s*minclass
    line: minclass = {{ var_password_pam_minclass }}
  when: '"pam" in ansible_facts.packages'
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(1)(a)
    - NIST-800-53-IA-5(4)
    - NIST-800-53-IA-5(c)
    - accounts_password_pam_minclass
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</fix>
              <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <check-export export-name="oval:ssg-var_password_pam_minclass:var:1" value-id="xccdf_org.ssgproject.content_value_var_password_pam_minclass"/>
                <check-content-ref name="oval:ssg-accounts_password_pam_minclass:def:1" href="ssg-fedora-oval.xml"/>
              </check>
              <check system="http://scap.nist.gov/schema/ocil/2">
                <check-content-ref name="ocil:ssg-accounts_password_pam_minclass_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
              </check>
            </Rule>
            <Rule id="xccdf_org.ssgproject.content_rule_accounts_password_pam_dcredit" selected="false" role="full" severity="medium">
              <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure PAM Enforces Password Requirements - Minimum Digit Characters</title>
              <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The pam_pwquality module's <html:code xmlns:html="http://www.w3.org/1999/xhtml">dcredit</html:code> parameter controls requirements for
usage of digits in a password. When set to a negative number, any password will be required to
contain that many digits. When set to a positive number, pam_pwquality will grant +1 additional
length credit for each digit. Modify the <html:code xmlns:html="http://www.w3.org/1999/xhtml">dcredit</html:code> setting in
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/security/pwquality.conf</html:code> to require the use of a digit in passwords.</description>
              <reference href="https://public.cyber.mil/stigs/cci/">CCI-000194</reference>
              <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(c)</reference>
              <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(1)(a)</reference>
              <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
              <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(4)</reference>
              <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</reference>
              <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</reference>
              <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</reference>
              <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_MOF_EXT.1</reference>
              <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-8.2.3</reference>
              <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000071-GPOS-00039</reference>
              <reference href="">SRG-OS-000071-VMM-000380</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.2.2</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS05.10</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS06.03</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS06.10</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.18.1.4</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.7.1.1</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.9.2.1</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.9.2.2</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.9.2.3</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.9.2.4</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.9.2.6</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.9.3.1</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.9.4.2</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.9.4.3</reference>
              <reference href="https://www.cisecurity.org/controls/">1</reference>
              <reference href="https://www.cisecurity.org/controls/">12</reference>
              <reference href="https://www.cisecurity.org/controls/">15</reference>
              <reference href="https://www.cisecurity.org/controls/">16</reference>
              <reference href="https://www.cisecurity.org/controls/">5</reference>
              <reference href="">0421</reference>
              <reference href="">0422</reference>
              <reference href="">0431</reference>
              <reference href="">0974</reference>
              <reference href="">1173</reference>
              <reference href="">1401</reference>
              <reference href="">1504</reference>
              <reference href="">1505</reference>
              <reference href="">1546</reference>
              <reference href="">1557</reference>
              <reference href="">1558</reference>
              <reference href="">1559</reference>
              <reference href="">1560</reference>
              <reference href="">1561</reference>
              <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R18)</reference>
              <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Use of a complex password helps to increase the time and resources required
to compromise the password. Password complexity, or strength, is a measure of
the effectiveness of a password in resisting attempts at guessing and brute-force
attacks.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Password complexity is one factor of several that determines how long it takes
to crack a password. The more complex the password, the greater the number of
possible combinations that need to be tested before the password is compromised.
Requiring digits makes password guessing attacks more difficult by ensuring a larger
search space.</rationale>
              <platform idref="cpe:/a:pam"/>
              <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="accounts_password_pam_dcredit" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="restrict"># Remediation is applicable only in certain platforms
if rpm --quiet -q pam; then


var_password_pam_dcredit="<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_password_pam_dcredit" use="legacy"/>"
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_replace_or_append" use="legacy"/>
replace_or_append '/etc/security/pwquality.conf' '^dcredit' $var_password_pam_dcredit '' '%s = %s'

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
              <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="accounts_password_pam_dcredit" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(1)(a)
    - NIST-800-53-IA-5(4)
    - NIST-800-53-IA-5(c)
    - PCI-DSS-Req-8.2.3
    - accounts_password_pam_dcredit
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
- name: XCCDF Value var_password_pam_dcredit # promote to variable
  set_fact:
    var_password_pam_dcredit: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_password_pam_dcredit" use="legacy"/>
  tags:
    - always

- name: Ensure PAM variable dcredit is set accordingly
  lineinfile:
    create: true
    dest: /etc/security/pwquality.conf
    regexp: ^#?\s*dcredit
    line: dcredit = {{ var_password_pam_dcredit }}
  when: '"pam" in ansible_facts.packages'
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(1)(a)
    - NIST-800-53-IA-5(4)
    - NIST-800-53-IA-5(c)
    - PCI-DSS-Req-8.2.3
    - accounts_password_pam_dcredit
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</fix>
              <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <check-export export-name="oval:ssg-var_password_pam_dcredit:var:1" value-id="xccdf_org.ssgproject.content_value_var_password_pam_dcredit"/>
                <check-content-ref name="oval:ssg-accounts_password_pam_dcredit:def:1" href="ssg-fedora-oval.xml"/>
              </check>
              <check system="http://scap.nist.gov/schema/ocil/2">
                <check-content-ref name="ocil:ssg-accounts_password_pam_dcredit_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
              </check>
            </Rule>
            <Rule id="xccdf_org.ssgproject.content_rule_accounts_password_pam_maxclassrepeat" selected="false" role="full" severity="medium">
              <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure PAM Enforces Password Requirements - Maximum Consecutive Repeating Characters from Same Character Class</title>
              <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The pam_pwquality module's <html:code xmlns:html="http://www.w3.org/1999/xhtml">maxclassrepeat</html:code> parameter controls requirements for
consecutive repeating characters from the same character class. When set to a positive number, it will reject passwords
which contain more than that number of consecutive characters from the same character class. Modify the
<html:code xmlns:html="http://www.w3.org/1999/xhtml">maxclassrepeat</html:code> setting in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/security/pwquality.conf</html:code> to equal <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_password_pam_maxclassrepeat" use="legacy"/>
to prevent a run of (<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_password_pam_maxclassrepeat" use="legacy"/> + 1) or more identical characters.</description>
              <reference href="https://public.cyber.mil/stigs/cci/">CCI-000195</reference>
              <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(c)</reference>
              <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(1)(a)</reference>
              <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
              <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(4)</reference>
              <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</reference>
              <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</reference>
              <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</reference>
              <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000072-GPOS-00040</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.2.2</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS05.10</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS06.03</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS06.10</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.18.1.4</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.7.1.1</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.9.2.1</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.9.2.2</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.9.2.3</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.9.2.4</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.9.2.6</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.9.3.1</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.9.4.2</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.9.4.3</reference>
              <reference href="https://www.cisecurity.org/controls/">1</reference>
              <reference href="https://www.cisecurity.org/controls/">12</reference>
              <reference href="https://www.cisecurity.org/controls/">15</reference>
              <reference href="https://www.cisecurity.org/controls/">16</reference>
              <reference href="https://www.cisecurity.org/controls/">5</reference>
              <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Use of a complex password helps to increase the time and resources required to comrpomise the password.
Password complexity, or strength, is a measure of the effectiveness of a password in resisting
attempts at guessing and brute-force attacks.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Password complexity is one factor of several that determines how long it takes to crack a password. The
more complex a password, the greater the number of possible combinations that need to be tested before the
password is compromised.</rationale>
              <platform idref="cpe:/a:pam"/>
              <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="accounts_password_pam_maxclassrepeat" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="restrict"># Remediation is applicable only in certain platforms
if rpm --quiet -q pam; then


var_password_pam_maxclassrepeat="<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_password_pam_maxclassrepeat" use="legacy"/>"
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_replace_or_append" use="legacy"/>
replace_or_append '/etc/security/pwquality.conf' '^maxclassrepeat' $var_password_pam_maxclassrepeat '' '%s = %s'

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
              <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="accounts_password_pam_maxclassrepeat" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(1)(a)
    - NIST-800-53-IA-5(4)
    - NIST-800-53-IA-5(c)
    - accounts_password_pam_maxclassrepeat
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
- name: XCCDF Value var_password_pam_maxclassrepeat # promote to variable
  set_fact:
    var_password_pam_maxclassrepeat: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_password_pam_maxclassrepeat" use="legacy"/>
  tags:
    - always

- name: Ensure PAM variable maxclassrepeat is set accordingly
  lineinfile:
    create: true
    dest: /etc/security/pwquality.conf
    regexp: ^#?\s*maxclassrepeat
    line: maxclassrepeat = {{ var_password_pam_maxclassrepeat }}
  when: '"pam" in ansible_facts.packages'
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(1)(a)
    - NIST-800-53-IA-5(4)
    - NIST-800-53-IA-5(c)
    - accounts_password_pam_maxclassrepeat
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</fix>
              <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <check-export export-name="oval:ssg-var_password_pam_maxclassrepeat:var:1" value-id="xccdf_org.ssgproject.content_value_var_password_pam_maxclassrepeat"/>
                <check-content-ref name="oval:ssg-accounts_password_pam_maxclassrepeat:def:1" href="ssg-fedora-oval.xml"/>
              </check>
              <check system="http://scap.nist.gov/schema/ocil/2">
                <check-content-ref name="ocil:ssg-accounts_password_pam_maxclassrepeat_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
              </check>
            </Rule>
            <Rule id="xccdf_org.ssgproject.content_rule_accounts_password_pam_ocredit" selected="false" role="full" severity="medium">
              <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure PAM Enforces Password Requirements - Minimum Special Characters</title>
              <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The pam_pwquality module's <html:code xmlns:html="http://www.w3.org/1999/xhtml">ocredit=</html:code> parameter controls requirements for
usage of special (or "other") characters in a password. When set to a negative number,
any password will be required to contain that many special characters.
When set to a positive number, pam_pwquality will grant +1
additional length credit for each special character. Modify the <html:code xmlns:html="http://www.w3.org/1999/xhtml">ocredit</html:code> setting
in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/security/pwquality.conf</html:code> to equal <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_password_pam_ocredit" use="legacy"/>
to require use of a special character in passwords.</description>
              <reference href="https://public.cyber.mil/stigs/cci/">CCI-001619</reference>
              <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(c)</reference>
              <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(1)(a)</reference>
              <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
              <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(4)</reference>
              <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</reference>
              <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</reference>
              <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</reference>
              <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_MOF_EXT.1</reference>
              <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000266-GPOS-00101</reference>
              <reference href="">SRG-OS-000266-VMM-000940</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.2.2</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS05.10</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS06.03</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS06.10</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.18.1.4</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.7.1.1</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.9.2.1</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.9.2.2</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.9.2.3</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.9.2.4</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.9.2.6</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.9.3.1</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.9.4.2</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.9.4.3</reference>
              <reference href="https://www.cisecurity.org/controls/">1</reference>
              <reference href="https://www.cisecurity.org/controls/">12</reference>
              <reference href="https://www.cisecurity.org/controls/">15</reference>
              <reference href="https://www.cisecurity.org/controls/">16</reference>
              <reference href="https://www.cisecurity.org/controls/">5</reference>
              <reference href="">0421</reference>
              <reference href="">0422</reference>
              <reference href="">0431</reference>
              <reference href="">0974</reference>
              <reference href="">1173</reference>
              <reference href="">1401</reference>
              <reference href="">1504</reference>
              <reference href="">1505</reference>
              <reference href="">1546</reference>
              <reference href="">1557</reference>
              <reference href="">1558</reference>
              <reference href="">1559</reference>
              <reference href="">1560</reference>
              <reference href="">1561</reference>
              <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R18)</reference>
              <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Use of a complex password helps to increase the time and resources required
to compromise the password. Password complexity, or strength, is a measure of
the effectiveness of a password in resisting attempts at guessing and brute-force
attacks.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Password complexity is one factor of several that determines how long it takes
to crack a password. The more complex the password, the greater the number of
possble combinations that need to be tested before the password is compromised.
Requiring a minimum number of special characters makes password guessing attacks
more difficult by ensuring a larger search space.</rationale>
              <platform idref="cpe:/a:pam"/>
              <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="accounts_password_pam_ocredit" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="restrict"># Remediation is applicable only in certain platforms
if rpm --quiet -q pam; then


var_password_pam_ocredit="<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_password_pam_ocredit" use="legacy"/>"
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_replace_or_append" use="legacy"/>
replace_or_append '/etc/security/pwquality.conf' '^ocredit' $var_password_pam_ocredit '' '%s = %s'

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
              <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="accounts_password_pam_ocredit" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(1)(a)
    - NIST-800-53-IA-5(4)
    - NIST-800-53-IA-5(c)
    - accounts_password_pam_ocredit
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
- name: XCCDF Value var_password_pam_ocredit # promote to variable
  set_fact:
    var_password_pam_ocredit: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_password_pam_ocredit" use="legacy"/>
  tags:
    - always

- name: Ensure PAM variable ocredit is set accordingly
  lineinfile:
    create: true
    dest: /etc/security/pwquality.conf
    regexp: ^#?\s*ocredit
    line: ocredit = {{ var_password_pam_ocredit }}
  when: '"pam" in ansible_facts.packages'
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(1)(a)
    - NIST-800-53-IA-5(4)
    - NIST-800-53-IA-5(c)
    - accounts_password_pam_ocredit
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</fix>
              <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <check-export export-name="oval:ssg-var_password_pam_ocredit:var:1" value-id="xccdf_org.ssgproject.content_value_var_password_pam_ocredit"/>
                <check-content-ref name="oval:ssg-accounts_password_pam_ocredit:def:1" href="ssg-fedora-oval.xml"/>
              </check>
              <check system="http://scap.nist.gov/schema/ocil/2">
                <check-content-ref name="ocil:ssg-accounts_password_pam_ocredit_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
              </check>
            </Rule>
            <Rule id="xccdf_org.ssgproject.content_rule_accounts_password_pam_enforce_root" selected="false" role="full" severity="medium">
              <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure PAM Enforces Password Requirements - Enforce for root User</title>
              <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The pam_pwquality module's <html:code xmlns:html="http://www.w3.org/1999/xhtml">enforce_for_root</html:code> parameter controls requirements for
enforcing password complexity for the root user. Enable the <html:code xmlns:html="http://www.w3.org/1999/xhtml">enforce_for_root</html:code>
setting in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/security/pwquality.conf</html:code> to require the <html:code xmlns:html="http://www.w3.org/1999/xhtml">root</html:code> user
to use complex passwords.</description>
              <reference href="https://public.cyber.mil/stigs/cci/">CCI-000194</reference>
              <reference href="https://public.cyber.mil/stigs/cci/">CCI-000193</reference>
              <reference href="https://public.cyber.mil/stigs/cci/">CCI-001619</reference>
              <reference href="https://public.cyber.mil/stigs/cci/">CCI-000205</reference>
              <reference href="https://public.cyber.mil/stigs/cci/">CCI-000195</reference>
              <reference href="https://public.cyber.mil/stigs/cci/">CCI-000192</reference>
              <reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</reference>
              <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(c)</reference>
              <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(1)(a)</reference>
              <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
              <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(4)</reference>
              <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000072-GPOS-00040</reference>
              <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000071-GPOS-00039</reference>
              <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000070-GPOS-00038</reference>
              <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000266-GPOS-00101</reference>
              <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000078-GPOS-00046</reference>
              <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00225</reference>
              <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000069-GPOS-00037</reference>
              <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Use of a complex password helps to increase the time and resources required to compromise
the password. Password complexity, or strength, is a measure of the effectiveness of a
password in resisting attempts at guessing and brute-force attacks.

Password complexity is one factor of several that determines how long it takes to crack a
password. The more complex the password, the greater the number of possible combinations
that need to be tested before the password is compromised.</rationale>
              <platform idref="cpe:/a:pam"/>
              <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="accounts_password_pam_enforce_root" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="restrict"># Remediation is applicable only in certain platforms
if rpm --quiet -q pam; then

if [ -e "/etc/security/pwquality.conf" ] ; then
    LC_ALL=C sed -i "/^\s*enforce_for_root/Id" "/etc/security/pwquality.conf"
else
    touch "/etc/security/pwquality.conf"
fi
cp "/etc/security/pwquality.conf" "/etc/security/pwquality.conf.bak"
# Insert at the end of the file
printf '%s\n' "enforce_for_root" &gt;&gt; "/etc/security/pwquality.conf"
# Clean up after ourselves.
rm "/etc/security/pwquality.conf.bak"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
              <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="accounts_password_pam_enforce_root" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(1)(a)
    - NIST-800-53-IA-5(4)
    - NIST-800-53-IA-5(c)
    - accounts_password_pam_enforce_root
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Ensure PAM Enforces Password Requirements - Enforce for root User
  lineinfile:
    path: /etc/security/pwquality.conf
    create: true
    line: enforce_for_root
    state: present
  when: '"pam" in ansible_facts.packages'
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(1)(a)
    - NIST-800-53-IA-5(4)
    - NIST-800-53-IA-5(c)
    - accounts_password_pam_enforce_root
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</fix>
              <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <check-content-ref name="oval:ssg-accounts_password_pam_enforce_root:def:1" href="ssg-fedora-oval.xml"/>
              </check>
              <check system="http://scap.nist.gov/schema/ocil/2">
                <check-content-ref name="ocil:ssg-accounts_password_pam_enforce_root_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
              </check>
            </Rule>
            <Rule id="xccdf_org.ssgproject.content_rule_accounts_password_pam_enforce_local" selected="false" role="full" severity="medium">
              <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure PAM Enforces Password Requirements - Enforce for Local Accounts Only</title>
              <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The pam_pwquality module's <html:code xmlns:html="http://www.w3.org/1999/xhtml">local_users_only</html:code> parameter controls requirements for
enforcing password complexity by pam_pwquality only for local user accounts and ignoring
centralized user account management password complexity configurations. Enable the <html:code xmlns:html="http://www.w3.org/1999/xhtml">local_users_only</html:code>
setting in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/security/pwquality.conf</html:code> to require password complexity enforcement
for only local user accounts.</description>
              <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="management">Using this rule bypasses pam_faillock's functionality and should be used in cases
where centralized management such as LDAP or Active Directory is in use.</warning>
              <reference href="https://public.cyber.mil/stigs/cci/">CCI-000015</reference>
              <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-2(1)</reference>
              <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000001-GPOS-00001</reference>
              <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The operating system must provide automated mechanisms for supporting account management
functions. Enterprise environments make application account management challenging and
complex. A manual process for account management functions adds the risk of a potential
oversight or other error.</rationale>
              <platform idref="cpe:/a:pam"/>
              <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="accounts_password_pam_enforce_local" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="restrict"># Remediation is applicable only in certain platforms
if rpm --quiet -q pam; then

if [ -e "/etc/security/pwquality.conf" ] ; then
    LC_ALL=C sed -i "/^\s*local_users_only/Id" "/etc/security/pwquality.conf"
else
    touch "/etc/security/pwquality.conf"
fi
cp "/etc/security/pwquality.conf" "/etc/security/pwquality.conf.bak"
# Insert at the end of the file
printf '%s\n' "local_users_only" &gt;&gt; "/etc/security/pwquality.conf"
# Clean up after ourselves.
rm "/etc/security/pwquality.conf.bak"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
              <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="accounts_password_pam_enforce_local" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-53-AC-2(1)
    - accounts_password_pam_enforce_local
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Ensure PAM Enforces Password Requirements - Enforce for Local Accounts Only
  lineinfile:
    path: /etc/security/pwquality.conf
    create: true
    line: local_users_only
    state: present
  when: '"pam" in ansible_facts.packages'
  tags:
    - NIST-800-53-AC-2(1)
    - accounts_password_pam_enforce_local
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</fix>
              <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <check-content-ref name="oval:ssg-accounts_password_pam_enforce_local:def:1" href="ssg-fedora-oval.xml"/>
              </check>
              <check system="http://scap.nist.gov/schema/ocil/2">
                <check-content-ref name="ocil:ssg-accounts_password_pam_enforce_local_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
              </check>
            </Rule>
            <Rule id="xccdf_org.ssgproject.content_rule_accounts_password_pam_lcredit" selected="false" role="full" severity="medium">
              <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure PAM Enforces Password Requirements - Minimum Lowercase Characters</title>
              <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The pam_pwquality module's <html:code xmlns:html="http://www.w3.org/1999/xhtml">lcredit</html:code> parameter controls requirements for
usage of lowercase letters in a password. When set to a negative number, any password will be required to
contain that many lowercase characters. When set to a positive number, pam_pwquality will grant +1 additional
length credit for each lowercase character. Modify the <html:code xmlns:html="http://www.w3.org/1999/xhtml">lcredit</html:code> setting in
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/security/pwquality.conf</html:code> to require the use of a lowercase character in passwords.</description>
              <reference href="https://public.cyber.mil/stigs/cci/">CCI-000193</reference>
              <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(c)</reference>
              <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(1)(a)</reference>
              <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
              <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(4)</reference>
              <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</reference>
              <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</reference>
              <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</reference>
              <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_MOF_EXT.1</reference>
              <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-8.2.3</reference>
              <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000070-GPOS-00038</reference>
              <reference href="">SRG-OS-000070-VMM-000370</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.2.2</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS05.10</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS06.03</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS06.10</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.18.1.4</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.7.1.1</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.9.2.1</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.9.2.2</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.9.2.3</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.9.2.4</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.9.2.6</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.9.3.1</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.9.4.2</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.9.4.3</reference>
              <reference href="https://www.cisecurity.org/controls/">1</reference>
              <reference href="https://www.cisecurity.org/controls/">12</reference>
              <reference href="https://www.cisecurity.org/controls/">15</reference>
              <reference href="https://www.cisecurity.org/controls/">16</reference>
              <reference href="https://www.cisecurity.org/controls/">5</reference>
              <reference href="">0421</reference>
              <reference href="">0422</reference>
              <reference href="">0431</reference>
              <reference href="">0974</reference>
              <reference href="">1173</reference>
              <reference href="">1401</reference>
              <reference href="">1504</reference>
              <reference href="">1505</reference>
              <reference href="">1546</reference>
              <reference href="">1557</reference>
              <reference href="">1558</reference>
              <reference href="">1559</reference>
              <reference href="">1560</reference>
              <reference href="">1561</reference>
              <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R18)</reference>
              <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Use of a complex password helps to increase the time and resources required
to compromise the password. Password complexity, or strength, is a measure of
the effectiveness of a password in resisting attempts at guessing and brute-force
attacks.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Password complexity is one factor of several that determines how long it takes
to crack a password. The more complex the password, the greater the number of
possble combinations that need to be tested before the password is compromised.
Requiring a minimum number of lowercase characters makes password guessing attacks
more difficult by ensuring a larger search space.</rationale>
              <platform idref="cpe:/a:pam"/>
              <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="accounts_password_pam_lcredit" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="restrict"># Remediation is applicable only in certain platforms
if rpm --quiet -q pam; then


var_password_pam_lcredit="<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_password_pam_lcredit" use="legacy"/>"
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_replace_or_append" use="legacy"/>
replace_or_append '/etc/security/pwquality.conf' '^lcredit' $var_password_pam_lcredit '' '%s = %s'

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
              <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="accounts_password_pam_lcredit" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(1)(a)
    - NIST-800-53-IA-5(4)
    - NIST-800-53-IA-5(c)
    - PCI-DSS-Req-8.2.3
    - accounts_password_pam_lcredit
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
- name: XCCDF Value var_password_pam_lcredit # promote to variable
  set_fact:
    var_password_pam_lcredit: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_password_pam_lcredit" use="legacy"/>
  tags:
    - always

- name: Ensure PAM variable lcredit is set accordingly
  lineinfile:
    create: true
    dest: /etc/security/pwquality.conf
    regexp: ^#?\s*lcredit
    line: lcredit = {{ var_password_pam_lcredit }}
  when: '"pam" in ansible_facts.packages'
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(1)(a)
    - NIST-800-53-IA-5(4)
    - NIST-800-53-IA-5(c)
    - PCI-DSS-Req-8.2.3
    - accounts_password_pam_lcredit
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</fix>
              <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <check-export export-name="oval:ssg-var_password_pam_lcredit:var:1" value-id="xccdf_org.ssgproject.content_value_var_password_pam_lcredit"/>
                <check-content-ref name="oval:ssg-accounts_password_pam_lcredit:def:1" href="ssg-fedora-oval.xml"/>
              </check>
              <check system="http://scap.nist.gov/schema/ocil/2">
                <check-content-ref name="ocil:ssg-accounts_password_pam_lcredit_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
              </check>
            </Rule>
          </Group>
          <Group id="xccdf_org.ssgproject.content_group_password_quality_pamcracklib">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Set Password Quality Requirements, if using
pam_cracklib</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">pam_cracklib</html:code> PAM module can be configured to meet
requirements for a variety of policies.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
For example, to configure <html:code xmlns:html="http://www.w3.org/1999/xhtml">pam_cracklib</html:code> to require at least one uppercase
character, lowercase character, digit, and other (special)
character, locate the following line in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/pam.d/system-auth</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">password requisite pam_cracklib.so try_first_pass retry=3</html:pre>
and then alter it to read:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">password required pam_cracklib.so try_first_pass retry=3 maxrepeat=3 minlen=14 dcredit=-1 ucredit=-1 ocredit=-1 lcredit=-1 difok=4</html:pre>
If no such line exists, add one as the first line of the password section in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/pam.d/system-auth</html:code>.
The arguments can be modified to ensure compliance with
your organization's security policy. Discussion of each parameter follows.</description>
            <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">Note that the password quality requirements are not enforced for the
root account for some reason.</warning>
          </Group>
        </Group>
        <Group id="xccdf_org.ssgproject.content_group_set_password_hashing_algorithm">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Set Password Hashing Algorithm</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The system's default algorithm for storing password hashes in
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/shadow</html:code> is SHA-512. This can be configured in several
locations.</description>
          <Rule id="xccdf_org.ssgproject.content_rule_set_password_hashing_algorithm_logindefs" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Set Password Hashing Algorithm in /etc/login.defs</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">In <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/login.defs</html:code>, add or correct the following line to ensure
the system will use SHA-512 as the hashing algorithm:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">ENCRYPT_METHOD SHA512</html:pre></description>
            <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.6.2.2</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.13.11</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000196</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(c)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(1)(c)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</reference>
            <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-8.2.1</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000073-GPOS-00041</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.2.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.10</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.10</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.18.1.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.7.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.2.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.2.6</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.3.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.3</reference>
            <reference href="https://www.cisecurity.org/controls/">1</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">5</reference>
            <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R32)</reference>
            <reference href="">0418</reference>
            <reference href="">1055</reference>
            <reference href="">1402</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Passwords need to be protected at all times, and encryption is the standard method for protecting passwords.
If passwords are not encrypted, they can be plainly read (i.e., clear text) and easily compromised. Passwords
that are encrypted with a weak algorithm are no more protected than if they are kept in plain text.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Using a stronger hashing algorithm makes password cracking attacks more difficult.</rationale>
            <platform idref="cpe:/a:login_defs"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="set_password_hashing_algorithm_logindefs" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q login; then


var_password_hashing_algorithm="<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_password_hashing_algorithm" use="legacy"/>"



if grep --silent ^ENCRYPT_METHOD /etc/login.defs ; then
	sed -i "s/^ENCRYPT_METHOD .*/ENCRYPT_METHOD $var_password_hashing_algorithm/g" /etc/login.defs
else
	echo "" &gt;&gt; /etc/login.defs
	echo "ENCRYPT_METHOD $var_password_hashing_algorithm" &gt;&gt; /etc/login.defs
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="set_password_hashing_algorithm_logindefs" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - CJIS-5.6.2.2
    - NIST-800-171-3.13.11
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(1)(c)
    - NIST-800-53-IA-5(c)
    - PCI-DSS-Req-8.2.1
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - set_password_hashing_algorithm_logindefs
- name: XCCDF Value var_password_hashing_algorithm # promote to variable
  set_fact:
    var_password_hashing_algorithm: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_password_hashing_algorithm" use="legacy"/>
  tags:
    - always

- name: Set Password Hashing Algorithm in /etc/login.defs
  lineinfile:
    dest: /etc/login.defs
    regexp: ^#?ENCRYPT_METHOD
    line: ENCRYPT_METHOD {{ var_password_hashing_algorithm }}
    state: present
    create: true
  when: '"login" in ansible_facts.packages'
  tags:
    - CJIS-5.6.2.2
    - NIST-800-171-3.13.11
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(1)(c)
    - NIST-800-53-IA-5(c)
    - PCI-DSS-Req-8.2.1
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - set_password_hashing_algorithm_logindefs
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-export export-name="oval:ssg-var_password_hashing_algorithm:var:1" value-id="xccdf_org.ssgproject.content_value_var_password_hashing_algorithm"/>
              <check-content-ref name="oval:ssg-set_password_hashing_algorithm_logindefs:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-set_password_hashing_algorithm_logindefs_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_set_password_hashing_algorithm_systemauth" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Set PAM's Password Hashing Algorithm</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The PAM system service can be configured to only store encrypted
representations of passwords. In

<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/pam.d/system-auth</html:code>,

the
<html:code xmlns:html="http://www.w3.org/1999/xhtml">password</html:code> section of the file controls which PAM modules execute
during a password change. Set the <html:code xmlns:html="http://www.w3.org/1999/xhtml">pam_unix.so</html:code> module in the
<html:code xmlns:html="http://www.w3.org/1999/xhtml">password</html:code> section to include the argument <html:code xmlns:html="http://www.w3.org/1999/xhtml">sha512</html:code>, as shown
below:
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>

<html:pre xmlns:html="http://www.w3.org/1999/xhtml">password    sufficient    pam_unix.so sha512 <html:i>other arguments...</html:i></html:pre>

<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
This will help ensure when local users change their passwords, hashes for
the new passwords will be generated using the SHA-512 algorithm. This is
the default.</description>
            <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.6.2.2</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.13.11</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000196</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(c)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(1)(c)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</reference>
            <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-8.2.1</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000073-GPOS-00041</reference>
            <reference href="">SRG-OS-000480-VMM-002000</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.2.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.10</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.10</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.18.1.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.7.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.2.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.2.6</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.3.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.3</reference>
            <reference href="https://www.cisecurity.org/controls/">1</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">5</reference>
            <reference href="">0418</reference>
            <reference href="">1055</reference>
            <reference href="">1402</reference>
            <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R32)</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Passwords need to be protected at all times, and encryption is the standard
method for protecting passwords. If passwords are not encrypted, they can
be plainly read (i.e., clear text) and easily compromised. Passwords that
are encrypted with a weak algorithm are no more protected than if they are
kepy in plain text.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
This setting ensures user and group account administration utilities are
configured to store only encrypted representations of passwords.
Additionally, the <html:code xmlns:html="http://www.w3.org/1999/xhtml">crypt_style</html:code> configuration option ensures the use
of a strong hashing algorithm that makes password cracking attacks more
difficult.</rationale>
            <platform idref="cpe:/a:pam"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="set_password_hashing_algorithm_systemauth" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q pam; then

AUTH_FILES[0]="/etc/pam.d/system-auth"
AUTH_FILES[1]="/etc/pam.d/password-auth"

for pamFile in "${AUTH_FILES[@]}"
do
	if ! grep -q "^password.*sufficient.*pam_unix.so.*sha512" $pamFile; then
		sed -i --follow-symlinks "/^password.*sufficient.*pam_unix.so/ s/$/ sha512/" $pamFile
	fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-set_password_hashing_algorithm_systemauth:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-set_password_hashing_algorithm_systemauth_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_set_password_hashing_algorithm_libuserconf" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Set Password Hashing Algorithm in /etc/libuser.conf</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">In <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/libuser.conf</html:code>, add or correct the following line in its
<html:code xmlns:html="http://www.w3.org/1999/xhtml">[defaults]</html:code> section to ensure the system will use the SHA-512
algorithm for password hashing:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">crypt_style = sha512</html:pre></description>
            <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.6.2.2</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.13.11</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000196</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(c)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(1)(c)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</reference>
            <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-8.2.1</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000073-GPOS-00041</reference>
            <reference href="">SRG-OS-000480-VMM-002000</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.2.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.10</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.10</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.18.1.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.7.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.2.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.2.6</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.3.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.3</reference>
            <reference href="https://www.cisecurity.org/controls/">1</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">5</reference>
            <reference href="">0418</reference>
            <reference href="">1055</reference>
            <reference href="">1402</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Passwords need to be protected at all times, and encryption is the standard
method for protecting passwords. If passwords are not encrypted, they can
be plainly read (i.e., clear text) and easily compromised. Passwords that
are encrypted with a weak algorithm are no more protected than if they are
kepy in plain text.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
This setting ensures user and group account administration utilities are
configured to store only encrypted representations of passwords.
Additionally, the <html:code xmlns:html="http://www.w3.org/1999/xhtml">crypt_style</html:code> configuration option ensures the use
of a strong hashing algorithm that makes password cracking attacks more
difficult.</rationale>
            <platform idref="cpe:/a:libuser"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="set_password_hashing_algorithm_libuserconf" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q libuser; then

LIBUSER_CONF="/etc/libuser.conf"
CRYPT_STYLE_REGEX='[[:space:]]*\[defaults](.*(\n)+)+?[[:space:]]*crypt_style[[:space:]]*'

# Try find crypt_style in [defaults] section. If it is here, then change algorithm to sha512.
# If it isn't here, then add it to [defaults] section.
if grep -qzosP $CRYPT_STYLE_REGEX $LIBUSER_CONF ; then
        sed -i "s/\(crypt_style[[:space:]]*=[[:space:]]*\).*/\1sha512/g" $LIBUSER_CONF
elif grep -qs "\[defaults]" $LIBUSER_CONF ; then
        sed -i "/[[:space:]]*\[defaults]/a crypt_style = sha512" $LIBUSER_CONF
else
        echo -e "[defaults]\ncrypt_style = sha512" &gt;&gt; $LIBUSER_CONF
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="set_password_hashing_algorithm_libuserconf" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - CJIS-5.6.2.2
    - NIST-800-171-3.13.11
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(1)(c)
    - NIST-800-53-IA-5(c)
    - PCI-DSS-Req-8.2.1
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - set_password_hashing_algorithm_libuserconf

- name: Set Password Hashing Algorithm in /etc/libuser.conf
  lineinfile:
    dest: /etc/libuser.conf
    insertafter: ^\s*\[defaults]
    regexp: ^#?crypt_style
    line: crypt_style = sha512
    state: present
    create: true
  when: '"libuser" in ansible_facts.packages'
  tags:
    - CJIS-5.6.2.2
    - NIST-800-171-3.13.11
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(1)(c)
    - NIST-800-53-IA-5(c)
    - PCI-DSS-Req-8.2.1
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - set_password_hashing_algorithm_libuserconf
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-set_password_hashing_algorithm_libuserconf:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-set_password_hashing_algorithm_libuserconf_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
        </Group>
      </Group>
      <Group id="xccdf_org.ssgproject.content_group_accounts-physical">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Protect Physical Console Access</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">It is impossible to fully protect a system from an
attacker with physical access, so securing the space in which the
system is located should be considered a necessary step. However,
there are some steps which, if taken, make it more difficult for an
attacker to quickly or undetectably modify a system from its
console.</description>
        <Rule id="xccdf_org.ssgproject.content_rule_service_debug-shell_disabled" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable debug-shell SystemD Service</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">SystemD's <html:code xmlns:html="http://www.w3.org/1999/xhtml">debug-shell</html:code> service is intended to
diagnose SystemD related boot issues with various <html:code xmlns:html="http://www.w3.org/1999/xhtml">systemctl</html:code>
commands. Once enabled and following a system reboot, the root shell
will be available on <html:code xmlns:html="http://www.w3.org/1999/xhtml">tty9</html:code> which is access by pressing
<html:code xmlns:html="http://www.w3.org/1999/xhtml">CTRL-ALT-F9</html:code>. The <html:code xmlns:html="http://www.w3.org/1999/xhtml">debug-shell</html:code> service should only be used
for SystemD related issues and should otherwise be disabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
By default, the <html:code xmlns:html="http://www.w3.org/1999/xhtml">debug-shell</html:code> SystemD service is already disabled.

The <html:code xmlns:html="http://www.w3.org/1999/xhtml">debug-shell</html:code> service can be disabled with the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo systemctl mask --now debug-shell.service</html:pre></description>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.4.5</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(B)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(7)(i)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(7)(ii)(A)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(1)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(i)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(ii)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(iii)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(c)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(1)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(2)(iii)</reference>
          <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FIA_UAU.1</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000324-GPOS-00125</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">This prevents attackers with physical access from trivially bypassing security
on the machine through valid troubleshooting configurations and gaining root
access when the system is rebooted.</rationale>
          <platform idref="cpe:/a:machine"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="service_debug-shell_disabled" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

SYSTEMCTL_EXEC='/usr/bin/systemctl'
"$SYSTEMCTL_EXEC" stop 'debug-shell.service'
"$SYSTEMCTL_EXEC" disable 'debug-shell.service'
"$SYSTEMCTL_EXEC" mask 'debug-shell.service'
# Disable socket activation if we have a unit file for it
if "$SYSTEMCTL_EXEC" list-unit-files | grep -q '^debug-shell.socket'; then
    "$SYSTEMCTL_EXEC" stop 'debug-shell.socket'
    "$SYSTEMCTL_EXEC" mask 'debug-shell.socket'
fi
# The service may not be running because it has been started and failed,
# so let's reset the state so OVAL checks pass.
# Service should be 'inactive', not 'failed' after reboot though.
"$SYSTEMCTL_EXEC" reset-failed 'debug-shell.service' || true

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="service_debug-shell_disabled" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="disable">- name: Disable service debug-shell
  block:

    - name: Gather the service facts
      service_facts: null

    - name: Disable service debug-shell
      systemd:
        name: debug-shell.service
        enabled: 'no'
        state: stopped
        masked: 'yes'
      when: '"debug-shell.service" in ansible_facts.services'
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.4.5
    - disable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - service_debug-shell_disabled

- name: Unit Socket Exists - debug-shell.socket
  command: systemctl list-unit-files debug-shell.socket
  args:
    warn: false
  register: socket_file_exists
  changed_when: false
  ignore_errors: true
  check_mode: false
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.4.5
    - disable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - service_debug-shell_disabled

- name: Disable socket debug-shell
  systemd:
    name: debug-shell.socket
    enabled: 'no'
    state: stopped
    masked: 'yes'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - '"debug-shell.socket" in socket_file_exists.stdout_lines[1]'
  tags:
    - NIST-800-171-3.4.5
    - disable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - service_debug-shell_disabled
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="service_debug-shell_disabled" system="urn:xccdf:fix:script:puppet" complexity="low" disruption="low" strategy="enable">include disable_debug-shell

class disable_debug-shell {
  service {'debug-shell':
    enable =&gt; false,
    ensure =&gt; 'stopped',
  }
}
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="service_debug-shell_disabled" system="urn:xccdf:fix:script:kubernetes">apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    systemd:
      units:
      - enabled: false
        name: debug-shell.service
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-service_debug-shell_disabled:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-service_debug-shell_disabled_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_require_emergency_target_auth" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Require Authentication for Emergency Systemd Target</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Emergency mode is intended as a system recovery
method, providing a single user root access to the system
during a failed boot sequence.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
By default, Emergency mode is protected by requiring a password and is set
in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/usr/lib/systemd/system/emergency.service</html:code>.</description>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.1</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.4.5</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-000213</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(B)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(7)(i)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(7)(ii)(A)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(1)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(i)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(ii)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(iii)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(c)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(1)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(2)(iii)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-2</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-3</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
          <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FIA_UAU.1</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000080-GPOS-00048</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.11</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.12</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.2.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.10</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.06</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.10</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.18.1.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.6.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.7.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.6</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.3.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.5</reference>
          <reference href="https://www.cisecurity.org/controls/">1</reference>
          <reference href="https://www.cisecurity.org/controls/">11</reference>
          <reference href="https://www.cisecurity.org/controls/">12</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">16</reference>
          <reference href="https://www.cisecurity.org/controls/">18</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">5</reference>
          <reference href="">0421</reference>
          <reference href="">0422</reference>
          <reference href="">0431</reference>
          <reference href="">0974</reference>
          <reference href="">1173</reference>
          <reference href="">1401</reference>
          <reference href="">1504</reference>
          <reference href="">1505</reference>
          <reference href="">1546</reference>
          <reference href="">1557</reference>
          <reference href="">1558</reference>
          <reference href="">1559</reference>
          <reference href="">1560</reference>
          <reference href="">1561</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">This prevents attackers with physical access from trivially bypassing security
on the machine and gaining root access. Such accesses are further prevented
by configuring the bootloader password.</rationale>
          <platform idref="cpe:/a:machine"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="require_emergency_target_auth" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

service_file="/usr/lib/systemd/system/emergency.service"

sulogin="/usr/lib/systemd/systemd-sulogin-shell emergency"

if grep "^ExecStart=.*" "$service_file" ; then
    sed -i "s%^ExecStart=.*%ExecStart=-$sulogin%" "$service_file"
else
    echo "ExecStart=-$sulogin" &gt;&gt; "$service_file"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="require_emergency_target_auth" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: require emergency mode password
  lineinfile:
    create: true
    dest: /usr/lib/systemd/system/emergency.service
    regexp: ^#?ExecStart=
    line: ExecStart=-/usr/lib/systemd/systemd-sulogin-shell emergency
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.1
    - NIST-800-171-3.4.5
    - NIST-800-53-AC-3
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-2
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - require_emergency_target_auth
    - restrict_strategy
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-require_emergency_target_auth:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-require_emergency_target_auth_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_disable_ctrlaltdel_reboot" selected="false" role="full" severity="high">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable Ctrl-Alt-Del Reboot Activation</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">By default, <html:code xmlns:html="http://www.w3.org/1999/xhtml">SystemD</html:code> will reboot the system if the <html:code xmlns:html="http://www.w3.org/1999/xhtml">Ctrl-Alt-Del</html:code>
key sequence is pressed.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
To configure the system to ignore the <html:code xmlns:html="http://www.w3.org/1999/xhtml">Ctrl-Alt-Del</html:code> key sequence from the

command line instead of rebooting the system, do either of the following:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">ln -sf /dev/null /etc/systemd/system/ctrl-alt-del.target</html:pre>
or
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">systemctl mask ctrl-alt-del.target</html:pre>
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Do not simply delete the <html:code xmlns:html="http://www.w3.org/1999/xhtml">/usr/lib/systemd/system/ctrl-alt-del.service</html:code> file,
as this file may be restored during future system updates.</description>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.4.5</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(B)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(7)(i)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(7)(ii)(A)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(1)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(i)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(ii)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(iii)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(c)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(1)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(2)(iii)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000324-GPOS-00125</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.10.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.11.1.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.11.1.5</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.11.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.1.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.2.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.6.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.7.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.7.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.7.3.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.8.2.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.8.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.5</reference>
          <reference href="https://www.cisecurity.org/controls/">12</reference>
          <reference href="https://www.cisecurity.org/controls/">13</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">16</reference>
          <reference href="https://www.cisecurity.org/controls/">18</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">5</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">A locally logged-in user who presses Ctrl-Alt-Del, when at the console,
can reboot the system. If accidentally pressed, as could happen in
the case of mixed OS environment, this can create the risk of short-term
loss of availability of systems due to unintentional reboot.</rationale>
          <platform idref="cpe:/a:machine"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="disable_ctrlaltdel_reboot" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

systemctl mask --now ctrl-alt-del.target

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="disable_ctrlaltdel_reboot" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="disable">- name: Disable Ctrl-Alt-Del Reboot Activation
  systemd:
    name: ctrl-alt-del.target
    masked: true
    state: stopped
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.4.5
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - disable_ctrlaltdel_reboot
    - disable_strategy
    - high_severity
    - low_complexity
    - low_disruption
    - no_reboot_needed
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="disable_ctrlaltdel_reboot" system="urn:xccdf:fix:script:kubernetes" reboot="true" complexity="low" disruption="low" strategy="restrict">apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    systemd:
      units:
      - name: ctrl-alt-del.target
        mask: true
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-disable_ctrlaltdel_reboot:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-disable_ctrlaltdel_reboot_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_require_singleuser_auth" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Require Authentication for Single User Mode</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Single-user mode is intended as a system recovery
method, providing a single user root access to the system by
providing a boot option at startup. By default, no authentication
is performed if single-user mode is selected.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
By default, single-user mode is protected by requiring a password and is set
in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/usr/lib/systemd/system/rescue.service</html:code>.</description>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.1</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.4.5</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-000213</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(B)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(7)(i)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(7)(ii)(A)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(1)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(i)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(ii)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(iii)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(c)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(1)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(2)(iii)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-2</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-3</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
          <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FIA_UAU.1</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000080-GPOS-00048</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.11</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.12</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.2.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.10</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.06</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.10</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.18.1.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.6.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.7.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.6</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.3.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.5</reference>
          <reference href="https://www.cisecurity.org/controls/">1</reference>
          <reference href="https://www.cisecurity.org/controls/">11</reference>
          <reference href="https://www.cisecurity.org/controls/">12</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">16</reference>
          <reference href="https://www.cisecurity.org/controls/">18</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">5</reference>
          <reference href="">0421</reference>
          <reference href="">0422</reference>
          <reference href="">0431</reference>
          <reference href="">0974</reference>
          <reference href="">1173</reference>
          <reference href="">1401</reference>
          <reference href="">1504</reference>
          <reference href="">1505</reference>
          <reference href="">1546</reference>
          <reference href="">1557</reference>
          <reference href="">1558</reference>
          <reference href="">1559</reference>
          <reference href="">1560</reference>
          <reference href="">1561</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">This prevents attackers with physical access from trivially bypassing security
on the machine and gaining root access. Such accesses are further prevented
by configuring the bootloader password.</rationale>
          <platform idref="cpe:/a:machine"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="require_singleuser_auth" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

service_file="/usr/lib/systemd/system/rescue.service"

sulogin="/usr/lib/systemd/systemd-sulogin-shell rescue"

if grep "^ExecStart=.*" "$service_file" ; then
    sed -i "s%^ExecStart=.*%ExecStart=-$sulogin%" "$service_file"
else
    echo "ExecStart=-$sulogin" &gt;&gt; "$service_file"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="require_singleuser_auth" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: require single user mode password
  lineinfile:
    create: true
    dest: /usr/lib/systemd/system/rescue.service
    regexp: ^#?ExecStart=
    line: ExecStart=-/usr/lib/systemd/systemd-sulogin-shell rescue
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.1
    - NIST-800-171-3.4.5
    - NIST-800-53-AC-3
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-2
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - require_singleuser_auth
    - restrict_strategy
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-require_singleuser_auth:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-require_singleuser_auth_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_grub2_disable_interactive_boot" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Verify that Interactive Boot is Disabled</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Fedora systems support an "interactive boot" option that can
be used to prevent services from being started. On a Fedora
system, interactive boot can be enabled by providing a <html:code xmlns:html="http://www.w3.org/1999/xhtml">1</html:code>,
<html:code xmlns:html="http://www.w3.org/1999/xhtml">yes</html:code>, <html:code xmlns:html="http://www.w3.org/1999/xhtml">true</html:code>, or <html:code xmlns:html="http://www.w3.org/1999/xhtml">on</html:code> value to the
<html:code xmlns:html="http://www.w3.org/1999/xhtml">systemd.confirm_spawn</html:code> kernel argument in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/default/grub</html:code>.
Remove any instance of <html:pre xmlns:html="http://www.w3.org/1999/xhtml">systemd.confirm_spawn=(1|yes|true|on)</html:pre> from
the kernel arguments in that file to disable interactive boot. It is also
required to change the runtime configuration, run:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">/sbin/grubby --update-kernel=ALL --remove-args="systemd.confirm_spawn"</html:pre></description>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.2</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.4.5</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-000213</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(B)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(7)(i)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(7)(ii)(A)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(1)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(i)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(ii)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(iii)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(c)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(1)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(2)(iii)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-2(1)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
          <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FIA_UAU.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.11</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.12</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.2.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.06</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.6.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.7.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.5</reference>
          <reference href="https://www.cisecurity.org/controls/">11</reference>
          <reference href="https://www.cisecurity.org/controls/">12</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">16</reference>
          <reference href="https://www.cisecurity.org/controls/">18</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">5</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Using interactive boot, the console user could disable auditing, firewalls,
or other services, weakening system security.</rationale>
          <platform idref="cpe:/a:grub2"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="grub2_disable_interactive_boot" system="urn:xccdf:fix:script:sh" reboot="true" complexity="low" disruption="low" strategy="restrict"># Remediation is applicable only in certain platforms
if rpm --quiet -q grub2-common; then

CONFIRM_SPAWN_YES="systemd.confirm_spawn=\(1\|yes\|true\|on\)"
CONFIRM_SPAWN_NO="systemd.confirm_spawn=no"

if grep -q "\(GRUB_CMDLINE_LINUX\|GRUB_CMDLINE_LINUX_DEFAULT\)" /etc/default/grub
then
	sed -i "s/${CONFIRM_SPAWN_YES}/${CONFIRM_SPAWN_NO}/" /etc/default/grub
fi
# Remove 'systemd.confirm_spawn' kernel argument also from runtime settings
/sbin/grubby --update-kernel=ALL --remove-args="systemd.confirm_spawn"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="grub2_disable_interactive_boot" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-171-3.1.2
    - NIST-800-171-3.4.5
    - NIST-800-53-CM-6(a)
    - NIST-800-53-SC-2(1)
    - grub2_disable_interactive_boot
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Verify that Interactive Boot is Disabled in /etc/default/grub
  replace:
    dest: /etc/default/grub
    regexp: systemd.confirm_spawn=(1|yes|true|on)
    replace: systemd.confirm_spawn=no
  when: '"grub2-common" in ansible_facts.packages'
  tags:
    - NIST-800-171-3.1.2
    - NIST-800-171-3.4.5
    - NIST-800-53-CM-6(a)
    - NIST-800-53-SC-2(1)
    - grub2_disable_interactive_boot
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Verify that Interactive Boot is Disabled (runtime)
  command: /sbin/grubby --update-kernel=ALL --remove-args="systemd.confirm_spawn"
  when: '"grub2-common" in ansible_facts.packages'
  tags:
    - NIST-800-171-3.1.2
    - NIST-800-171-3.4.5
    - NIST-800-53-CM-6(a)
    - NIST-800-53-SC-2(1)
    - grub2_disable_interactive_boot
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-grub2_disable_interactive_boot:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-grub2_disable_interactive_boot_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Group id="xccdf_org.ssgproject.content_group_screen_locking">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Configure Screen Locking</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">When a user must temporarily leave an account
logged-in, screen locking should be employed to prevent passersby
from abusing the account. User education and training is
particularly important for screen locking to be effective, and policies
can be implemented to reinforce this.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Automatic screen locking is only meant as a safeguard for
those cases where a user forgot to lock the screen.</description>
          <Group id="xccdf_org.ssgproject.content_group_smart_card_login">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Hardware Tokens for Authentication</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The use of hardware tokens such as smart cards for system login
provides stronger, two-factor authentication than using a username and password.

In Red Hat Enterprise Linux servers and workstations, hardware token login

is not enabled by default and must be enabled in the system settings.</description>
            <platform idref="cpe:/a:machine"/>
            <Value id="xccdf_org.ssgproject.content_value_var_smartcard_drivers" type="string" interactive="true">
              <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">OpenSC Smart Card Drivers</title>
              <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Choose the Smart Card Driver in use by your organization.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>For DoD, choose the <html:code xmlns:html="http://www.w3.org/1999/xhtml">cac</html:code> driver.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>If your driver is not listed and you don't want to use the
<html:code xmlns:html="http://www.w3.org/1999/xhtml">default</html:code> driver, use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">other</html:code> option and
manually specify your driver.</description>
              <value>default</value>
              <value selector="acos5">acos5</value>
              <value selector="akis">akis</value>
              <value selector="asepcos">asepcos</value>
              <value selector="atrust-acos">atrust-acos</value>
              <value selector="authentic">authentic</value>
              <value selector="belpic">belpic</value>
              <value selector="cac">cac</value>
              <value selector="cardos">cardos</value>
              <value selector="coolkey">coolkey</value>
              <value selector="cyberflex">cyberflex</value>
              <value selector="dnie">dnie</value>
              <value selector="entersafe">entersafe</value>
              <value selector="epass2003">epass2003</value>
              <value selector="flex">flex</value>
              <value selector="gemsafeV1">gemsafeV1</value>
              <value selector="gids">gids</value>
              <value selector="gpk">gpk</value>
              <value selector="iasecc">iasecc</value>
              <value selector="incrypto34">incrypto34</value>
              <value selector="isoApplet">isoApplet</value>
              <value selector="itacns">itacns</value>
              <value selector="jpki">jpki</value>
              <value selector="MaskTech">MaskTech</value>
              <value selector="mcrd">mcrd</value>
              <value selector="muscle">muscle</value>
              <value selector="myeid">myeid</value>
              <value selector="npa">npa</value>
              <value selector="oberthur">oberthur</value>
              <value selector="openpgp">openpgp</value>
              <value selector="other">None</value>
              <value selector="PIV-II">PIV-II</value>
              <value selector="rutoken_ecp">rutoken_ecp</value>
              <value selector="rutoken">rutoken</value>
              <value selector="sc-hsm">sc-hsm</value>
              <value selector="setcos">setcos</value>
              <value selector="starcos">starcos</value>
              <value selector="tcos">tcos</value>
              <value selector="westcos">westcos</value>
            </Value>
            <Rule id="xccdf_org.ssgproject.content_rule_package_opensc_installed" selected="false" role="full" severity="medium">
              <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Install the opensc Package For Multifactor Authentication</title>
              <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">opensc</html:code> package can be installed with the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">
$ sudo dnf install opensc</html:pre></description>
              <reference href="https://public.cyber.mil/stigs/cci/">CCI-001954</reference>
              <reference href="https://public.cyber.mil/stigs/cci/">CCI-001953</reference>
              <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
              <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000375-GPOS-00160</reference>
              <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000376-GPOS-00161</reference>
              <reference href="">SRG-OS-000376-VMM-001520</reference>
              <reference href="">1382</reference>
              <reference href="">1384</reference>
              <reference href="">1386</reference>
              <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Using an authentication device, such as a CAC or token that is separate from
the information system, ensures that even if the information system is
compromised, that compromise will not affect credentials stored on the
authentication device.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Multifactor solutions that require devices separate from
information systems gaining access include, for example, hardware tokens
providing time-based or challenge-response authenticators and smart cards such
as the U.S. Government Personal Identity Verification card and the DoD Common
Access Card.</rationale>
              <platform idref="cpe:/a:machine"/>
              <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_opensc_installed" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="enable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

if ! rpm -q --quiet "opensc" ; then
    dnf install -y "opensc"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
              <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_opensc_installed" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="enable">- name: Ensure opensc is installed
  package:
    name: opensc
    state: present
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-CM-6(a)
    - enable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - package_opensc_installed
</fix>
              <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_opensc_installed" system="urn:xccdf:fix:script:puppet" complexity="low" disruption="low" strategy="enable">include install_opensc

class install_opensc {
  package { 'opensc':
    ensure =&gt; 'installed',
  }
}
</fix>
              <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_opensc_installed" system="urn:redhat:anaconda:pre" complexity="low" disruption="low" strategy="enable">
package --add=opensc
</fix>
              <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_opensc_installed" system="urn:redhat:osbuild:blueprint">
[[packages]]
name = "opensc"
version = "*"
</fix>
              <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <check-content-ref name="oval:ssg-package_opensc_installed:def:1" href="ssg-fedora-oval.xml"/>
              </check>
              <check system="http://scap.nist.gov/schema/ocil/2">
                <check-content-ref name="ocil:ssg-package_opensc_installed_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
              </check>
            </Rule>
            <Rule id="xccdf_org.ssgproject.content_rule_package_pcsc-lite_installed" selected="false" role="full" severity="medium">
              <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Install the pcsc-lite package</title>
              <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">pcsc-lite</html:code> package can be installed with the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">
$ sudo dnf install pcsc-lite</html:pre></description>
              <reference href="https://public.cyber.mil/stigs/cci/">CCI-001954</reference>
              <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
              <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000375-GPOS-00160</reference>
              <reference href="">SRG-OS-000377-VMM-001530</reference>
              <reference href="">1382</reference>
              <reference href="">1384</reference>
              <reference href="">1386</reference>
              <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The pcsc-lite package must be installed if it is to be available for
multifactor authentication using smartcards.</rationale>
              <platform idref="cpe:/a:machine"/>
              <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_pcsc-lite_installed" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="enable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

if ! rpm -q --quiet "pcsc-lite" ; then
    dnf install -y "pcsc-lite"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
              <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_pcsc-lite_installed" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="enable">- name: Ensure pcsc-lite is installed
  package:
    name: pcsc-lite
    state: present
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-CM-6(a)
    - enable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - package_pcsc-lite_installed
</fix>
              <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_pcsc-lite_installed" system="urn:xccdf:fix:script:puppet" complexity="low" disruption="low" strategy="enable">include install_pcsc-lite

class install_pcsc-lite {
  package { 'pcsc-lite':
    ensure =&gt; 'installed',
  }
}
</fix>
              <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_pcsc-lite_installed" system="urn:redhat:anaconda:pre" complexity="low" disruption="low" strategy="enable">
package --add=pcsc-lite
</fix>
              <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_pcsc-lite_installed" system="urn:redhat:osbuild:blueprint">
[[packages]]
name = "pcsc-lite"
version = "*"
</fix>
              <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <check-content-ref name="oval:ssg-package_pcsc-lite_installed:def:1" href="ssg-fedora-oval.xml"/>
              </check>
              <check system="http://scap.nist.gov/schema/ocil/2">
                <check-content-ref name="ocil:ssg-package_pcsc-lite_installed_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
              </check>
            </Rule>
            <Rule id="xccdf_org.ssgproject.content_rule_service_pcscd_enabled" selected="false" role="full" severity="medium">
              <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Enable the pcscd Service</title>
              <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">
The <html:code xmlns:html="http://www.w3.org/1999/xhtml">pcscd</html:code> service can be enabled with the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo systemctl enable pcscd.service</html:pre></description>
              <reference href="https://public.cyber.mil/stigs/cci/">CCI-001954</reference>
              <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-2(1)</reference>
              <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-2(2)</reference>
              <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-2(3)</reference>
              <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-2(4)</reference>
              <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-2(6)</reference>
              <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-2(7)</reference>
              <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-2(11)</reference>
              <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
              <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000375-GPOS-00160</reference>
              <reference href="">SRG-OS-000377-VMM-001530</reference>
              <reference href="">1382</reference>
              <reference href="">1384</reference>
              <reference href="">1386</reference>
              <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Using an authentication device, such as a CAC or token that is separate from
the information system, ensures that even if the information system is
compromised, that compromise will not affect credentials stored on the
authentication device.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Multifactor solutions that require devices separate from
information systems gaining access include, for example, hardware tokens
providing time-based or challenge-response authenticators and smart cards such
as the U.S. Government Personal Identity Verification card and the DoD Common
Access Card.</rationale>
              <platform idref="cpe:/a:machine"/>
              <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="service_pcscd_enabled" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="enable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

SYSTEMCTL_EXEC='/usr/bin/systemctl'
"$SYSTEMCTL_EXEC" unmask 'pcscd.service'
"$SYSTEMCTL_EXEC" start 'pcscd.service'
"$SYSTEMCTL_EXEC" enable 'pcscd.service'

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
              <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="service_pcscd_enabled" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="enable">- name: Enable service pcscd
  block:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: Enable service pcscd
      service:
        name: pcscd
        enabled: 'yes'
        state: started
        masked: 'no'
      when:
        - '"pcsc-lite" in ansible_facts.packages'
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-2(1)
    - NIST-800-53-IA-2(11)
    - NIST-800-53-IA-2(2)
    - NIST-800-53-IA-2(3)
    - NIST-800-53-IA-2(4)
    - NIST-800-53-IA-2(6)
    - NIST-800-53-IA-2(7)
    - enable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - service_pcscd_enabled
</fix>
              <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="service_pcscd_enabled" system="urn:xccdf:fix:script:puppet" complexity="low" disruption="low" strategy="enable">include enable_pcscd

class enable_pcscd {
  service {'pcscd':
    enable =&gt; true,
    ensure =&gt; 'running',
  }
}
</fix>
              <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <check-content-ref name="oval:ssg-service_pcscd_enabled:def:1" href="ssg-fedora-oval.xml"/>
              </check>
              <check system="http://scap.nist.gov/schema/ocil/2">
                <check-content-ref name="ocil:ssg-service_pcscd_enabled_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
              </check>
            </Rule>
            <Rule id="xccdf_org.ssgproject.content_rule_install_smartcard_packages" selected="false" role="full" severity="medium">
              <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Install Smart Card Packages For Multifactor Authentication</title>
              <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Configure the operating system to implement multifactor authentication by
installing the required package with the following command:

The <html:code xmlns:html="http://www.w3.org/1999/xhtml">openssl-pkcs11</html:code> package can be installed with the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">
$ sudo dnf install openssl-pkcs11</html:pre></description>
              <reference href="https://public.cyber.mil/stigs/cci/">CCI-000765</reference>
              <reference href="https://public.cyber.mil/stigs/cci/">CCI-001948</reference>
              <reference href="https://public.cyber.mil/stigs/cci/">CCI-001953</reference>
              <reference href="https://public.cyber.mil/stigs/cci/">CCI-001954</reference>
              <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
              <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000105-GPOS-00052</reference>
              <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000375-GPOS-00160</reference>
              <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000375-GPOS-00161</reference>
              <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000377-GPOS-00162</reference>
              <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Using an authentication device, such as a CAC or token that is separate from
the information system, ensures that even if the information system is
compromised, that compromise will not affect credentials stored on the
authentication device.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Multifactor solutions that require devices separate from
information systems gaining access include, for example, hardware tokens
providing time-based or challenge-response authenticators and smart cards such
as the U.S. Government Personal Identity Verification card and the DoD Common
Access Card.</rationale>
              <platform idref="cpe:/a:machine"/>
              <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="install_smartcard_packages" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="enable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

if ! rpm -q --quiet "openssl-pkcs11" ; then
    dnf install -y "openssl-pkcs11"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
              <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="install_smartcard_packages" system="urn:xccdf:fix:script:puppet" complexity="low" disruption="low" strategy="enable">include install_openssl-pkcs11

class install_openssl-pkcs11 {
  package { 'openssl-pkcs11':
    ensure =&gt; 'installed',
  }
}
</fix>
              <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="install_smartcard_packages" system="urn:redhat:anaconda:pre" complexity="low" disruption="low" strategy="enable">
package --add=openssl-pkcs11
</fix>
              <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="install_smartcard_packages" system="urn:redhat:osbuild:blueprint">
[[packages]]
name = "openssl-pkcs11"
version = "*"
</fix>
              <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <check-content-ref name="oval:ssg-install_smartcard_packages:def:1" href="ssg-fedora-oval.xml"/>
              </check>
              <check system="http://scap.nist.gov/schema/ocil/2">
                <check-content-ref name="ocil:ssg-install_smartcard_packages_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
              </check>
            </Rule>
            <Rule id="xccdf_org.ssgproject.content_rule_smartcard_auth" selected="false" role="full" severity="medium">
              <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Enable Smart Card Login</title>
              <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To enable smart card authentication, consult the documentation at:
<html:ul xmlns:html="http://www.w3.org/1999/xhtml">

</html:ul>


For guidance on enabling SSH to authenticate against a Common Access Card (CAC), consult documentation at:
<html:ul xmlns:html="http://www.w3.org/1999/xhtml"><html:li><html:b><html:a href="https://access.redhat.com/solutions/82273">https://access.redhat.com/solutions/82273</html:a></html:b></html:li></html:ul></description>
              <reference href="https://public.cyber.mil/stigs/cci/">CCI-000764</reference>
              <reference href="https://public.cyber.mil/stigs/cci/">CCI-000765</reference>
              <reference href="https://public.cyber.mil/stigs/cci/">CCI-000766</reference>
              <reference href="https://public.cyber.mil/stigs/cci/">CCI-000767</reference>
              <reference href="https://public.cyber.mil/stigs/cci/">CCI-000768</reference>
              <reference href="https://public.cyber.mil/stigs/cci/">CCI-000770</reference>
              <reference href="https://public.cyber.mil/stigs/cci/">CCI-000771</reference>
              <reference href="https://public.cyber.mil/stigs/cci/">CCI-000772</reference>
              <reference href="https://public.cyber.mil/stigs/cci/">CCI-000884</reference>
              <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-2(1)</reference>
              <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-2(2)</reference>
              <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-2(3)</reference>
              <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-2(4)</reference>
              <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-2(6)</reference>
              <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-2(7)</reference>
              <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-2(11)</reference>
              <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
              <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</reference>
              <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</reference>
              <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</reference>
              <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-8.3</reference>
              <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000104-GPOS-00051</reference>
              <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000106-GPOS-00053</reference>
              <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000107-GPOS-00054</reference>
              <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000108-GPOS-00055</reference>
              <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000108-GPOS-00057</reference>
              <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000108-GPOS-00058</reference>
              <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000109-GPOS-00056</reference>
              <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000376-GPOS-00161</reference>
              <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000377-GPOS-00162</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.2.2</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS05.10</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS06.03</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS06.10</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.18.1.4</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.7.1.1</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.9.2.1</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.9.2.2</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.9.2.3</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.9.2.4</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.9.2.6</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.9.3.1</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.9.4.2</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.9.4.3</reference>
              <reference href="https://www.cisecurity.org/controls/">1</reference>
              <reference href="https://www.cisecurity.org/controls/">12</reference>
              <reference href="https://www.cisecurity.org/controls/">15</reference>
              <reference href="https://www.cisecurity.org/controls/">16</reference>
              <reference href="https://www.cisecurity.org/controls/">5</reference>
              <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Smart card login provides two-factor authentication stronger than
that provided by a username and password combination. Smart cards leverage PKI
(public key infrastructure) in order to provide and verify credentials.</rationale>
              <platform idref="cpe:/a:machine"/>
              <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <check-content-ref name="oval:ssg-smartcard_auth:def:1" href="ssg-fedora-oval.xml"/>
              </check>
              <check system="http://scap.nist.gov/schema/ocil/2">
                <check-content-ref name="ocil:ssg-smartcard_auth_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
              </check>
            </Rule>
            <Rule id="xccdf_org.ssgproject.content_rule_force_opensc_card_drivers" selected="false" role="full" severity="medium">
              <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Force opensc To Use Defined Smart Card Driver</title>
              <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The OpenSC smart card tool can auto-detect smart card drivers; however by
forcing the smart card driver in use by your organization, opensc will no longer
autodetect or use other drivers unless specified. This helps to prevent
users from using unauthorized smart cards. The default smart card driver for this
profile is <html:code xmlns:html="http://www.w3.org/1999/xhtml" xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2"><xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_smartcard_drivers" use="legacy"/></html:code>.
To force the OpenSC driver, edit the <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/opensc-<html:i>ARCH</html:i>.conf</html:code> (where
<html:i xmlns:html="http://www.w3.org/1999/xhtml">ARCH</html:i> is the architecture of your operating system) file. Look for a line
similar to:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml"># force_card_driver = customcos;</html:pre>
and change it to:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml" xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2">force_card_driver = <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_smartcard_drivers" use="legacy"/>;</html:pre></description>
              <reference href="https://public.cyber.mil/stigs/cci/">CCI-000765</reference>
              <reference href="https://public.cyber.mil/stigs/cci/">CCI-000766</reference>
              <reference href="https://public.cyber.mil/stigs/cci/">CCI-000767</reference>
              <reference href="https://public.cyber.mil/stigs/cci/">CCI-000768</reference>
              <reference href="https://public.cyber.mil/stigs/cci/">CCI-000771</reference>
              <reference href="https://public.cyber.mil/stigs/cci/">CCI-000772</reference>
              <reference href="https://public.cyber.mil/stigs/cci/">CCI-000884</reference>
              <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-2(1)</reference>
              <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-2(2)</reference>
              <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-2(3)</reference>
              <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-2(4)</reference>
              <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-2(6)</reference>
              <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-2(7)</reference>
              <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-2(11)</reference>
              <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
              <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</reference>
              <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</reference>
              <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</reference>
              <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-8.3</reference>
              <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000104-GPOS-00051</reference>
              <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000106-GPOS-00053</reference>
              <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000107-GPOS-00054</reference>
              <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000109-GPOS-00056</reference>
              <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000108-GPOS-00055</reference>
              <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000108-GPOS-00057</reference>
              <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000108-GPOS-00058</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.2.2</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS05.10</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS06.03</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS06.10</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.18.1.4</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.7.1.1</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.9.2.1</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.9.2.2</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.9.2.3</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.9.2.4</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.9.2.6</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.9.3.1</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.9.4.2</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.9.4.3</reference>
              <reference href="https://www.cisecurity.org/controls/">1</reference>
              <reference href="https://www.cisecurity.org/controls/">12</reference>
              <reference href="https://www.cisecurity.org/controls/">15</reference>
              <reference href="https://www.cisecurity.org/controls/">16</reference>
              <reference href="https://www.cisecurity.org/controls/">5</reference>
              <reference href="">SRG-OS-000376-VMM-001520</reference>
              <reference href="">1382</reference>
              <reference href="">1384</reference>
              <reference href="">1386</reference>
              <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Smart card login provides two-factor authentication stronger than
that provided by a username and password combination. Smart cards leverage PKI
(public key infrastructure) in order to provide and verify credentials.
Forcing the smart card driver in use by your organization helps to prevent
users from using unauthorized smart cards.</rationale>
              <platform idref="cpe:/a:machine"/>
              <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="force_opensc_card_drivers" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="configure"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then


var_smartcard_drivers="<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_smartcard_drivers" use="legacy"/>"



OPENSC_TOOL="/usr/bin/opensc-tool"

if [ -f "${OPENSC_TOOL}" ]; then
    ${OPENSC_TOOL} -S app:default:force_card_driver:$var_smartcard_drivers
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
              <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="force_opensc_card_drivers" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: XCCDF Value var_smartcard_drivers # promote to variable
  set_fact:
    var_smartcard_drivers: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_smartcard_drivers" use="legacy"/>
  tags:
    - always

- name: Check existence of opensc conf
  stat:
    path: /etc/opensc-{{ ansible_architecture }}.conf
  register: opensc_conf_fcd
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-2(1)
    - NIST-800-53-IA-2(11)
    - NIST-800-53-IA-2(2)
    - NIST-800-53-IA-2(3)
    - NIST-800-53-IA-2(4)
    - NIST-800-53-IA-2(6)
    - NIST-800-53-IA-2(7)
    - PCI-DSS-Req-8.3
    - configure_strategy
    - force_opensc_card_drivers
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Force smartcard driver block
  block:

    - name: Check if force_card_driver is defined
      command: /usr/bin/opensc-tool -G app:default:force_card_driver
      changed_when: false
      register: force_card_driver

    - name: Force opensc To Use Defined Smart Card Driver
      command: |
        /usr/bin/opensc-tool -S app:default:force_card_driver:{{ var_smartcard_drivers }}
      when:
        - force_card_driver.stdout != var_smartcard_drivers
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - opensc_conf_fcd.stat.exists
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-2(1)
    - NIST-800-53-IA-2(11)
    - NIST-800-53-IA-2(2)
    - NIST-800-53-IA-2(3)
    - NIST-800-53-IA-2(4)
    - NIST-800-53-IA-2(6)
    - NIST-800-53-IA-2(7)
    - PCI-DSS-Req-8.3
    - configure_strategy
    - force_opensc_card_drivers
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
</fix>
              <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <check-export export-name="oval:ssg-var_smartcard_drivers:var:1" value-id="xccdf_org.ssgproject.content_value_var_smartcard_drivers"/>
                <check-content-ref name="oval:ssg-force_opensc_card_drivers:def:1" href="ssg-fedora-oval.xml"/>
              </check>
              <check system="http://scap.nist.gov/schema/ocil/2">
                <check-content-ref name="ocil:ssg-force_opensc_card_drivers_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
              </check>
            </Rule>
            <Rule id="xccdf_org.ssgproject.content_rule_configure_opensc_nss_db" selected="false" role="full" severity="medium">
              <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Configure NSS DB To Use opensc</title>
              <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">opensc</html:code> module should be configured for use over the
<html:code xmlns:html="http://www.w3.org/1999/xhtml">Coolkey PKCS#11</html:code> module in the NSS database. To configure the
NSS database to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">opensc</html:code> module, run the following
command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo pkcs11-switch opensc</html:pre></description>
              <reference href="https://public.cyber.mil/stigs/cci/">CCI-000765</reference>
              <reference href="https://public.cyber.mil/stigs/cci/">CCI-000766</reference>
              <reference href="https://public.cyber.mil/stigs/cci/">CCI-000767</reference>
              <reference href="https://public.cyber.mil/stigs/cci/">CCI-000768</reference>
              <reference href="https://public.cyber.mil/stigs/cci/">CCI-000771</reference>
              <reference href="https://public.cyber.mil/stigs/cci/">CCI-000772</reference>
              <reference href="https://public.cyber.mil/stigs/cci/">CCI-000884</reference>
              <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-2(1)</reference>
              <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-2(2)</reference>
              <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-2(3)</reference>
              <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-2(4)</reference>
              <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-2(6)</reference>
              <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-2(7)</reference>
              <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-2(11)</reference>
              <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
              <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</reference>
              <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</reference>
              <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</reference>
              <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-8.3</reference>
              <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000104-GPOS-00051</reference>
              <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000106-GPOS-00053</reference>
              <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000107-GPOS-00054</reference>
              <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000109-GPOS-00056</reference>
              <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000108-GPOS-00055</reference>
              <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000108-GPOS-00057</reference>
              <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000108-GPOS-00058</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.2.2</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS05.10</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS06.03</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS06.10</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.18.1.4</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.7.1.1</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.9.2.1</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.9.2.2</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.9.2.3</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.9.2.4</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.9.2.6</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.9.3.1</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.9.4.2</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.9.4.3</reference>
              <reference href="https://www.cisecurity.org/controls/">1</reference>
              <reference href="https://www.cisecurity.org/controls/">12</reference>
              <reference href="https://www.cisecurity.org/controls/">15</reference>
              <reference href="https://www.cisecurity.org/controls/">16</reference>
              <reference href="https://www.cisecurity.org/controls/">5</reference>
              <reference href="">SRG-OS-000376-VMM-001520</reference>
              <reference href="">SRG-OS-000403-VMM-001640</reference>
              <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Smart card login provides two-factor authentication stronger than
that provided by a username and password combination. Smart cards leverage PKI
(public key infrastructure) in order to provide and verify credentials.</rationale>
              <platform idref="cpe:/a:machine"/>
              <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="configure_opensc_nss_db" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="configure"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

PKCSSW=$(/usr/bin/pkcs11-switch)

if [ ${PKCSSW} != "opensc" ] ; then
    ${PKCSSW} opensc
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
              <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="configure_opensc_nss_db" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: Check existence of pkcs11-switch
  stat:
    path: /usr/bin/pkcs11-switch
  register: pkcs11switch
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-2(1)
    - NIST-800-53-IA-2(11)
    - NIST-800-53-IA-2(2)
    - NIST-800-53-IA-2(3)
    - NIST-800-53-IA-2(4)
    - NIST-800-53-IA-2(6)
    - NIST-800-53-IA-2(7)
    - PCI-DSS-Req-8.3
    - configure_opensc_nss_db
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Get NSS database smart card configuration
  command: /usr/bin/pkcs11-switch
  changed_when: true
  register: pkcsw_output
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - pkcs11switch.stat.exists
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-2(1)
    - NIST-800-53-IA-2(11)
    - NIST-800-53-IA-2(2)
    - NIST-800-53-IA-2(3)
    - NIST-800-53-IA-2(4)
    - NIST-800-53-IA-2(6)
    - NIST-800-53-IA-2(7)
    - PCI-DSS-Req-8.3
    - configure_opensc_nss_db
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Configure NSS DB To Use opensc
  command: /usr/bin/pkcs11-switch opensc
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - pkcs11switch.stat.exists and pkcsw_output.stdout != "opensc"
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-2(1)
    - NIST-800-53-IA-2(11)
    - NIST-800-53-IA-2(2)
    - NIST-800-53-IA-2(3)
    - NIST-800-53-IA-2(4)
    - NIST-800-53-IA-2(6)
    - NIST-800-53-IA-2(7)
    - PCI-DSS-Req-8.3
    - configure_opensc_nss_db
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
</fix>
              <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <check-content-ref name="oval:ssg-configure_opensc_nss_db:def:1" href="ssg-fedora-oval.xml"/>
              </check>
              <check system="http://scap.nist.gov/schema/ocil/2">
                <check-content-ref name="ocil:ssg-configure_opensc_nss_db_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
              </check>
            </Rule>
            <Rule id="xccdf_org.ssgproject.content_rule_configure_opensc_card_drivers" selected="false" role="full" severity="medium">
              <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Configure opensc Smart Card Drivers</title>
              <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The OpenSC smart card tool can auto-detect smart card drivers; however,
setting the smart card drivers in use by your organization helps to prevent
users from using unauthorized smart cards. The default smart card driver for this
profile is <html:code xmlns:html="http://www.w3.org/1999/xhtml" xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2"><xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_smartcard_drivers" use="legacy"/></html:code>.
To configure the OpenSC driver, edit the <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/opensc-<html:i>ARCH</html:i>.conf</html:code> (where
<html:i xmlns:html="http://www.w3.org/1999/xhtml">ARCH</html:i> is the architecture of your operating system) file. Look for a
line similar to:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml"># card_drivers = old, internal;</html:pre>
and change it to:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml" xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2">card_drivers = <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_smartcard_drivers" use="legacy"/>;</html:pre></description>
              <reference href="https://public.cyber.mil/stigs/cci/">CCI-000765</reference>
              <reference href="https://public.cyber.mil/stigs/cci/">CCI-000766</reference>
              <reference href="https://public.cyber.mil/stigs/cci/">CCI-000767</reference>
              <reference href="https://public.cyber.mil/stigs/cci/">CCI-000768</reference>
              <reference href="https://public.cyber.mil/stigs/cci/">CCI-000771</reference>
              <reference href="https://public.cyber.mil/stigs/cci/">CCI-000772</reference>
              <reference href="https://public.cyber.mil/stigs/cci/">CCI-000884</reference>
              <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-2(1)</reference>
              <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-2(2)</reference>
              <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-2(3)</reference>
              <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-2(4)</reference>
              <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-2(6)</reference>
              <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-2(7)</reference>
              <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-2(11)</reference>
              <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
              <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</reference>
              <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</reference>
              <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</reference>
              <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-8.3</reference>
              <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000104-GPOS-00051</reference>
              <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000106-GPOS-00053</reference>
              <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000107-GPOS-00054</reference>
              <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000109-GPOS-00056</reference>
              <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000108-GPOS-00055</reference>
              <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000108-GPOS-00057</reference>
              <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000108-GPOS-00058</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.2.2</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS05.10</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS06.03</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS06.10</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.18.1.4</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.7.1.1</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.9.2.1</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.9.2.2</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.9.2.3</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.9.2.4</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.9.2.6</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.9.3.1</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.9.4.2</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.9.4.3</reference>
              <reference href="https://www.cisecurity.org/controls/">1</reference>
              <reference href="https://www.cisecurity.org/controls/">12</reference>
              <reference href="https://www.cisecurity.org/controls/">15</reference>
              <reference href="https://www.cisecurity.org/controls/">16</reference>
              <reference href="https://www.cisecurity.org/controls/">5</reference>
              <reference href="">SRG-OS-000376-VMM-001520</reference>
              <reference href="">1382</reference>
              <reference href="">1384</reference>
              <reference href="">1386</reference>
              <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Smart card login provides two-factor authentication stronger than
that provided by a username and password combination. Smart cards leverage PKI
(public key infrastructure) in order to provide and verify credentials.
Configuring the smart card driver in use by your organization helps to prevent
users from using unauthorized smart cards.</rationale>
              <platform idref="cpe:/a:machine"/>
              <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="configure_opensc_card_drivers" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="configure"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then


var_smartcard_drivers="<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_smartcard_drivers" use="legacy"/>"



OPENSC_TOOL="/usr/bin/opensc-tool"

if [ -f "${OPENSC_TOOL}" ]; then
    ${OPENSC_TOOL} -S app:default:card_drivers:$var_smartcard_drivers
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
              <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="configure_opensc_card_drivers" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: XCCDF Value var_smartcard_drivers # promote to variable
  set_fact:
    var_smartcard_drivers: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_smartcard_drivers" use="legacy"/>
  tags:
    - always

- name: Check existence of opensc conf
  stat:
    path: /etc/opensc-{{ ansible_architecture }}.conf
  register: opensc_conf_cd
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-2(1)
    - NIST-800-53-IA-2(11)
    - NIST-800-53-IA-2(2)
    - NIST-800-53-IA-2(3)
    - NIST-800-53-IA-2(4)
    - NIST-800-53-IA-2(6)
    - NIST-800-53-IA-2(7)
    - PCI-DSS-Req-8.3
    - configure_opensc_card_drivers
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Configure smartcard driver block
  block:

    - name: Check if card_drivers is defined
      command: /usr/bin/opensc-tool -G app:default:card_drivers
      changed_when: false
      register: card_drivers

    - name: Configure opensc Smart Card Drivers
      command: |
        /usr/bin/opensc-tool -S app:default:card_drivers:{{ var_smartcard_drivers }}
      when:
        - card_drivers.stdout != var_smartcard_drivers
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - opensc_conf_cd.stat.exists
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-2(1)
    - NIST-800-53-IA-2(11)
    - NIST-800-53-IA-2(2)
    - NIST-800-53-IA-2(3)
    - NIST-800-53-IA-2(4)
    - NIST-800-53-IA-2(6)
    - NIST-800-53-IA-2(7)
    - PCI-DSS-Req-8.3
    - configure_opensc_card_drivers
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
</fix>
              <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <check-export export-name="oval:ssg-var_smartcard_drivers:var:1" value-id="xccdf_org.ssgproject.content_value_var_smartcard_drivers"/>
                <check-content-ref name="oval:ssg-configure_opensc_card_drivers:def:1" href="ssg-fedora-oval.xml"/>
              </check>
              <check system="http://scap.nist.gov/schema/ocil/2">
                <check-content-ref name="ocil:ssg-configure_opensc_card_drivers_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
              </check>
            </Rule>
          </Group>
          <Group id="xccdf_org.ssgproject.content_group_console_screen_locking">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Configure Console Screen Locking</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">A console screen locking mechanism is a temporary action taken when a user
stops work and moves away from the immediate physical vicinity of the
information system but does not logout because of the temporary nature of
the absence. Rather than relying on the user to manually lock their
operation system session prior to vacating the vicinity, operating systems
need to be able to identify when a user's session has idled and take action
to initiate the session lock.</description>
            <Rule id="xccdf_org.ssgproject.content_rule_package_screen_installed" selected="false" role="full" severity="medium">
              <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Install the screen Package</title>
              <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To enable console screen locking, install the <html:code xmlns:html="http://www.w3.org/1999/xhtml">screen</html:code> package.
The <html:code xmlns:html="http://www.w3.org/1999/xhtml">screen</html:code> package can be installed with the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">
$ sudo dnf install screen</html:pre>
Instruct users to begin new terminal sessions with the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ screen</html:pre>
The console can now be locked with the following key combination:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">ctrl+a x</html:pre></description>
              <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.10</reference>
              <reference href="https://public.cyber.mil/stigs/cci/">CCI-000057</reference>
              <reference href="https://public.cyber.mil/stigs/cci/">CCI-000058</reference>
              <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
              <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</reference>
              <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_MOF_EXT.1</reference>
              <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000029-GPOS-00010</reference>
              <reference href="">SRG-OS-000030-VMM-000110</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS05.10</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS06.10</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.18.1.4</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.9.2.1</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.9.2.4</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.9.3.1</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.9.4.2</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.9.4.3</reference>
              <reference href="https://www.cisecurity.org/controls/">1</reference>
              <reference href="https://www.cisecurity.org/controls/">12</reference>
              <reference href="https://www.cisecurity.org/controls/">15</reference>
              <reference href="https://www.cisecurity.org/controls/">16</reference>
              <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">A session time-out lock is a temporary action taken when a user stops work and moves away from the immediate
physical vicinity of the information system but does not logout because of the temporary nature of the absence.
Rather than relying on the user to manually lock their operation system session prior to vacating the vicinity,
operating systems need to be able to identify when a user's session has idled and take action to initiate the
session lock.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
The <html:code xmlns:html="http://www.w3.org/1999/xhtml">screen</html:code> package allows for a session lock to be implemented and configured.</rationale>
              <platform idref="cpe:/a:machine"/>
              <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_screen_installed" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="enable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

if ! rpm -q --quiet "screen" ; then
    dnf install -y "screen"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
              <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_screen_installed" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="enable">- name: Ensure screen is installed
  package:
    name: screen
    state: present
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.10
    - NIST-800-53-CM-6(a)
    - enable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - package_screen_installed
</fix>
              <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_screen_installed" system="urn:xccdf:fix:script:puppet" complexity="low" disruption="low" strategy="enable">include install_screen

class install_screen {
  package { 'screen':
    ensure =&gt; 'installed',
  }
}
</fix>
              <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_screen_installed" system="urn:redhat:anaconda:pre" complexity="low" disruption="low" strategy="enable">
package --add=screen
</fix>
              <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_screen_installed" system="urn:redhat:osbuild:blueprint">
[[packages]]
name = "screen"
version = "*"
</fix>
              <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <check-content-ref name="oval:ssg-package_screen_installed:def:1" href="ssg-fedora-oval.xml"/>
              </check>
              <check system="http://scap.nist.gov/schema/ocil/2">
                <check-content-ref name="ocil:ssg-package_screen_installed_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
              </check>
            </Rule>
            <Rule id="xccdf_org.ssgproject.content_rule_package_tmux_installed" selected="false" role="full" severity="medium">
              <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Install the tmux Package</title>
              <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To enable console screen locking, install the <html:code xmlns:html="http://www.w3.org/1999/xhtml">tmux</html:code> package.
The <html:code xmlns:html="http://www.w3.org/1999/xhtml">tmux</html:code> package can be installed with the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">
$ sudo dnf install tmux</html:pre>
Instruct users to begin new terminal sessions with the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ tmux</html:pre>
The console can now be locked with the following key combination:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">ctrl+b :lock-session</html:pre></description>
              <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.10</reference>
              <reference href="https://public.cyber.mil/stigs/cci/">CCI-000058</reference>
              <reference href="https://public.cyber.mil/stigs/cci/">CCI-000056</reference>
              <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
              <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</reference>
              <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_MOF_EXT.1</reference>
              <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000030-GPOS-00011</reference>
              <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000028-GPOS-00009</reference>
              <reference href="">SRG-OS-000030-VMM-000110</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</reference>
              <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS05.10</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS06.10</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.18.1.4</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.9.2.1</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.9.2.4</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.9.3.1</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.9.4.2</reference>
              <reference href="https://www.iso.org/standard/54534.html">A.9.4.3</reference>
              <reference href="https://www.cisecurity.org/controls/">1</reference>
              <reference href="https://www.cisecurity.org/controls/">12</reference>
              <reference href="https://www.cisecurity.org/controls/">15</reference>
              <reference href="https://www.cisecurity.org/controls/">16</reference>
              <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">A session time-out lock is a temporary action taken when a user stops work and moves away from the immediate
physical vicinity of the information system but does not logout because of the temporary nature of the absence.
Rather than relying on the user to manually lock their operation system session prior to vacating the vicinity,
operating systems need to be able to identify when a user's session has idled and take action to initiate the
session lock.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
The <html:code xmlns:html="http://www.w3.org/1999/xhtml">tmux</html:code> package allows for a session lock to be implemented and configured.</rationale>
              <platform idref="cpe:/a:machine"/>
              <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_tmux_installed" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="enable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

if ! rpm -q --quiet "tmux" ; then
    dnf install -y "tmux"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
              <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_tmux_installed" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="enable">- name: Ensure tmux is installed
  package:
    name: tmux
    state: present
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.10
    - NIST-800-53-CM-6(a)
    - enable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - package_tmux_installed
</fix>
              <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_tmux_installed" system="urn:xccdf:fix:script:puppet" complexity="low" disruption="low" strategy="enable">include install_tmux

class install_tmux {
  package { 'tmux':
    ensure =&gt; 'installed',
  }
}
</fix>
              <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_tmux_installed" system="urn:redhat:anaconda:pre" complexity="low" disruption="low" strategy="enable">
package --add=tmux
</fix>
              <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_tmux_installed" system="urn:redhat:osbuild:blueprint">
[[packages]]
name = "tmux"
version = "*"
</fix>
              <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <check-content-ref name="oval:ssg-package_tmux_installed:def:1" href="ssg-fedora-oval.xml"/>
              </check>
              <check system="http://scap.nist.gov/schema/ocil/2">
                <check-content-ref name="ocil:ssg-package_tmux_installed_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
              </check>
            </Rule>
            <Rule id="xccdf_org.ssgproject.content_rule_no_tmux_in_shells" selected="false" role="full" severity="medium">
              <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Prevent user from disabling the screen lock</title>
              <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">tmux</html:code> terminal multiplexer is used to implement
automatic session locking. It should not be listed in
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/shells</html:code>.</description>
              <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_SMF_EXT.1</reference>
              <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000324-GPOS-00125</reference>
              <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000028-GPOS-00009</reference>
              <reference href="https://public.cyber.mil/stigs/cci/">CCI-000056</reference>
              <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Not listing <html:code xmlns:html="http://www.w3.org/1999/xhtml">tmux</html:code> among permitted shells
prevents malicious program running as user
from lowering security by disabling the screen lock.</rationale>
              <platform idref="cpe:/a:machine"/>
              <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="no_tmux_in_shells" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

if grep -q 'tmux$' /etc/shells ; then
	sed -i '/tmux$/d' /etc/shells
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
              <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="no_tmux_in_shells" system="urn:xccdf:fix:script:kubernetes">apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,/bin/sh%0A/bin/bash%0A/usr/bin/sh%0A/usr/bin/bash%0A
        mode: 0644
        path: /etc/shells
        overwrite: true
</fix>
              <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <check-content-ref name="oval:ssg-no_tmux_in_shells:def:1" href="ssg-fedora-oval.xml"/>
              </check>
              <check system="http://scap.nist.gov/schema/ocil/2">
                <check-content-ref name="ocil:ssg-no_tmux_in_shells_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
              </check>
            </Rule>
            <Rule id="xccdf_org.ssgproject.content_rule_configure_tmux_lock_command" selected="false" role="full" severity="medium">
              <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Configure the tmux Lock Command</title>
              <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To enable console screen locking in <html:code xmlns:html="http://www.w3.org/1999/xhtml">tmux</html:code> terminal multiplexer,
the <html:code xmlns:html="http://www.w3.org/1999/xhtml">vlock</html:code> command must be configured to be used as a locking
mechanism.
Add the following line to <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/tmux.conf</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">set -g lock-command vlock</html:pre>.
The console can now be locked with the following key combination:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">ctrl+b :lock-session</html:pre></description>
              <reference href="https://public.cyber.mil/stigs/cci/">CCI-000056</reference>
              <reference href="https://public.cyber.mil/stigs/cci/">CCI-000058</reference>
              <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-11(a)</reference>
              <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-11(b)</reference>
              <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
              <reference href="">SRG-OS-000028-VMM-000090</reference>
              <reference href="">SRG-OS-000030-VMM-000110</reference>
              <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000028-GPOS-00009</reference>
              <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">tmux</html:code> package allows for a session lock to be implemented and configured.
However, the session lock is implemented by an external command. The <html:code xmlns:html="http://www.w3.org/1999/xhtml">tmux</html:code>
default configuration does not contain an effective session lock.</rationale>
              <platform idref="cpe:/a:machine"/>
              <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="configure_tmux_lock_command" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

tmux_conf="/etc/tmux.conf"

if grep -qP '^\s*set\s+-g\s+lock-command' "$tmux_conf" ; then
    sed -i 's/^\s*set\s\+-g\s\+lock-command.*$/set -g lock-command vlock/' "$tmux_conf"
else
    echo "set -g lock-command vlock" &gt;&gt; "$tmux_conf"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
              <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="configure_tmux_lock_command" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Configure the tmux Lock Command
  block:

    - name: Check for duplicate values
      lineinfile:
        path: /etc/tmux.conf
        create: false
        regexp: ^\s*set -g lock-command\s+
        state: absent
      check_mode: true
      changed_when: false
      register: dupes

    - name: Deduplicate values from /etc/tmux.conf
      lineinfile:
        path: /etc/tmux.conf
        create: false
        regexp: ^\s*set -g lock-command\s+
        state: absent
      when: dupes.found is defined and dupes.found &gt; 1

    - name: Insert correct line to /etc/tmux.conf
      lineinfile:
        path: /etc/tmux.conf
        create: true
        regexp: ^\s*set -g lock-command\s+
        line: set -g lock-command vlock
        state: present
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-11(a)
    - NIST-800-53-AC-11(b)
    - NIST-800-53-CM-6(a)
    - configure_tmux_lock_command
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</fix>
              <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <check-content-ref name="oval:ssg-configure_tmux_lock_command:def:1" href="ssg-fedora-oval.xml"/>
              </check>
              <check system="http://scap.nist.gov/schema/ocil/2">
                <check-content-ref name="ocil:ssg-configure_tmux_lock_command_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
              </check>
            </Rule>
            <Rule id="xccdf_org.ssgproject.content_rule_configure_tmux_lock_after_time" selected="false" role="full" severity="medium">
              <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Configure tmux to lock session after inactivity</title>
              <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To enable console screen locking in <html:code xmlns:html="http://www.w3.org/1999/xhtml">tmux</html:code> terminal multiplexer
after a period of inactivity,
the <html:code xmlns:html="http://www.w3.org/1999/xhtml">lock-after-time</html:code> option has to be set to nonzero value in
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/tmux.conf</html:code>.</description>
              <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_SMF_EXT.1</reference>
              <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000029-GPOS-00010</reference>
              <reference href="https://public.cyber.mil/stigs/cci/">CCI-000057</reference>
              <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Locking the session after a period of inactivity limits the
potential exposure if the session is left unattended.</rationale>
              <platform idref="cpe:/a:machine"/>
              <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="configure_tmux_lock_after_time" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

tmux_conf="/etc/tmux.conf"

if grep -qP '^\s*set\s+-g\s+lock-after-time' "$tmux_conf" ; then
    sed -i 's/^\s*set\s\+-g\s\+lock-after-time.*$/set -g lock-after-time 900/' "$tmux_conf"
else
    echo "set -g lock-after-time 900" &gt;&gt; "$tmux_conf"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
              <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="configure_tmux_lock_after_time" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Configure tmux to lock session after inactivity
  block:

    - name: Check for duplicate values
      lineinfile:
        path: /etc/tmux.conf
        create: false
        regexp: ^\s*set -g lock-after-time\s+
        state: absent
      check_mode: true
      changed_when: false
      register: dupes

    - name: Deduplicate values from /etc/tmux.conf
      lineinfile:
        path: /etc/tmux.conf
        create: false
        regexp: ^\s*set -g lock-after-time\s+
        state: absent
      when: dupes.found is defined and dupes.found &gt; 1

    - name: Insert correct line to /etc/tmux.conf
      lineinfile:
        path: /etc/tmux.conf
        create: true
        regexp: ^\s*set -g lock-after-time\s+
        line: set -g lock-after-time 900
        state: present
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - configure_tmux_lock_after_time
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</fix>
              <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <check-content-ref name="oval:ssg-configure_tmux_lock_after_time:def:1" href="ssg-fedora-oval.xml"/>
              </check>
              <check system="http://scap.nist.gov/schema/ocil/2">
                <check-content-ref name="ocil:ssg-configure_tmux_lock_after_time_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
              </check>
            </Rule>
            <Rule id="xccdf_org.ssgproject.content_rule_configure_bashrc_exec_tmux" selected="false" role="full" severity="medium">
              <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Support session locking with tmux</title>
              <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">tmux</html:code> terminal multiplexer is used to implement
automatic session locking. It should be started from
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/bashrc</html:code>.</description>
              <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_SMF_EXT.1</reference>
              <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000031-GPOS-00012</reference>
              <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000028-GPOS-00009</reference>
              <reference href="https://public.cyber.mil/stigs/cci/">CCI-000056</reference>
              <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Unlike <html:code xmlns:html="http://www.w3.org/1999/xhtml">bash</html:code> itself, the <html:code xmlns:html="http://www.w3.org/1999/xhtml">tmux</html:code> terminal multiplexer
provides a mechanism to lock sessions after period of inactivity.</rationale>
              <platform idref="cpe:/a:machine"/>
              <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="configure_bashrc_exec_tmux" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

if ! grep -x '  case "$name" in sshd|login) exec tmux ;; esac' /etc/bashrc; then
    cat &gt;&gt; /etc/bashrc &lt;&lt;'EOF'
if [ "$PS1" ]; then
  parent=$(ps -o ppid= -p $$)
  name=$(ps -o comm= -p $parent)
  case "$name" in sshd|login) exec tmux ;; esac
fi
EOF
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
              <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <check-content-ref name="oval:ssg-configure_bashrc_exec_tmux:def:1" href="ssg-fedora-oval.xml"/>
              </check>
              <check system="http://scap.nist.gov/schema/ocil/2">
                <check-content-ref name="ocil:ssg-configure_bashrc_exec_tmux_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
              </check>
            </Rule>
          </Group>
        </Group>
      </Group>
      <Group id="xccdf_org.ssgproject.content_group_accounts-restrictions">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Protect Accounts by Restricting Password-Based Login</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Conventionally, Unix shell accounts are accessed by
providing a username and password to a login program, which tests
these values for correctness using the <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/passwd</html:code> and
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/shadow</html:code> files. Password-based login is vulnerable to
guessing of weak passwords, and to sniffing and man-in-the-middle
attacks against passwords entered over a network or at an insecure
console. Therefore, mechanisms for accessing accounts by entering
usernames and passwords should be restricted to those which are
operationally necessary.</description>
        <Group id="xccdf_org.ssgproject.content_group_password_expiration">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Set Password Expiration Parameters</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The file <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/login.defs</html:code> controls several
password-related settings. Programs such as <html:code xmlns:html="http://www.w3.org/1999/xhtml">passwd</html:code>,
<html:code xmlns:html="http://www.w3.org/1999/xhtml">su</html:code>, and
<html:code xmlns:html="http://www.w3.org/1999/xhtml">login</html:code> consult <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/login.defs</html:code> to determine
behavior with regard to password aging, expiration warnings,
and length. See the man page <html:code xmlns:html="http://www.w3.org/1999/xhtml">login.defs(5)</html:code> for more information.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Users should be forced to change their passwords, in order to
decrease the utility of compromised passwords. However, the need to
change passwords often should be balanced against the risk that
users will reuse or write down passwords if forced to change them
too often. Forcing password changes every 90-360 days, depending on
the environment, is recommended. Set the appropriate value as
<html:code xmlns:html="http://www.w3.org/1999/xhtml">PASS_MAX_DAYS</html:code> and apply it to existing accounts with the
<html:code xmlns:html="http://www.w3.org/1999/xhtml">-M</html:code> flag.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
The <html:code xmlns:html="http://www.w3.org/1999/xhtml">PASS_MIN_DAYS</html:code> (<html:code xmlns:html="http://www.w3.org/1999/xhtml">-m</html:code>) setting prevents password
changes for 7 days after the first change, to discourage password
cycling. If you use this setting, train users to contact an administrator
for an emergency password change in case a new password becomes
compromised. The <html:code xmlns:html="http://www.w3.org/1999/xhtml">PASS_WARN_AGE</html:code> (<html:code xmlns:html="http://www.w3.org/1999/xhtml">-W</html:code>) setting gives
users 7 days of warnings at login time that their passwords are about to expire.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
For example, for each existing human user <html:i xmlns:html="http://www.w3.org/1999/xhtml">USER</html:i>, expiration parameters
could be adjusted to a 180 day maximum password age, 7 day minimum password
age, and 7 day warning period with the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo chage -M 180 -m 7 -W 7 USER</html:pre></description>
          <Value id="xccdf_org.ssgproject.content_value_var_accounts_maximum_age_login_defs" type="number">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">maximum password age</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Maximum age of password in days</description>
            <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">This will only apply to newly created accounts</warning>
            <value selector="365">365</value>
            <value selector="120">120</value>
            <value selector="180">180</value>
            <value selector="60">60</value>
            <value selector="90">90</value>
            <value>60</value>
          </Value>
          <Value id="xccdf_org.ssgproject.content_value_var_accounts_minimum_age_login_defs" type="number">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">minimum password age</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Minimum age of password in days</description>
            <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">This will only apply to newly created accounts</warning>
            <value selector="0">0</value>
            <value selector="1">1</value>
            <value selector="2">2</value>
            <value selector="5">5</value>
            <value selector="7">7</value>
            <value>7</value>
          </Value>
          <Value id="xccdf_org.ssgproject.content_value_var_accounts_password_minlen_login_defs" type="number">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">minimum password length</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Minimum number of characters in password</description>
            <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">This will only check new passwords</warning>
            <value selector="10">10</value>
            <value selector="12">12</value>
            <value selector="14">14</value>
            <value selector="15">15</value>
            <value selector="18">18</value>
            <value selector="20">20</value>
            <value selector="6">6</value>
            <value selector="8">8</value>
            <value>15</value>
          </Value>
          <Value id="xccdf_org.ssgproject.content_value_var_accounts_password_warn_age_login_defs" type="number">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">warning days before password expires</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The number of days' warning given before a password expires.</description>
            <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">This will only apply to newly created accounts</warning>
            <value selector="0">0</value>
            <value selector="14">14</value>
            <value selector="7">7</value>
            <value>7</value>
          </Value>
          <Rule id="xccdf_org.ssgproject.content_rule_accounts_password_warn_age_login_defs" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Set Password Warning Age</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To specify how many days prior to password
expiration that a warning will be issued to users,
edit the file <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/login.defs</html:code> and add or correct
 the following line:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml" xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2">PASS_WARN_AGE <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_password_warn_age_login_defs" use="legacy"/></html:pre>
The DoD requirement is 7.
The profile requirement is <html:code xmlns:html="http://www.w3.org/1999/xhtml" xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2"><xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_password_warn_age_login_defs" use="legacy"/></html:code>.</description>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.5.8</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(f)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(1)(d)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.2.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.10</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.10</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.18.1.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.7.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.2.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.2.6</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.3.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.5</reference>
            <reference href="https://www.cisecurity.org/controls/">1</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">13</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">18</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">5</reference>
            <reference href="https://www.cisecurity.org/controls/">7</reference>
            <reference href="https://www.cisecurity.org/controls/">8</reference>
            <reference href="">0418</reference>
            <reference href="">1055</reference>
            <reference href="">1402</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Setting the password warning age enables users to
make the change at a practical time.</rationale>
            <platform idref="cpe:/a:login_defs"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="accounts_password_warn_age_login_defs" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q login; then


declare var_accounts_password_warn_age_login_defs
var_accounts_password_warn_age_login_defs="<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_accounts_password_warn_age_login_defs" use="legacy"/>"



grep -q ^PASS_WARN_AGE /etc/login.defs &amp;&amp; \
sed -i "s/PASS_WARN_AGE.*/PASS_WARN_AGE\t$var_accounts_password_warn_age_login_defs/g" /etc/login.defs
if ! [ $? -eq 0 ]
then
  echo -e "PASS_WARN_AGE\t$var_accounts_password_warn_age_login_defs" &gt;&gt; /etc/login.defs
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="accounts_password_warn_age_login_defs" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-171-3.5.8
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(1)(d)
    - NIST-800-53-IA-5(f)
    - accounts_password_warn_age_login_defs
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
- name: XCCDF Value var_accounts_password_warn_age_login_defs # promote to variable
  set_fact:
    var_accounts_password_warn_age_login_defs: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_accounts_password_warn_age_login_defs" use="legacy"/>
  tags:
    - always

- name: Set Password Warning Age
  lineinfile:
    dest: /etc/login.defs
    regexp: ^PASS_WARN_AGE *[0-9]*
    state: present
    line: PASS_WARN_AGE        {{ var_accounts_password_warn_age_login_defs }}
    create: true
  when: '"login" in ansible_facts.packages'
  tags:
    - NIST-800-171-3.5.8
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(1)(d)
    - NIST-800-53-IA-5(f)
    - accounts_password_warn_age_login_defs
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-export export-name="oval:ssg-var_accounts_password_warn_age_login_defs:var:1" value-id="xccdf_org.ssgproject.content_value_var_accounts_password_warn_age_login_defs"/>
              <check-content-ref name="oval:ssg-accounts_password_warn_age_login_defs:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-accounts_password_warn_age_login_defs_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_accounts_minimum_age_login_defs" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Set Password Minimum Age</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To specify password minimum age for new accounts,
edit the file <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/login.defs</html:code>
and add or correct the following line:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml" xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2">PASS_MIN_DAYS <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_minimum_age_login_defs" use="legacy"/></html:pre>
A value of 1 day is considered sufficient for many
environments. The DoD requirement is 1.
The profile requirement is <html:code xmlns:html="http://www.w3.org/1999/xhtml" xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2"><xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_minimum_age_login_defs" use="legacy"/></html:code>.</description>
            <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.6.2.1.1</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.5.8</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000198</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(f)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(1)(d)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000075-GPOS-00043</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.2.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.10</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.10</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.18.1.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.7.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.2.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.2.6</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.3.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.3</reference>
            <reference href="https://www.cisecurity.org/controls/">1</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">5</reference>
            <reference href="">0418</reference>
            <reference href="">1055</reference>
            <reference href="">1402</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Enforcing a minimum password lifetime helps to prevent repeated password
changes to defeat the password reuse or history enforcement requirement. If
users are allowed to immediately and continually change their password,
then the password could be repeatedly changed in a short period of time to
defeat the organization's policy regarding password reuse.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Setting the minimum password age protects against users cycling back to a
favorite password after satisfying the password reuse requirement.</rationale>
            <platform idref="cpe:/a:login_defs"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="accounts_minimum_age_login_defs" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q login; then


declare var_accounts_minimum_age_login_defs
var_accounts_minimum_age_login_defs="<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_accounts_minimum_age_login_defs" use="legacy"/>"



grep -q ^PASS_MIN_DAYS /etc/login.defs &amp;&amp; \
sed -i "s/PASS_MIN_DAYS.*/PASS_MIN_DAYS\t$var_accounts_minimum_age_login_defs/g" /etc/login.defs
if ! [ $? -eq 0 ]
then
  echo -e "PASS_MIN_DAYS\t$var_accounts_minimum_age_login_defs" &gt;&gt; /etc/login.defs
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="accounts_minimum_age_login_defs" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - CJIS-5.6.2.1.1
    - NIST-800-171-3.5.8
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(1)(d)
    - NIST-800-53-IA-5(f)
    - accounts_minimum_age_login_defs
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
- name: XCCDF Value var_accounts_minimum_age_login_defs # promote to variable
  set_fact:
    var_accounts_minimum_age_login_defs: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_accounts_minimum_age_login_defs" use="legacy"/>
  tags:
    - always

- name: Set Password Minimum Age
  lineinfile:
    create: true
    dest: /etc/login.defs
    regexp: ^#?PASS_MIN_DAYS
    line: PASS_MIN_DAYS {{ var_accounts_minimum_age_login_defs }}
  when: '"login" in ansible_facts.packages'
  tags:
    - CJIS-5.6.2.1.1
    - NIST-800-171-3.5.8
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(1)(d)
    - NIST-800-53-IA-5(f)
    - accounts_minimum_age_login_defs
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-export export-name="oval:ssg-var_accounts_minimum_age_login_defs:var:1" value-id="xccdf_org.ssgproject.content_value_var_accounts_minimum_age_login_defs"/>
              <check-content-ref name="oval:ssg-accounts_minimum_age_login_defs:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-accounts_minimum_age_login_defs_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_accounts_maximum_age_login_defs" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Set Password Maximum Age</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To specify password maximum age for new accounts,
edit the file <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/login.defs</html:code>
and add or correct the following line:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml" xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2">PASS_MAX_DAYS <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_maximum_age_login_defs" use="legacy"/></html:pre>
A value of 180 days is sufficient for many environments.
The DoD requirement is 60.
The profile requirement is <html:code xmlns:html="http://www.w3.org/1999/xhtml" xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2"><xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_maximum_age_login_defs" use="legacy"/></html:code>.</description>
            <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.6.2.1</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.5.6</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000199</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(f)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(1)(d)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</reference>
            <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-8.2.4</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000076-GPOS-00044</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.2.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.10</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.10</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.18.1.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.7.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.2.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.2.6</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.3.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.3</reference>
            <reference href="https://www.cisecurity.org/controls/">1</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">5</reference>
            <reference href="">0418</reference>
            <reference href="">1055</reference>
            <reference href="">1402</reference>
            <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R18)</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Any password, no matter how complex, can eventually be cracked. Therefore, passwords
need to be changed periodically. If the operating system does not limit the lifetime
of passwords and force users to change their passwords, there is the risk that the
operating system passwords could be compromised.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Setting the password maximum age ensures users are required to
periodically change their passwords. Requiring shorter password lifetimes
increases the risk of users writing down the password in a convenient
location subject to physical compromise.</rationale>
            <platform idref="cpe:/a:login_defs"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="accounts_maximum_age_login_defs" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q login; then


var_accounts_maximum_age_login_defs="<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_accounts_maximum_age_login_defs" use="legacy"/>"



grep -q ^PASS_MAX_DAYS /etc/login.defs &amp;&amp; \
  sed -i "s/PASS_MAX_DAYS.*/PASS_MAX_DAYS     $var_accounts_maximum_age_login_defs/g" /etc/login.defs
if ! [ $? -eq 0 ]; then
    echo "PASS_MAX_DAYS      $var_accounts_maximum_age_login_defs" &gt;&gt; /etc/login.defs
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="accounts_maximum_age_login_defs" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - CJIS-5.6.2.1
    - NIST-800-171-3.5.6
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(1)(d)
    - NIST-800-53-IA-5(f)
    - PCI-DSS-Req-8.2.4
    - accounts_maximum_age_login_defs
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
- name: XCCDF Value var_accounts_maximum_age_login_defs # promote to variable
  set_fact:
    var_accounts_maximum_age_login_defs: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_accounts_maximum_age_login_defs" use="legacy"/>
  tags:
    - always

- name: Set Password Maximum Age
  lineinfile:
    create: true
    dest: /etc/login.defs
    regexp: ^#?PASS_MAX_DAYS
    line: PASS_MAX_DAYS {{ var_accounts_maximum_age_login_defs }}
  when: '"login" in ansible_facts.packages'
  tags:
    - CJIS-5.6.2.1
    - NIST-800-171-3.5.6
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(1)(d)
    - NIST-800-53-IA-5(f)
    - PCI-DSS-Req-8.2.4
    - accounts_maximum_age_login_defs
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-export export-name="oval:ssg-var_accounts_maximum_age_login_defs:var:1" value-id="xccdf_org.ssgproject.content_value_var_accounts_maximum_age_login_defs"/>
              <check-content-ref name="oval:ssg-accounts_maximum_age_login_defs:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-accounts_maximum_age_login_defs_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_accounts_password_minlen_login_defs" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Set Password Minimum Length in login.defs</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To specify password length requirements for new accounts, edit the file
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/login.defs</html:code> and add or correct the following line:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml" xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2">PASS_MIN_LEN <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_password_minlen_login_defs" use="legacy"/></html:pre>
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
The DoD requirement is <html:code xmlns:html="http://www.w3.org/1999/xhtml">15</html:code>.
The FISMA requirement is <html:code xmlns:html="http://www.w3.org/1999/xhtml">12</html:code>.
The profile requirement is
<html:code xmlns:html="http://www.w3.org/1999/xhtml" xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2"><xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_password_minlen_login_defs" use="legacy"/></html:code>.
If a program consults <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/login.defs</html:code> and also another PAM module
(such as <html:code xmlns:html="http://www.w3.org/1999/xhtml">pam_pwquality</html:code>) during a password change operation, then
the most restrictive must be satisfied. See PAM section for more
information about enforcing password quality requirements.</description>
            <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.6.2.1</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.5.7</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(f)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(1)(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</reference>
            <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_MOF_EXT.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.2.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.10</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.10</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.18.1.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.7.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.2.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.2.6</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.3.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.3</reference>
            <reference href="https://www.cisecurity.org/controls/">1</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">5</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000078-GPOS-00046</reference>
            <reference href="">0421</reference>
            <reference href="">0422</reference>
            <reference href="">0431</reference>
            <reference href="">0974</reference>
            <reference href="">1173</reference>
            <reference href="">1401</reference>
            <reference href="">1504</reference>
            <reference href="">1505</reference>
            <reference href="">1546</reference>
            <reference href="">1557</reference>
            <reference href="">1558</reference>
            <reference href="">1559</reference>
            <reference href="">1560</reference>
            <reference href="">1561</reference>
            <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R18)</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000205</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Requiring a minimum password length makes password
cracking attacks more difficult by ensuring a larger
search space. However, any security benefit from an onerous requirement
must be carefully weighed against usability problems, support costs, or counterproductive
behavior that may result.</rationale>
            <platform idref="cpe:/a:login_defs"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="accounts_password_minlen_login_defs" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q login; then


declare var_accounts_password_minlen_login_defs
var_accounts_password_minlen_login_defs="<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_accounts_password_minlen_login_defs" use="legacy"/>"



grep -q ^PASS_MIN_LEN /etc/login.defs &amp;&amp; \
sed -i "s/PASS_MIN_LEN.*/PASS_MIN_LEN\t$var_accounts_password_minlen_login_defs/g" /etc/login.defs
if ! [ $? -eq 0 ]
then
  echo -e "PASS_MIN_LEN\t$var_accounts_password_minlen_login_defs" &gt;&gt; /etc/login.defs
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="accounts_password_minlen_login_defs" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - CJIS-5.6.2.1
    - NIST-800-171-3.5.7
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(1)(a)
    - NIST-800-53-IA-5(f)
    - accounts_password_minlen_login_defs
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
- name: XCCDF Value var_accounts_password_minlen_login_defs # promote to variable
  set_fact:
    var_accounts_password_minlen_login_defs: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_accounts_password_minlen_login_defs" use="legacy"/>
  tags:
    - always

- name: Set Password Minimum Length in login.defs
  lineinfile:
    dest: /etc/login.defs
    regexp: ^PASS_MIN_LEN *[0-9]*
    state: present
    line: PASS_MIN_LEN        {{ var_accounts_password_minlen_login_defs }}
    create: true
  when: '"login" in ansible_facts.packages'
  tags:
    - CJIS-5.6.2.1
    - NIST-800-171-3.5.7
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(1)(a)
    - NIST-800-53-IA-5(f)
    - accounts_password_minlen_login_defs
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-export export-name="oval:ssg-var_accounts_password_minlen_login_defs:var:1" value-id="xccdf_org.ssgproject.content_value_var_accounts_password_minlen_login_defs"/>
              <check-content-ref name="oval:ssg-accounts_password_minlen_login_defs:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-accounts_password_minlen_login_defs_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
        </Group>
        <Group id="xccdf_org.ssgproject.content_group_root_logins">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Restrict Root Logins</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Direct root logins should be allowed only for emergency use.
In normal situations, the administrator should access the system
via a unique unprivileged account, and then use <html:code xmlns:html="http://www.w3.org/1999/xhtml">su</html:code> or <html:code xmlns:html="http://www.w3.org/1999/xhtml">sudo</html:code> to execute
privileged commands. Discouraging administrators from accessing the
root account directly ensures an audit trail in organizations with
multiple administrators. Locking down the channels through which
root can connect directly also reduces opportunities for
password-guessing against the root account. The <html:code xmlns:html="http://www.w3.org/1999/xhtml">login</html:code> program
uses the file <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/securetty</html:code> to determine which interfaces
should allow root logins.

The virtual devices <html:code xmlns:html="http://www.w3.org/1999/xhtml">/dev/console</html:code>
and <html:code xmlns:html="http://www.w3.org/1999/xhtml">/dev/tty*</html:code> represent the system consoles (accessible via
the Ctrl-Alt-F1 through Ctrl-Alt-F6 keyboard sequences on a default
installation). The default securetty file also contains <html:code xmlns:html="http://www.w3.org/1999/xhtml">/dev/vc/*</html:code>.
These are likely to be deprecated in most environments, but may be retained
for compatibility. Root should also be prohibited from connecting
via network protocols. Other sections of this document
include guidance describing how to prevent root from logging in via SSH.</description>
          <Rule id="xccdf_org.ssgproject.content_rule_use_pam_wheel_for_su" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Enforce usage of pam_wheel for su authentication</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To ensure that only users who are members of the <html:code xmlns:html="http://www.w3.org/1999/xhtml">wheel</html:code> group can
run commands with altered privileges through the <html:code xmlns:html="http://www.w3.org/1999/xhtml">su</html:code> command, make
sure that the following line exists in the file <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/pam.d/su</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">auth             required        pam_wheel.so use_uid</html:pre></description>
            <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_SMF_EXT.1.1</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000373-GPOS-00156</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000312-GPOS-00123</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">su</html:code> program allows to run commands with a substitute user and
group ID. It is commonly used to run commands as the root user. Limiting
access to such command is considered a good security practice.</rationale>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="use_pam_wheel_for_su" system="urn:xccdf:fix:script:sh">#!/bin/bash

# uncomment the option if commented
  sed '/^[[:space:]]*#[[:space:]]*auth[[:space:]]\+required[[:space:]]\+pam_wheel\.so[[:space:]]\+use_uid$/s/^[[:space:]]*#//' -i /etc/pam.d/su
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="use_pam_wheel_for_su" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: restrict usage of su command only to members of wheel group
  replace:
    path: /etc/pam.d/su
    regexp: ^[\s]*#[\s]*auth[\s]+required[\s]+pam_wheel\.so[\s]+use_uid$
    replace: auth             required        pam_wheel.so use_uid
  tags:
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - use_pam_wheel_for_su
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-use_pam_wheel_for_su:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-use_pam_wheel_for_su_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_securetty_root_login_console_only" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Restrict Virtual Console Root Logins</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To restrict root logins through the (deprecated) virtual console devices,
ensure lines of this form do not appear in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/securetty</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">vc/1
vc/2
vc/3
vc/4</html:pre></description>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.1</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.5</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000770</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(B)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(7)(i)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(7)(ii)(A)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(1)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(i)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(ii)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(iii)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(c)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(1)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(2)(iii)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.10.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.1.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.1.5</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.1.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.7.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.7.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.7.3.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.8.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.8.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.5</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">13</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">18</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">5</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000324-GPOS-00125</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Preventing direct root login to virtual console devices
helps ensure accountability for actions taken on the system
using the root account.</rationale>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="securetty_root_login_console_only" system="urn:xccdf:fix:script:sh">sed -i '/^vc\//d' /etc/securetty
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="securetty_root_login_console_only" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Restrict Virtual Console Root Logins
  lineinfile:
    dest: /etc/securetty
    regexp: ^vc
    state: absent
  tags:
    - NIST-800-171-3.1.1
    - NIST-800-171-3.1.5
    - NIST-800-53-AC-6
    - NIST-800-53-CM-6(a)
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - securetty_root_login_console_only
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-securetty_root_login_console_only:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-securetty_root_login_console_only_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_restrict_serial_port_logins" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Restrict Serial Port Root Logins</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To restrict root logins on serial ports,
ensure lines of this form do not appear in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/securetty</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">ttyS0
ttyS1</html:pre></description>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.1</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.5</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000770</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(B)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(7)(i)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(7)(ii)(A)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(1)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(i)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(ii)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(iii)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(c)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(1)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(2)(iii)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.10.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.1.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.1.5</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.1.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.7.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.7.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.7.3.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.8.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.8.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.5</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">13</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">18</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">5</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Preventing direct root login to serial port interfaces
helps ensure accountability for actions taken on the systems
using the root account.</rationale>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="restrict_serial_port_logins" system="urn:xccdf:fix:script:sh">sed -i '/ttyS/d' /etc/securetty
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="restrict_serial_port_logins" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Restrict Serial Port Root Logins
  lineinfile:
    dest: /etc/securetty
    regexp: ttyS[0-9]
    state: absent
  tags:
    - NIST-800-171-3.1.1
    - NIST-800-171-3.1.5
    - NIST-800-53-AC-6
    - NIST-800-53-CM-6(a)
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_serial_port_logins
    - restrict_strategy
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-restrict_serial_port_logins:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-restrict_serial_port_logins_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_no_shelllogin_for_systemaccounts" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure that System Accounts Do Not Run a Shell Upon Login</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Some accounts are not associated with a human user of the system, and exist to
perform some administrative function. Should an attacker be able to log into
these accounts, they should not be granted access to a shell.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
The login shell for each local account is stored in the last field of each line
in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/passwd</html:code>. System accounts are those user accounts with a user ID
less than UID_MIN, where value of UID_MIN directive is set in
/etc/login.defs configuration file. In the default configuration UID_MIN is set
to 1000, thus system accounts are those user accounts with a user ID less than
1000. The user ID is stored in the third field. If any system account
<html:i xmlns:html="http://www.w3.org/1999/xhtml">SYSACCT</html:i> (other than root) has a login shell, disable it with the
command: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo usermod -s /sbin/nologin <html:i>SYSACCT</html:i></html:pre></description>
            <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="functionality">Do not perform the steps in this section on the root account. Doing so might
cause the system to become inaccessible.</warning>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.2.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.03</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.7.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.2.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.2.6</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.3.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.5</reference>
            <reference href="https://www.cisecurity.org/controls/">1</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">13</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">18</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">5</reference>
            <reference href="https://www.cisecurity.org/controls/">7</reference>
            <reference href="https://www.cisecurity.org/controls/">8</reference>
            <reference href="">1491</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensuring shells are not given to system accounts upon login makes it more
difficult for attackers to make use of system accounts.</rationale>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-no_shelllogin_for_systemaccounts:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-no_shelllogin_for_systemaccounts_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_no_direct_root_logins" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Direct root Logins Not Allowed</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To further limit access to the <html:code xmlns:html="http://www.w3.org/1999/xhtml">root</html:code> account, administrators
can disable root logins at the console by editing the <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/securetty</html:code> file.
This file lists all devices the root user is allowed to login to. If the file does
not exist at all, the root user can login through any communication device on the
system, whether via the console or via a raw network interface. This is dangerous
as user can login to the system as root via Telnet, which sends the password in
plain text over the network. By default, Fedora's
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/securetty</html:code> file only allows the root user to login at the console
physically attached to the system. To prevent root from logging in, remove the
contents of this file. To prevent direct root logins, remove the contents of this
file by typing the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">
$ sudo echo &gt; /etc/securetty
</html:pre></description>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.1</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.6</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(B)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(7)(i)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(7)(ii)(A)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(1)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(i)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(ii)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(iii)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(c)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(1)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(2)(iii)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-2</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.2.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.10</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.10</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.18.1.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.7.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.2.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.2.6</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.3.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.3</reference>
            <reference href="https://www.cisecurity.org/controls/">1</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">5</reference>
            <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R19)</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disabling direct root logins ensures proper accountability and multifactor
authentication to privileged accounts. Users will first login, then escalate
to privileged (root) access via su / sudo. This is required for FISMA Low
and FISMA Moderate systems.</rationale>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="no_direct_root_logins" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

echo &gt; /etc/securetty

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="no_direct_root_logins" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Direct root Logins Not Allowed
  copy:
    dest: /etc/securetty
    content: ''
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.1
    - NIST-800-171-3.1.6
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-2
    - low_complexity
    - low_disruption
    - medium_severity
    - no_direct_root_logins
    - no_reboot_needed
    - restrict_strategy
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="no_direct_root_logins" system="urn:xccdf:fix:script:kubernetes">apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,
        mode: 0600
        path: /etc/securetty
        overwrite: true
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-no_direct_root_logins:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-no_direct_root_logins_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_accounts_no_uid_except_zero" selected="false" role="full" severity="high">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Verify Only Root Has UID 0</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">If any account other than root has a UID of 0, this misconfiguration should
be investigated and the accounts other than root should be removed or have
their UID changed.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
If the account is associated with system commands or applications the UID
should be changed to one greater than "0" but less than "1000."
Otherwise assign a UID greater than "1000" that has not already been
assigned.</description>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.1</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.5</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-2</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(5)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-4(b)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.2.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.10</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.10</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.10.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.1.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.1.5</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.1.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.18.1.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.7.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.7.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.7.3.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.8.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.8.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.2.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.2.6</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.3.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.5</reference>
            <reference href="https://www.cisecurity.org/controls/">1</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">13</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">18</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">5</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">An account has root authority if it has a UID of 0. Multiple accounts
with a UID of 0 afford more opportunity for potential intruders to
guess a password for a privileged account. Proper configuration of
sudo is recommended to afford multiple system administrators
access to root privileges in an accountable manner.</rationale>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-accounts_no_uid_except_zero:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-accounts_no_uid_except_zero_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_no_root_webbrowsing" selected="false" role="full" severity="unknown">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Restrict Web Browser Use for Administrative Accounts</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Enforce policy requiring administrative accounts use web browsers only for
local service administration.</description>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">If a browser vulnerability is exploited while running with administrative privileges,
the entire system could be compromised. Specific exceptions for local service
administration should be documented in site-defined policy.</rationale>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-no_root_webbrowsing_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_no_password_auth_for_systemaccounts" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure that System Accounts Are Locked</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Some accounts are not associated with a human user of the system, and exist to
perform some administrative function. An attacker should not be able to log into
these accounts.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
System accounts are those user accounts with a user ID
less than UID_MIN, where value of the UID_MIN directive is set in
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/login.defs</html:code> configuration file. In the default configuration UID_MIN is set
to 500, thus system accounts are those user accounts with a user ID less than
500. If any system account <html:i xmlns:html="http://www.w3.org/1999/xhtml">SYSACCT</html:i> (other than root) has an unlocked password,
disable it with the command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo passwd -l <html:i>SYSACCT</html:i></html:pre></description>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disabling authentication for default system accounts makes it more difficult
for attackers to make use of them to compromise a system.false</rationale>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-no_password_auth_for_systemaccounts_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_root_path_default" selected="false" role="full" severity="unknown">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Root Path Must Be Vendor Default</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Assuming root shell is bash, edit the following files:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">~/.profile</html:pre>
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">~/.bashrc</html:pre>
Change any <html:code xmlns:html="http://www.w3.org/1999/xhtml">PATH</html:code> variables to the vendor default for root and remove any
empty <html:code xmlns:html="http://www.w3.org/1999/xhtml">PATH</html:code> entries or references to relative paths.</description>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.3</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI03.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI03.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI03.03</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.5</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.1.5</reference>
            <reference href="https://www.cisecurity.org/controls/">18</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The root account's executable search path must be the vendor default, and must
contain only absolute paths.</rationale>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-root_path_default_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
        </Group>
        <Group id="xccdf_org.ssgproject.content_group_password_storage">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Verify Proper Storage and Existence of Password
Hashes</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">By default, password hashes for local accounts are stored
in the second field (colon-separated) in
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/shadow</html:code>. This file should be readable only by
processes running with root credentials, preventing users from
casually accessing others' password hashes and attempting
to crack them.
However, it remains possible to misconfigure the system
and store password hashes
in world-readable files such as <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/passwd</html:code>, or
to even store passwords themselves in plaintext on the system.
Using system-provided tools for password change/creation
should allow administrators to avoid such misconfiguration.</description>
          <Value id="xccdf_org.ssgproject.content_value_var_password_pam_unix_rounds" type="number">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Password Hashing algorithm</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Specify the number of SHA rounds for the system password encryption algorithm.
Defines the value set in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/pam.d/system-auth</html:code> and <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/pam.d/password-auth</html:code></description>
            <value>5000</value>
            <value selector="5000">5000</value>
            <value selector="65536">65536</value>
          </Value>
          <Rule id="xccdf_org.ssgproject.content_rule_gid_passwd_group_same" selected="false" role="full" severity="low">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">All GIDs referenced in /etc/passwd must be defined in /etc/group</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Add a group to the system for each GID referenced without a corresponding group.</description>
            <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.2</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000764</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-2</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</reference>
            <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-8.5.a</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000104-GPOS-00051</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.2.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.10</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.10</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.18.1.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.7.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.2.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.2.6</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.3.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.3</reference>
            <reference href="https://www.cisecurity.org/controls/">1</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">5</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">If a user is assigned the Group Identifier (GID) of a group not existing on the system, and a group
with the Gruop Identifier (GID) is subsequently created, the user may have unintended rights to
any files associated with the group.</rationale>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-gid_passwd_group_same:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-gid_passwd_group_same_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_no_legacy_plus_entries_etc_shadow" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure there are no legacy + NIS entries in /etc/shadow</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">+</html:code> character in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/shadow</html:code> file marks a place where
entries from a network information service (NIS) should be directly inserted.</description>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Using this method to include entries into <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/shadow</html:code> is considered legacy
and should be avoided. These entries may provide a way for an attacker
to gain access to the system.</rationale>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="no_legacy_plus_entries_etc_shadow" system="urn:xccdf:fix:script:sh">
if grep -q '^\+' /etc/shadow; then
# backup old file to /etc/shadow-
	cp /etc/shadow /etc/shadow-
	sed -i '/^\+.*$/d' /etc/shadow
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="no_legacy_plus_entries_etc_shadow" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="medium" strategy="restrict">- name: Backup the old /etc/shadow file
  copy:
    src: /etc/shadow
    dest: /etc/shadow-
    remote_src: true
  tags:
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_legacy_plus_entries_etc_shadow
    - no_reboot_needed
    - restrict_strategy

- name: Remove lines starting with + from /etc/shadow
  lineinfile:
    regexp: ^\+.*$
    state: absent
    path: /etc/shadow
  tags:
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_legacy_plus_entries_etc_shadow
    - no_reboot_needed
    - restrict_strategy
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-no_legacy_plus_entries_etc_shadow:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-no_legacy_plus_entries_etc_shadow_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_no_netrc_files" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Verify No netrc Files Exist</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">.netrc</html:code> files contain login information
used to auto-login into FTP servers and reside in the user's home
directory. These files may contain unencrypted passwords to
remote FTP servers making them susceptible to access by unauthorized
users and should not be used.  Any <html:code xmlns:html="http://www.w3.org/1999/xhtml">.netrc</html:code> files should be removed.</description>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000196</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(h)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(1)(c)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(7)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.11</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.12</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.2.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.10</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.06</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.10</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.18.1.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.7.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.2.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.2.6</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.3.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.5</reference>
            <reference href="https://www.cisecurity.org/controls/">1</reference>
            <reference href="https://www.cisecurity.org/controls/">11</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">18</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">5</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Unencrypted passwords for remote FTP servers may be stored in <html:code xmlns:html="http://www.w3.org/1999/xhtml">.netrc</html:code>
files. </rationale>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-no_netrc_files:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-no_netrc_files_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_accounts_password_all_shadowed" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Verify All Account Password Hashes are Shadowed</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">If any password hashes are stored in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/passwd</html:code> (in the second field,
instead of an <html:code xmlns:html="http://www.w3.org/1999/xhtml">x</html:code> or <html:code xmlns:html="http://www.w3.org/1999/xhtml">*</html:code>), the cause of this misconfiguration should be
investigated. The account should have its password reset and the hash should be
properly stored, or the account should be deleted entirely.</description>
            <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.2</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.5.10</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(h)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</reference>
            <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-8.2.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.2.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.10</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.10</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.18.1.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.7.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.2.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.2.6</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.3.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.3</reference>
            <reference href="https://www.cisecurity.org/controls/">1</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">5</reference>
            <reference href="">1410</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The hashes for all user account passwords should be stored in
the file <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/shadow</html:code> and never in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/passwd</html:code>,
which is readable by all users.</rationale>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-accounts_password_all_shadowed:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-accounts_password_all_shadowed_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_no_empty_passwords" selected="false" role="full" severity="high">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Prevent Login to Accounts With Empty Password</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">If an account is configured for password authentication
but does not have an assigned password, it may be possible to log
into the account without authentication. Remove any instances of the
<html:code xmlns:html="http://www.w3.org/1999/xhtml">nullok</html:code> in

<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/pam.d/system-auth</html:code>

to prevent logins with empty passwords.</description>
            <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.2</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.1</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.5</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(B)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(7)(i)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(7)(ii)(A)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(1)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(i)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(ii)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(iii)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(c)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(1)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(2)(iii)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(1)(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(c)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</reference>
            <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FIA_UAU.1</reference>
            <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-8.2.3</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.2.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.10</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.10</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.10.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.1.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.1.5</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.1.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.18.1.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.7.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.7.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.7.3.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.8.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.8.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.2.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.2.6</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.3.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.5</reference>
            <reference href="https://www.cisecurity.org/controls/">1</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">13</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">18</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">5</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">If an account has an empty password, anyone could log in and
run commands with the privileges of that account. Accounts with
empty passwords should never be used in operational environments.</rationale>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="no_empty_passwords" system="urn:xccdf:fix:script:sh">sed --follow-symlinks -i 's/\&lt;nullok\&gt;//g' /etc/pam.d/system-auth
sed --follow-symlinks -i 's/\&lt;nullok\&gt;//g' /etc/pam.d/password-auth
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="no_empty_passwords" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="medium" strategy="configure">- name: Prevent Log In to Accounts With Empty Password - system-auth
  replace:
    dest: /etc/pam.d/system-auth
    regexp: nullok
  tags:
    - CJIS-5.5.2
    - NIST-800-171-3.1.1
    - NIST-800-171-3.1.5
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(1)(a)
    - NIST-800-53-IA-5(c)
    - PCI-DSS-Req-8.2.3
    - configure_strategy
    - high_severity
    - low_complexity
    - medium_disruption
    - no_empty_passwords
    - no_reboot_needed

- name: Prevent Log In to Accounts With Empty Password - password-auth
  replace:
    dest: /etc/pam.d/password-auth
    regexp: nullok
  tags:
    - CJIS-5.5.2
    - NIST-800-171-3.1.1
    - NIST-800-171-3.1.5
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(1)(a)
    - NIST-800-53-IA-5(c)
    - PCI-DSS-Req-8.2.3
    - configure_strategy
    - high_severity
    - low_complexity
    - medium_disruption
    - no_empty_passwords
    - no_reboot_needed
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="no_empty_passwords" system="urn:xccdf:fix:script:kubernetes">apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
        mode: 0644
        path: /etc/pam.d/password-auth
        overwrite: true
      - contents:
          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
        mode: 0644
        path: /etc/pam.d/system-auth
        overwrite: true
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-no_empty_passwords:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-no_empty_passwords_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_accounts_password_pam_unix_rounds_password_auth" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Set number of Password Hashing Rounds - password-auth</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Configure the number or rounds for the password hashing algorithm. This can be
accomplished by using the <html:code xmlns:html="http://www.w3.org/1999/xhtml">rounds</html:code> option for the <html:code xmlns:html="http://www.w3.org/1999/xhtml">pam_unix</html:code> PAM module.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
In file <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/pam.d/password-auth</html:code> append <html:code xmlns:html="http://www.w3.org/1999/xhtml" xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2">rounds=<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_password_pam_unix_rounds" use="legacy"/></html:code>
to the <html:code xmlns:html="http://www.w3.org/1999/xhtml">pam_unix.so</html:code> file, as shown below:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml" xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2">password sufficient pam_unix.so <html:i>...existing_options...</html:i> rounds=<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_password_pam_unix_rounds" use="legacy"/></html:pre>
The system's default number of rounds is 5000.</description>
            <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="performance">Setting a high number of hashing rounds makes it more difficult to brute force the password,
but requires more CPU resources to authenticate users.</warning>
            <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R32)</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000073-GPOS-00041</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000196</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Using a higher number of rounds makes password cracking attacks more difficult.</rationale>
            <platform idref="cpe:/a:pam"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="accounts_password_pam_unix_rounds_password_auth" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q pam; then


var_password_pam_unix_rounds="<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_password_pam_unix_rounds" use="legacy"/>"



pamFile="/etc/pam.d/password-auth"

if grep -q "rounds=" $pamFile; then
    sed -iP --follow-symlinks "/password[[:space:]]\+sufficient[[:space:]]\+pam_unix\.so/ \
                                    s/rounds=[[:digit:]]\+/rounds=$var_password_pam_unix_rounds/" $pamFile
else
    sed -iP --follow-symlinks "/password[[:space:]]\+sufficient[[:space:]]\+pam_unix\.so/ s/$/ rounds=$var_password_pam_unix_rounds/" $pamFile
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="accounts_password_pam_unix_rounds_password_auth" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="medium" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - accounts_password_pam_unix_rounds_password_auth
    - configure_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
- name: XCCDF Value var_password_pam_unix_rounds # promote to variable
  set_fact:
    var_password_pam_unix_rounds: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_password_pam_unix_rounds" use="legacy"/>
  tags:
    - always

- name: Configure number of password-auth password hashing rounds in pam_unix.so
  pamd:
    name: password-auth
    type: password
    control: sufficient
    module_path: pam_unix.so
    module_arguments: rounds={{ var_password_pam_unix_rounds }}
    state: args_present
  when: '"pam" in ansible_facts.packages'
  tags:
    - accounts_password_pam_unix_rounds_password_auth
    - configure_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-export export-name="oval:ssg-var_password_pam_unix_rounds:var:1" value-id="xccdf_org.ssgproject.content_value_var_password_pam_unix_rounds"/>
              <check-content-ref name="oval:ssg-accounts_password_pam_unix_rounds_password_auth:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-accounts_password_pam_unix_rounds_password_auth_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_no_legacy_plus_entries_etc_passwd" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure there are no legacy + NIS entries in /etc/passwd</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">+</html:code> character in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/passwd</html:code> file marks a place where
entries from a network information service (NIS) should be directly inserted.</description>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Using this method to include entries into <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/passwd</html:code> is considered legacy
and should be avoided. These entries may provide a way for an attacker
to gain access to the system.</rationale>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="no_legacy_plus_entries_etc_passwd" system="urn:xccdf:fix:script:sh">
if grep -q '^\+' /etc/passwd; then
# backup old file to /etc/passwd-
	cp /etc/passwd /etc/passwd-
	sed -i '/^\+.*$/d' /etc/passwd
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="no_legacy_plus_entries_etc_passwd" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="medium" strategy="restrict">- name: Backup the old /etc/passwd file
  copy:
    src: /etc/passwd
    dest: /etc/passwd-
    remote_src: true
  tags:
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_legacy_plus_entries_etc_passwd
    - no_reboot_needed
    - restrict_strategy

- name: Remove lines starting with + from /etc/passwd
  lineinfile:
    regexp: ^\+.*$
    state: absent
    path: /etc/passwd
  tags:
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_legacy_plus_entries_etc_passwd
    - no_reboot_needed
    - restrict_strategy
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-no_legacy_plus_entries_etc_passwd:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-no_legacy_plus_entries_etc_passwd_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_accounts_password_pam_unix_rounds_system_auth" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Set number of Password Hashing Rounds - system-auth</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Configure the number or rounds for the password hashing algorithm. This can be
accomplished by using the <html:code xmlns:html="http://www.w3.org/1999/xhtml">rounds</html:code> option for the <html:code xmlns:html="http://www.w3.org/1999/xhtml">pam_unix</html:code> PAM module.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
In file <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/pam.d/system-auth</html:code> append <html:code xmlns:html="http://www.w3.org/1999/xhtml" xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2">rounds=<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_password_pam_unix_rounds" use="legacy"/></html:code>
to the <html:code xmlns:html="http://www.w3.org/1999/xhtml">pam_unix.so</html:code> file, as shown below:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml" xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2">password sufficient pam_unix.so <html:i>...existing_options...</html:i> rounds=<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_password_pam_unix_rounds" use="legacy"/></html:pre>
The system's default number of rounds is 5000.</description>
            <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="performance">Setting a high number of hashing rounds makes it more difficult to brute force the password,
but requires more CPU resources to authenticate users.</warning>
            <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R32)</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000073-GPOS-00041</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000196</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Using a higher number of rounds makes password cracking attacks more difficult.</rationale>
            <platform idref="cpe:/a:pam"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="accounts_password_pam_unix_rounds_system_auth" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q pam; then


var_password_pam_unix_rounds="<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_password_pam_unix_rounds" use="legacy"/>"



pamFile="/etc/pam.d/system-auth"

if grep -q "rounds=" $pamFile; then
    sed -iP --follow-symlinks "/password[[:space:]]\+sufficient[[:space:]]\+pam_unix\.so/ \
                                    s/rounds=[[:digit:]]\+/rounds=$var_password_pam_unix_rounds/" $pamFile
else
    sed -iP --follow-symlinks "/password[[:space:]]\+sufficient[[:space:]]\+pam_unix\.so/ s/$/ rounds=$var_password_pam_unix_rounds/" $pamFile
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="accounts_password_pam_unix_rounds_system_auth" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="medium" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - accounts_password_pam_unix_rounds_system_auth
    - configure_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
- name: XCCDF Value var_password_pam_unix_rounds # promote to variable
  set_fact:
    var_password_pam_unix_rounds: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_password_pam_unix_rounds" use="legacy"/>
  tags:
    - always

- name: Configure number of system-auth password hashing rounds in pam_unix.so
  pamd:
    name: system-auth
    type: password
    control: sufficient
    module_path: pam_unix.so
    module_arguments: rounds={{ var_password_pam_unix_rounds }}
    state: args_present
  when: '"pam" in ansible_facts.packages'
  tags:
    - accounts_password_pam_unix_rounds_system_auth
    - configure_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-export export-name="oval:ssg-var_password_pam_unix_rounds:var:1" value-id="xccdf_org.ssgproject.content_value_var_password_pam_unix_rounds"/>
              <check-content-ref name="oval:ssg-accounts_password_pam_unix_rounds_system_auth:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-accounts_password_pam_unix_rounds_system_auth_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_no_legacy_plus_entries_etc_group" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure there are no legacy + NIS entries in /etc/group</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">+</html:code> character in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/group</html:code> file marks a place where
entries from a network information service (NIS) should be directly inserted.</description>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Using this method to include entries into <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/group</html:code> is considered legacy
and should be avoided. These entries may provide a way for an attacker
to gain access to the system.</rationale>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="no_legacy_plus_entries_etc_group" system="urn:xccdf:fix:script:sh">
if grep -q '^\+' /etc/group; then
# backup old file to /etc/group-
	cp /etc/group /etc/group-
	sed -i '/^\+.*$/d' /etc/group
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="no_legacy_plus_entries_etc_group" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="medium" strategy="restrict">- name: Backup the old /etc/group file
  copy:
    src: /etc/group
    dest: /etc/group-
    remote_src: true
  tags:
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_legacy_plus_entries_etc_group
    - no_reboot_needed
    - restrict_strategy

- name: Remove lines starting with + from /etc/group
  lineinfile:
    regexp: ^\+.*$
    state: absent
    path: /etc/group
  tags:
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_legacy_plus_entries_etc_group
    - no_reboot_needed
    - restrict_strategy
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-no_legacy_plus_entries_etc_group:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-no_legacy_plus_entries_etc_group_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
        </Group>
        <Group id="xccdf_org.ssgproject.content_group_account_expiration">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Set Account Expiration Parameters</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Accounts can be configured to be automatically disabled
after a certain time period,
meaning that they will require administrator interaction to become usable again.
Expiration of accounts after inactivity can be set for all accounts by default
and also on a per-account basis, such as for accounts that are known to be temporary.
To configure automatic expiration of an account following
the expiration of its password (that is, after the password has expired and not been changed),
run the following command, substituting <html:code xmlns:html="http://www.w3.org/1999/xhtml"><html:i>NUM_DAYS</html:i></html:code> and <html:code xmlns:html="http://www.w3.org/1999/xhtml"><html:i>USER</html:i></html:code> appropriately:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo chage -I <html:i>NUM_DAYS USER</html:i></html:pre>
Accounts, such as temporary accounts, can also be configured to expire on an explicitly-set date with the
<html:code xmlns:html="http://www.w3.org/1999/xhtml">-E</html:code> option.
The file <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/default/useradd</html:code> controls
default settings for all newly-created accounts created with the system's
normal command line utilities.</description>
          <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">This will only apply to newly created accounts</warning>
          <Value id="xccdf_org.ssgproject.content_value_var_account_disable_post_pw_expiration" type="number">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">number of days after a password expires until the account is permanently disabled</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The number of days to wait after a password expires, until the account will be permanently disabled.</description>
            <value selector="0">0</value>
            <value selector="180">180</value>
            <value selector="30">30</value>
            <value selector="35">35</value>
            <value selector="40">40</value>
            <value selector="60">60</value>
            <value selector="90">90</value>
            <value>35</value>
          </Value>
          <Rule id="xccdf_org.ssgproject.content_rule_account_temp_expire_date" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Assign Expiration Date to Temporary Accounts</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Temporary accounts are established as part of normal account activation
procedures when there is a need for short-term accounts. In the event
temporary or emergency accounts are required, configure the system to
terminate them after a documented time period. For every temporary and
emergency account, run the following command to set an expiration date on
it, substituting <html:code xmlns:html="http://www.w3.org/1999/xhtml"><html:i>USER</html:i></html:code> and <html:code xmlns:html="http://www.w3.org/1999/xhtml"><html:i>YYYY-MM-DD</html:i></html:code>
appropriately:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo chage -E <html:i>YYYY-MM-DD USER</html:i></html:pre>
<html:code xmlns:html="http://www.w3.org/1999/xhtml"><html:i>YYYY-MM-DD</html:i></html:code> indicates the documented expiration date for the
account. For U.S. Government systems, the operating system must be
configured to automatically terminate these types of accounts after a
period of 72 hours.</description>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000016</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-001682</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-2(2)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-2(3)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000123-GPOS-00064</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000002-GPOS-00002</reference>
            <reference href="">SRG-OS-000002-VMM-000020</reference>
            <reference href="">SRG-OS-000123-VMM-000620</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.2.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.03</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.7.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.2.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.2.6</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.3.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.5</reference>
            <reference href="https://www.cisecurity.org/controls/">1</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">13</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">18</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">5</reference>
            <reference href="https://www.cisecurity.org/controls/">7</reference>
            <reference href="https://www.cisecurity.org/controls/">8</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">If temporary user accounts remain active when no longer needed or for
an excessive period, these accounts may be used to gain unauthorized access.
To mitigate this risk, automated termination of all temporary accounts
must be set upon account creation.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/></rationale>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-account_temp_expire_date_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_account_use_centralized_automated_auth" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Use Centralized and Automated Authentication</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Implement an automated system for managing user accounts that minimizes the
risk of errors, either intentional or deliberate. This system
should integrate with an existing enterprise user management system, such as
one based on Identity Management tools such as Active Directory, Kerberos,
Directory Server, etc.</description>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">A comprehensive account management process that includes automation helps to
ensure the accounts designated as requiring attention are consistently and
promptly addressed. Enterprise environments make user account management
challenging and complex. A user management process requiring administrators to
manually address account management functions adds risk of potential
oversight.</rationale>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-account_use_centralized_automated_auth_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_account_disable_post_pw_expiration" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Set Account Expiration Following Inactivity</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To specify the number of days after a password expires (which
signifies inactivity) until an account is permanently disabled, add or correct
the following line in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/default/useradd</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml" xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2">INACTIVE=<html:i><xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_account_disable_post_pw_expiration" use="legacy"/></html:i></html:pre>
If a password is currently on the verge of expiration, then
<html:code xmlns:html="http://www.w3.org/1999/xhtml" xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2"><xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_account_disable_post_pw_expiration" use="legacy"/></html:code>
day(s) remain(s) until the account is automatically
disabled. However, if the password will not expire for another 60 days, then 60
days plus <html:code xmlns:html="http://www.w3.org/1999/xhtml" xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2"><xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_account_disable_post_pw_expiration" use="legacy"/></html:code> day(s) could
elapse until the account would be automatically disabled. See the
<html:code xmlns:html="http://www.w3.org/1999/xhtml">useradd</html:code> man page for more information.</description>
            <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.6.2.1.1</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.5.6</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000017</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000795</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-4(e)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-2(3)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</reference>
            <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-8.1.4</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000118-GPOS-00060</reference>
            <reference href="">SRG-OS-000003-VMM-000030</reference>
            <reference href="">SRG-OS-000118-VMM-000590</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.2.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.10</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.10</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.18.1.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.7.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.2.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.2.6</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.3.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.5</reference>
            <reference href="https://www.cisecurity.org/controls/">1</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">13</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">18</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">5</reference>
            <reference href="https://www.cisecurity.org/controls/">7</reference>
            <reference href="https://www.cisecurity.org/controls/">8</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disabling inactive accounts ensures that accounts which may not
have been responsibly removed are not available to attackers
who may have compromised their credentials.</rationale>
            <platform idref="cpe:/a:login_defs"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="account_disable_post_pw_expiration" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q login; then


var_account_disable_post_pw_expiration="<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_account_disable_post_pw_expiration" use="legacy"/>"
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_replace_or_append" use="legacy"/>
replace_or_append '/etc/default/useradd' '^INACTIVE' "$var_account_disable_post_pw_expiration" '' '%s=%s'

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="account_disable_post_pw_expiration" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - CJIS-5.6.2.1.1
    - NIST-800-171-3.5.6
    - NIST-800-53-AC-2(3)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-4(e)
    - PCI-DSS-Req-8.1.4
    - account_disable_post_pw_expiration
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
- name: XCCDF Value var_account_disable_post_pw_expiration # promote to variable
  set_fact:
    var_account_disable_post_pw_expiration: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_account_disable_post_pw_expiration" use="legacy"/>
  tags:
    - always

- name: Set Account Expiration Following Inactivity
  lineinfile:
    create: true
    dest: /etc/default/useradd
    regexp: ^INACTIVE
    line: INACTIVE={{ var_account_disable_post_pw_expiration }}
  when: '"login" in ansible_facts.packages'
  tags:
    - CJIS-5.6.2.1.1
    - NIST-800-171-3.5.6
    - NIST-800-53-AC-2(3)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-4(e)
    - PCI-DSS-Req-8.1.4
    - account_disable_post_pw_expiration
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-export export-name="oval:ssg-var_account_disable_post_pw_expiration:var:1" value-id="xccdf_org.ssgproject.content_value_var_account_disable_post_pw_expiration"/>
              <check-content-ref name="oval:ssg-account_disable_post_pw_expiration:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-account_disable_post_pw_expiration_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_account_unique_name" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure All Accounts on the System Have Unique Names</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure accounts on the system have unique names.

To ensure all accounts have unique names, run the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo getent passwd | awk -F: '{ print $1}' | uniq -d</html:pre>
If a username is returned, change or delete the username.</description>
            <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.2</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000770</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000804</reference>
            <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-8.1.1</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Unique usernames allow for accountability on the system.</rationale>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-account_unique_name:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-account_unique_name_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
        </Group>
      </Group>
      <Group id="xccdf_org.ssgproject.content_group_accounts-session">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Secure Session Configuration Files for Login Accounts</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">When a user logs into a Unix account, the system
configures the user's session by reading a number of files. Many of
these files are located in the user's home directory, and may have
weak permissions as a result of user error or misconfiguration. If
an attacker can modify or even read certain types of account
configuration information, they can often gain full access to the
affected user's account. Therefore, it is important to test and
correct configuration file permissions for interactive accounts,
particularly those of privileged users such as root or system
administrators.</description>
        <Value id="xccdf_org.ssgproject.content_value_var_accounts_fail_delay" type="number">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Maximum login attempts delay</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Maximum time in seconds between fail login attempts before re-prompting.</description>
          <value selector="1">1</value>
          <value selector="2">2</value>
          <value selector="3">3</value>
          <value selector="4">4</value>
          <value selector="5">5</value>
          <value>4</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_accounts_max_concurrent_login_sessions" type="number">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Maximum concurrent login sessions</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Maximum number of concurrent sessions by a user</description>
          <value selector="1">1</value>
          <value selector="10">10</value>
          <value selector="15">15</value>
          <value selector="20">20</value>
          <value selector="3">3</value>
          <value selector="5">5</value>
          <value>1</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_accounts_tmout" type="number">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Account Inactivity Timeout (minutes)</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">In an interactive shell, the value is interpreted as the
number of seconds to wait for input after issuing the primary prompt.
Bash terminates after waiting for that number of seconds if input does
not arrive.</description>
          <value selector="30_min">1800</value>
          <value selector="10_min">600</value>
          <value selector="15_min">900</value>
          <value selector="5_min">300</value>
          <value>600</value>
        </Value>
        <Rule id="xccdf_org.ssgproject.content_rule_accounts_polyinstantiated_tmp" selected="false" role="full" severity="low">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Configure Polyinstantiation of /tmp Directories</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To configure polyinstantiated /tmp directories, first create the parent directories
which will hold the polyinstantiation child directories. Use the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo mkdir --mode 000 /tmp/tmp-inst</html:pre>
Then, add the following entry to <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/security/namespace.conf</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">/tmp     /tmp/tmp-inst/            level      root,adm</html:pre></description>
          <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R39)</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Polyinstantiation of temporary directories is a proactive security measure
which reduces chances of attacks that are made possible by /tmp
directories being world-writable.</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="accounts_polyinstantiated_tmp" system="urn:xccdf:fix:script:sh">if ! [ -d /tmp/tmp-inst ] ; then
    mkdir --mode 000 /tmp/tmp-inst
fi
chmod 000 /tmp/tmp-inst
chcon --reference=/tmp /tmp/tmp-inst

if ! grep -Eq '^\s*/tmp\s+/tmp/tmp-inst/\s+level\s+root,adm$' /etc/security/namespace.conf ; then
    if grep -Eq '^\s*/tmp\s+' /etc/security/namespace.conf ; then
        sed -i '/^\s*\/tmp/d' /etc/security/namespace.conf
    fi
    echo "/tmp     /tmp/tmp-inst/        level      root,adm" &gt;&gt; /etc/security/namespace.conf
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="accounts_polyinstantiated_tmp" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Create /tmp/tmp-inst directory
  file:
    path: /tmp/tmp-inst
    state: directory
    mode: '000'
    seuser: system_u
    serole: object_r
    setype: tmp_t
  tags:
    - accounts_polyinstantiated_tmp
    - low_complexity
    - low_disruption
    - low_severity
    - no_reboot_needed
    - restrict_strategy

- name: Make changes to /etc/security/namespace.conf
  lineinfile:
    path: /etc/security/namespace.conf
    create: false
    regexp: ^\s*/tmp\s+/tmp/tmp-inst/\s+level\s+root,adm$
    line: /tmp     /tmp/tmp-inst/        level      root,adm
    state: present
  tags:
    - accounts_polyinstantiated_tmp
    - low_complexity
    - low_disruption
    - low_severity
    - no_reboot_needed
    - restrict_strategy
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-accounts_polyinstantiated_tmp:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-accounts_polyinstantiated_tmp_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_accounts_logon_fail_delay" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure the Logon Failure Delay is Set Correctly in login.defs</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To ensure the logon failure delay controlled by <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/login.defs</html:code> is set properly,
add or correct the <html:code xmlns:html="http://www.w3.org/1999/xhtml">FAIL_DELAY</html:code> setting in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/login.defs</html:code> to read as follows:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml" xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2">FAIL_DELAY <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_fail_delay" use="legacy"/></html:pre></description>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-7(b)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00226</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.3</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.5.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.6.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.2.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.2.4</reference>
          <reference href="https://www.cisecurity.org/controls/">11</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">9</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Increasing the time between a failed authentication attempt and re-prompting to
enter credentials helps to slow a single-threaded brute force attack.</rationale>
          <platform idref="cpe:/a:login_defs"/>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export export-name="oval:ssg-var_accounts_fail_delay:var:1" value-id="xccdf_org.ssgproject.content_value_var_accounts_fail_delay"/>
            <check-content-ref name="oval:ssg-accounts_logon_fail_delay:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-accounts_logon_fail_delay_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_accounts_max_concurrent_login_sessions" selected="false" role="full" severity="low">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Limit the Number of Concurrent Login Sessions Allowed Per User</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Limiting the number of allowed users and sessions per user can limit risks related to Denial of
Service attacks. This addresses concurrent sessions for a single account and does not address
concurrent sessions by a single user via multiple accounts. To set the number of concurrent
sessions per user add the following line in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/security/limits.conf</html:code> or
a file under <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/security/limits.d/</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml" xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2">* hard maxlogins <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_max_concurrent_login_sessions" use="legacy"/></html:pre></description>
          <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.2.2</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-000054</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-10</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-5</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000027-GPOS-00008</reference>
          <reference href="">SRG-OS-000027-VMM-000080</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.4</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS01.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.1.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">18</reference>
          <reference href="https://www.cisecurity.org/controls/">9</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Limiting simultaneous user logins can insulate the system from denial of service
problems caused by excessive logins. Automated login processes operating improperly or
maliciously may result in an exceptional number of simultaneous login sessions.</rationale>
          <platform idref="cpe:/a:pam"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="accounts_max_concurrent_login_sessions" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - CJIS-5.5.2.2
    - NIST-800-53-AC-10
    - NIST-800-53-CM-6(a)
    - accounts_max_concurrent_login_sessions
    - low_complexity
    - low_disruption
    - low_severity
    - no_reboot_needed
    - restrict_strategy
- name: XCCDF Value var_accounts_max_concurrent_login_sessions # promote to variable
  set_fact:
    var_accounts_max_concurrent_login_sessions: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_accounts_max_concurrent_login_sessions" use="legacy"/>
  tags:
    - always

- name: Find /etc/security/limits.d files containing maxlogins configuration
  find:
    paths: /etc/security/limits.d
    contains: ^[\s]*\*[\s]+(?:(?:hard)|(?:-))[\s]+maxlogins
    patterns: '*.conf'
  register: maxlogins
  when: '"pam" in ansible_facts.packages'
  tags:
    - CJIS-5.5.2.2
    - NIST-800-53-AC-10
    - NIST-800-53-CM-6(a)
    - accounts_max_concurrent_login_sessions
    - low_complexity
    - low_disruption
    - low_severity
    - no_reboot_needed
    - restrict_strategy

- name: Limit the Number of Concurrent Login Sessions Allowed Per User in files from
    limits.d
  replace:
    dest: '{{ item.path }}'
    regexp: ^#?\*.*maxlogins.*
    replace: '*          hard    maxlogins     {{ var_accounts_max_concurrent_login_sessions
      }}'
  with_items:
    - '{{ maxlogins.files }}'
  when: '"pam" in ansible_facts.packages'
  tags:
    - CJIS-5.5.2.2
    - NIST-800-53-AC-10
    - NIST-800-53-CM-6(a)
    - accounts_max_concurrent_login_sessions
    - low_complexity
    - low_disruption
    - low_severity
    - no_reboot_needed
    - restrict_strategy

- name: Limit the Number of Concurrent Login Sessions Allowed Per User
  lineinfile:
    state: present
    dest: /etc/security/limits.conf
    insertbefore: ^# End of file
    regexp: ^#?\*.*maxlogins
    line: '*          hard    maxlogins     {{ var_accounts_max_concurrent_login_sessions
      }}'
    create: true
  when:
    - '"pam" in ansible_facts.packages'
    - maxlogins.matched == 0
  tags:
    - CJIS-5.5.2.2
    - NIST-800-53-AC-10
    - NIST-800-53-CM-6(a)
    - accounts_max_concurrent_login_sessions
    - low_complexity
    - low_disruption
    - low_severity
    - no_reboot_needed
    - restrict_strategy
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export export-name="oval:ssg-var_accounts_max_concurrent_login_sessions:var:1" value-id="xccdf_org.ssgproject.content_value_var_accounts_max_concurrent_login_sessions"/>
            <check-content-ref name="oval:ssg-accounts_max_concurrent_login_sessions:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-accounts_max_concurrent_login_sessions_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_file_permissions_home_dirs" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure that User Home Directories are not Group-Writable or World-Readable</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">For each human user of the system, view the
permissions of the user's home directory:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml"># ls -ld /home/<html:i>USER</html:i></html:pre>
Ensure that the directory is not group-writable and that it
is not world-readable. If necessary, repair the permissions:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml"># chmod g-w /home/<html:i>USER</html:i>
# chmod o-rwx /home/<html:i>USER</html:i></html:pre></description>
          <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="functionality">This action may involve modifying user home directories.
Notify your user community, and solicit input if appropriate,
before making this type of change.</warning>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-000225</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.10.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.11.1.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.11.1.5</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.11.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.1.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.2.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.6.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.7.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.7.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.7.3.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.8.2.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.8.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.5</reference>
          <reference href="https://www.cisecurity.org/controls/">12</reference>
          <reference href="https://www.cisecurity.org/controls/">13</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">16</reference>
          <reference href="https://www.cisecurity.org/controls/">18</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">5</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">User home directories contain many configuration files which
affect the behavior of a user's account. No user should ever have
write permission to another user's home directory. Group shared
directories can be configured in sub-directories or elsewhere in the
filesystem if they are needed. Typically, user home directories
should not be world-readable, as it would disclose file names
to other users. If a subset of users need read access
to one another's home directories, this can be provided using
groups or ACLs.</rationale>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-file_permissions_home_dirs:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-file_permissions_home_dirs_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_accounts_have_homedir_login_defs" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure Home Directories are Created for New Users</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">All local interactive user accounts, upon creation, should be assigned a home directory.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Configure the operating system to assign home directories to all new local interactive users by setting the <html:code xmlns:html="http://www.w3.org/1999/xhtml">CREATE_HOME</html:code>
parameter in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/login.defs</html:code> to <html:code xmlns:html="http://www.w3.org/1999/xhtml">yes</html:code> as follows:
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">CREATE_HOME yes</html:pre></description>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">If local interactive users are not assigned a valid home directory, there is no place
for the storage and control of files they should own.</rationale>
          <platform idref="cpe:/a:login_defs"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="accounts_have_homedir_login_defs" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q login; then

if [ -e "/etc/login.defs" ] ; then
    LC_ALL=C sed -i "/^\s*CREATE_HOME\s\+/Id" "/etc/login.defs"
else
    touch "/etc/login.defs"
fi
cp "/etc/login.defs" "/etc/login.defs.bak"
# Insert before the line matching the regex '^\s*CREATE_HOME'.
line_number="$(LC_ALL=C grep -n "^\s*CREATE_HOME" "/etc/login.defs.bak" | LC_ALL=C sed 's/:.*//g')"
if [ -z "$line_number" ]; then
    # There was no match of '^\s*CREATE_HOME', insert at
    # the end of the file.
    printf '%s\n' "CREATE_HOME yes" &gt;&gt; "/etc/login.defs"
else
    head -n "$(( line_number - 1 ))" "/etc/login.defs.bak" &gt; "/etc/login.defs"
    printf '%s\n' "CREATE_HOME yes" &gt;&gt; "/etc/login.defs"
    tail -n "+$(( line_number ))" "/etc/login.defs.bak" &gt;&gt; "/etc/login.defs"
fi
# Clean up after ourselves.
rm "/etc/login.defs.bak"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="accounts_have_homedir_login_defs" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - accounts_have_homedir_login_defs
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Ensure new users receive home directories
  block:

    - name: Check for duplicate values
      lineinfile:
        path: /etc/login.defs
        create: false
        regexp: ^\s*CREATE_HOME\s+
        state: absent
      check_mode: true
      changed_when: false
      register: dupes

    - name: Deduplicate values from /etc/login.defs
      lineinfile:
        path: /etc/login.defs
        create: false
        regexp: ^\s*CREATE_HOME\s+
        state: absent
      when: dupes.found is defined and dupes.found &gt; 1

    - name: Insert correct line to /etc/login.defs
      lineinfile:
        path: /etc/login.defs
        create: true
        regexp: ^\s*CREATE_HOME\s+
        line: CREATE_HOME yes
        state: present
  when: '"login" in ansible_facts.packages'
  tags:
    - accounts_have_homedir_login_defs
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-accounts_have_homedir_login_defs:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-accounts_have_homedir_login_defs_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_accounts_polyinstantiated_var_tmp" selected="false" role="full" severity="low">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Configure Polyinstantiation of /var/tmp Directories</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To configure polyinstantiated /tmp directories, first create the parent directories
which will hold the polyinstantiation child directories. Use the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo mkdir --mode 000 /var/tmp/tmp-inst</html:pre>
Then, add the following entry to <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/security/namespace.conf</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">/var/tmp /var/tmp/tmp-inst/    level      root,adm</html:pre></description>
          <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R39)</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Polyinstantiation of temporary directories is a proactive security measure
which reduces chances of attacks that are made possible by /var/tmp
directories being world-writable.</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="accounts_polyinstantiated_var_tmp" system="urn:xccdf:fix:script:sh">if ! [ -d /tmp-inst ] ; then
    mkdir --mode 000 /var/tmp/tmp-inst
fi
chmod 000 /var/tmp/tmp-inst
chcon --reference=/var/tmp/ /var/tmp/tmp-inst

if ! grep -Eq '^\s*/var/tmp\s+/var/tmp/tmp-inst/\s+level\s+root,adm$' /etc/security/namespace.conf ; then
    if grep -Eq '^\s*/var/tmp\s+' /etc/security/namespace.conf ; then
        sed -i '/^\s*\/var\/tmp/d' /etc/security/namespace.conf
    fi
    echo "/var/tmp /var/tmp/tmp-inst/    level      root,adm" &gt;&gt; /etc/security/namespace.conf
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="accounts_polyinstantiated_var_tmp" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Create /var/tmp/tmp-inst directory
  file:
    path: /var/tmp/tmp-inst
    state: directory
    mode: '000'
    seuser: system_u
    serole: object_r
    setype: tmp_t
  tags:
    - accounts_polyinstantiated_var_tmp
    - low_complexity
    - low_disruption
    - low_severity
    - no_reboot_needed
    - restrict_strategy

- name: Make changes to /etc/security/namespace.conf
  lineinfile:
    path: /etc/security/namespace.conf
    create: false
    regexp: ^\s*/var/tmp\s+/var/tmp/tmp-inst/\s+level\s+root,adm$
    line: /var/tmp /var/tmp/tmp-inst/    level      root,adm
    state: present
  tags:
    - accounts_polyinstantiated_var_tmp
    - low_complexity
    - low_disruption
    - low_severity
    - no_reboot_needed
    - restrict_strategy
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-accounts_polyinstantiated_var_tmp:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-accounts_polyinstantiated_var_tmp_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_accounts_tmout" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Set Interactive Session Timeout</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Setting the <html:code xmlns:html="http://www.w3.org/1999/xhtml">TMOUT</html:code> option in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/profile</html:code> ensures that
all user sessions will terminate based on inactivity. The <html:code xmlns:html="http://www.w3.org/1999/xhtml">TMOUT</html:code>

setting in a file loaded by <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/profile</html:code>, e.g.
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/profile.d/tmout.sh</html:code> should read as follows:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml" xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2">TMOUT=<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_tmout" use="legacy"/></html:pre></description>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.11</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-000057</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-001133</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-002361</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-12</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-10</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-2(5)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</reference>
          <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_MOF_EXT.1</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000163-GPOS-00072</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000029-GPOS-00010</reference>
          <reference href="">SRG-OS-000163-VMM-000700</reference>
          <reference href="">SRG-OS-000279-VMM-001010</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.10</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.10</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.18.1.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.3.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.3</reference>
          <reference href="https://www.cisecurity.org/controls/">1</reference>
          <reference href="https://www.cisecurity.org/controls/">12</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">16</reference>
          <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R29)</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Terminating an idle session within a short time period reduces
the window of opportunity for unauthorized personnel to take control of a
management session enabled on the console or console port that has been
left unattended.</rationale>
          <platform idref="cpe:/a:machine"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="accounts_tmout" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then


var_accounts_tmout="<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_accounts_tmout" use="legacy"/>"



# if 0, no occurence of tmout found, if 1, occurence found
tmout_found=0

for f in /etc/profile /etc/profile.d/*.sh; do
    if grep --silent '^\s*TMOUT' $f; then
        sed -i -E "s/^(\s*)TMOUT\s*=\s*(\w|\$)*(.*)$/\1TMOUT=$var_accounts_tmout\3/g" $f
        $tmout_found=1
    fi
done

if [ $tmout_found -eq 0 ]; then
        echo -e "\n# Set TMOUT to $var_accounts_tmout per security requirements" &gt;&gt; /etc/profile.d/tmout.sh
        echo "TMOUT=$var_accounts_tmout" &gt;&gt; /etc/profile.d/tmout.sh
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="accounts_tmout" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: XCCDF Value var_accounts_tmout # promote to variable
  set_fact:
    var_accounts_tmout: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_accounts_tmout" use="legacy"/>
  tags:
    - always

- name: Set Interactive Session Timeout
  block:

    - name: Check for duplicate values
      lineinfile:
        path: /etc/profile.d/tmout.sh
        create: false
        regexp: ^\s*TMOUT=
        state: absent
      check_mode: true
      changed_when: false
      register: dupes

    - name: Deduplicate values from /etc/profile.d/tmout.sh
      lineinfile:
        path: /etc/profile.d/tmout.sh
        create: false
        regexp: ^\s*TMOUT=
        state: absent
      when: dupes.found is defined and dupes.found &gt; 1

    - name: Insert correct line to /etc/profile.d/tmout.sh
      lineinfile:
        path: /etc/profile.d/tmout.sh
        create: true
        regexp: ^\s*TMOUT=
        line: TMOUT={{ var_accounts_tmout }}
        state: present
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.11
    - NIST-800-53-AC-12
    - NIST-800-53-AC-2(5)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-SC-10
    - accounts_tmout
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export export-name="oval:ssg-var_accounts_tmout:var:1" value-id="xccdf_org.ssgproject.content_value_var_accounts_tmout"/>
            <check-content-ref name="oval:ssg-accounts_tmout:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-accounts_tmout_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Group id="xccdf_org.ssgproject.content_group_root_paths">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure that No Dangerous Directories Exist in Root's Path</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The active path of the root account can be obtained by
starting a new root shell and running:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml"># echo $PATH</html:pre>
This will produce a colon-separated list of
directories in the path.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Certain path elements could be considered dangerous, as they could lead
to root executing unknown or
untrusted programs, which could contain malicious
code.
Since root may sometimes work inside
untrusted directories, the <html:code xmlns:html="http://www.w3.org/1999/xhtml">.</html:code> character, which represents the
current directory, should never be in the root path, nor should any
directory which can be written to by an unprivileged or
semi-privileged (system) user.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
It is a good practice for administrators to always execute
privileged commands by typing the full path to the
command.</description>
          <Rule id="xccdf_org.ssgproject.content_rule_root_path_no_dot" selected="false" role="full" severity="unknown">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure that Root's Path Does Not Include Relative Paths or Null Directories</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure that none of the directories in root's path is equal to a single
<html:code xmlns:html="http://www.w3.org/1999/xhtml">.</html:code> character, or
that it contains any instances that lead to relative path traversal, such as
<html:code xmlns:html="http://www.w3.org/1999/xhtml">..</html:code> or beginning a path without the slash (<html:code xmlns:html="http://www.w3.org/1999/xhtml">/</html:code>) character.
Also ensure that there are no "empty" elements in the path, such as in these examples:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">PATH=:/bin
PATH=/bin:
PATH=/bin::/sbin</html:pre>
These empty elements have the same effect as a single <html:code xmlns:html="http://www.w3.org/1999/xhtml">.</html:code> character.</description>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.3</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.5.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.6.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.4</reference>
            <reference href="https://www.cisecurity.org/controls/">11</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">9</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Including these entries increases the risk that root could
execute code from an untrusted location.</rationale>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-root_path_no_dot:def:1" href="ssg-fedora-oval.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_accounts_root_path_dirs_no_write" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure that Root's Path Does Not Include World or Group-Writable Directories</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">For each element in root's path, run:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml"># ls -ld <html:i>DIR</html:i></html:pre>
and ensure that write permissions are disabled for group and
other.</description>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.3</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.5.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.6.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.4</reference>
            <reference href="https://www.cisecurity.org/controls/">11</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">9</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Such entries increase the risk that root could
execute code provided by unprivileged users,
and potentially malicious code.</rationale>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="accounts_root_path_dirs_no_write" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="medium" strategy="restrict">- name: Print error message if user is not root
  fail:
    msg: Root account required to read root $PATH
  when: ansible_user != "root"
  ignore_errors: true
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-6(a)
    - accounts_root_path_dirs_no_write
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Get root paths which are not symbolic links
  stat:
    path: '{{ item }}'
  changed_when: false
  failed_when: false
  register: root_paths
  with_items: '{{ ansible_env.PATH.split('':'') }}'
  when: ansible_user == "root"
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-6(a)
    - accounts_root_path_dirs_no_write
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Disable writability to root directories
  file:
    path: '{{ item.item }}'
    mode: g-w,o-w
  with_items: '{{ root_paths.results }}'
  when:
    - root_paths.results is defined
    - item.stat.exists
    - not item.stat.islnk
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-6(a)
    - accounts_root_path_dirs_no_write
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-accounts_root_path_dirs_no_write:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-accounts_root_path_dirs_no_write_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
        </Group>
        <Group id="xccdf_org.ssgproject.content_group_user_umask">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure that Users Have Sensible Umask Values</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The umask setting controls the default permissions
for the creation of new files.
With a default <html:code xmlns:html="http://www.w3.org/1999/xhtml">umask</html:code> setting of 077, files and directories
created by users will not be readable by any other user on the
system. Users who wish to make specific files group- or
world-readable can accomplish this by using the chmod command.
Additionally, users can make all their files readable to their
group by default by setting a <html:code xmlns:html="http://www.w3.org/1999/xhtml">umask</html:code> of 027 in their shell
configuration files. If default per-user groups exist (that is, if
every user has a default group whose name is the same as that
user's username and whose only member is the user), then it may
even be safe for users to select a <html:code xmlns:html="http://www.w3.org/1999/xhtml">umask</html:code> of 007, making it very
easy to intentionally share files with groups of which the user is
a member.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/></description>
          <Value id="xccdf_org.ssgproject.content_value_var_accounts_user_umask" type="string">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Sensible umask</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Enter default user umask</description>
            <value selector="007">007</value>
            <value selector="022">022</value>
            <value selector="027">027</value>
            <value selector="077">077</value>
            <value>027</value>
          </Value>
          <Rule id="xccdf_org.ssgproject.content_rule_accounts_umask_etc_login_defs" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure the Default Umask is Set Correctly in login.defs</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To ensure the default umask controlled by <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/login.defs</html:code> is set properly,
add or correct the <html:code xmlns:html="http://www.w3.org/1999/xhtml">UMASK</html:code> setting in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/login.defs</html:code> to read as follows:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml" xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2">UMASK <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_user_umask" use="legacy"/></html:pre></description>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-2</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00228</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.3</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI03.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI03.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI03.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.5.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.6.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.5</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.1.5</reference>
            <reference href="https://www.cisecurity.org/controls/">11</reference>
            <reference href="https://www.cisecurity.org/controls/">18</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">9</reference>
            <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R35)</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The umask value influences the permissions assigned to files when they are created.
A misconfigured umask value could result in files with excessive permissions that can be read and
written to by unauthorized users.</rationale>
            <platform idref="cpe:/a:login_defs"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="accounts_umask_etc_login_defs" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - accounts_umask_etc_login_defs
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
- name: XCCDF Value var_accounts_user_umask # promote to variable
  set_fact:
    var_accounts_user_umask: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_accounts_user_umask" use="legacy"/>
  tags:
    - always

- name: Ensure the Default UMASK is Set Correctly
  lineinfile:
    create: true
    dest: /etc/login.defs
    regexp: ^UMASK
    line: UMASK {{ var_accounts_user_umask }}
  when: '"login" in ansible_facts.packages'
  tags:
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - accounts_umask_etc_login_defs
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-export export-name="oval:ssg-var_accounts_user_umask:var:1" value-id="xccdf_org.ssgproject.content_value_var_accounts_user_umask"/>
              <check-content-ref name="oval:ssg-accounts_umask_etc_login_defs:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-accounts_umask_etc_login_defs_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_accounts_umask_etc_profile" selected="false" role="full" severity="unknown">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure the Default Umask is Set Correctly in /etc/profile</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To ensure the default umask controlled by <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/profile</html:code> is set properly,
add or correct the <html:code xmlns:html="http://www.w3.org/1999/xhtml">umask</html:code> setting in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/profile</html:code> to read as follows:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml" xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2">umask <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_user_umask" use="legacy"/></html:pre></description>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.3</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI03.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI03.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI03.03</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.5</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.1.5</reference>
            <reference href="https://www.cisecurity.org/controls/">18</reference>
            <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R35)</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00228</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The umask value influences the permissions assigned to files when they are created.
A misconfigured umask value could result in files with excessive permissions that can be read or
written to by unauthorized users.</rationale>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="accounts_umask_etc_profile" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: XCCDF Value var_accounts_user_umask # promote to variable
  set_fact:
    var_accounts_user_umask: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_accounts_user_umask" use="legacy"/>
  tags:
    - always

- name: Set user umask in /etc/profile
  replace:
    path: /etc/profile
    regexp: umask.*
    replace: umask {{ var_accounts_user_umask }}
  tags:
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - accounts_umask_etc_profile
    - low_complexity
    - low_disruption
    - no_reboot_needed
    - restrict_strategy
    - unknown_severity
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-export export-name="oval:ssg-var_accounts_user_umask:var:1" value-id="xccdf_org.ssgproject.content_value_var_accounts_user_umask"/>
              <check-content-ref name="oval:ssg-accounts_umask_etc_profile:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-accounts_umask_etc_profile_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
        </Group>
      </Group>
    </Group>
    <Group id="xccdf_org.ssgproject.content_group_auditing">
      <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">System Accounting with auditd</title>
      <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The audit service provides substantial capabilities
for recording system activities. By default, the service audits about
SELinux AVC denials and certain types of security-relevant events
such as system logins, account modifications, and authentication
events performed by programs such as sudo.
Under its default configuration, <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> has modest disk space
requirements, and should not noticeably impact system performance.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
NOTE: The Linux Audit daemon <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> can be configured to use
the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program to read audit rules files (<html:code xmlns:html="http://www.w3.org/1999/xhtml">*.rules</html:code>)
located in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code> location and compile them to create
the resulting form of the <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> configuration file
during the daemon startup (default configuration). Alternatively, the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code>
daemon can use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code> utility to read audit rules from the
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> configuration file during daemon startup,
and load them into the kernel. The expected behavior is configured via the
appropriate <html:code xmlns:html="http://www.w3.org/1999/xhtml">ExecStartPost</html:code> directive setting in the
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/usr/lib/systemd/system/auditd.service</html:code> configuration file.
To instruct the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program
to read audit rules (default configuration), use the following setting:
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/> <html:pre xmlns:html="http://www.w3.org/1999/xhtml">ExecStartPost=-/sbin/augenrules --load</html:pre>
in the <html:code xmlns:html="http://www.w3.org/1999/xhtml">/usr/lib/systemd/system/auditd.service</html:code> configuration file.
In order to instruct the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules, use the following setting:
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/> <html:pre xmlns:html="http://www.w3.org/1999/xhtml">ExecStartPost=-/sbin/auditctl -R /etc/audit/audit.rules</html:pre>
in the <html:code xmlns:html="http://www.w3.org/1999/xhtml">/usr/lib/systemd/system/auditd.service</html:code> configuration file.
Refer to <html:code xmlns:html="http://www.w3.org/1999/xhtml">[Service]</html:code> section of the <html:code xmlns:html="http://www.w3.org/1999/xhtml">/usr/lib/systemd/system/auditd.service</html:code>
configuration file for further details.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Government networks often have substantial auditing
requirements and <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> can be configured to meet these
requirements.
Examining some example audit records demonstrates how the Linux audit system
satisfies common requirements.
The following example from Fedora Documentation available at
<html:code xmlns:html="http://www.w3.org/1999/xhtml"><html:a href="https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/SELinux_Users_and_Administrators_Guide/sect-Security-Enhanced_Linux-Troubleshooting-Fixing_Problems.html#sect-Security-Enhanced_Linux-Fixing_Problems-Raw_Audit_Messages">https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/SELinux_Users_and_Administrators_Guide/sect-Security-Enhanced_Linux-Troubleshooting-Fixing_Problems.html#sect-Security-Enhanced_Linux-Fixing_Problems-Raw_Audit_Messages</html:a></html:code>
shows the substantial amount of information captured in a
two typical "raw" audit messages, followed by a breakdown of the most important
fields. In this example the message is SELinux-related and reports an AVC
denial (and the associated system call) that occurred when the Apache HTTP
Server attempted to access the <html:code xmlns:html="http://www.w3.org/1999/xhtml">/var/www/html/file1</html:code> file (labeled with
the <html:code xmlns:html="http://www.w3.org/1999/xhtml">samba_share_t</html:code> type):
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">type=AVC msg=audit(1226874073.147:96): avc:  denied  { getattr } for pid=2465 comm="httpd"
path="/var/www/html/file1" dev=dm-0 ino=284133 scontext=unconfined_u:system_r:httpd_t:s0
tcontext=unconfined_u:object_r:samba_share_t:s0 tclass=file

type=SYSCALL msg=audit(1226874073.147:96): arch=40000003 syscall=196 success=no exit=-13
a0=b98df198 a1=bfec85dc a2=54dff4 a3=2008171 items=0 ppid=2463 pid=2465 auid=502 uid=48
gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=6 comm="httpd"
exe="/usr/sbin/httpd" subj=unconfined_u:system_r:httpd_t:s0 key=(null)
</html:pre>
<html:ul xmlns:html="http://www.w3.org/1999/xhtml"><html:li><html:code>msg=audit(1226874073.147:96)</html:code><html:ul><html:li>The number in parentheses is the unformatted time stamp (Epoch time)
for the event, which can be converted to standard time by using the
<html:code>date</html:code> command.
</html:li></html:ul></html:li><html:li><html:code>{ getattr }</html:code><html:ul><html:li>The item in braces indicates the permission that was denied. <html:code>getattr</html:code>
indicates the source process was trying to read the target file's status information.
This occurs before reading files. This action is denied due to the file being
accessed having the wrong label. Commonly seen permissions include <html:code>getattr</html:code>,
<html:code>read</html:code>, and <html:code>write</html:code>.</html:li></html:ul></html:li><html:li><html:code>comm="httpd"</html:code><html:ul><html:li>The executable that launched the process. The full path of the executable is
found in the <html:code>exe=</html:code> section of the system call (<html:code>SYSCALL</html:code>) message,
which in this case, is <html:code>exe="/usr/sbin/httpd"</html:code>.
</html:li></html:ul></html:li><html:li><html:code>path="/var/www/html/file1"</html:code><html:ul><html:li>The path to the object (target) the process attempted to access.
</html:li></html:ul></html:li><html:li><html:code>scontext="unconfined_u:system_r:httpd_t:s0"</html:code><html:ul><html:li>The SELinux context of the process that attempted the denied action. In
this case, it is the SELinux context of the Apache HTTP Server, which is running
in the <html:code>httpd_t</html:code> domain.
</html:li></html:ul></html:li><html:li><html:code>tcontext="unconfined_u:object_r:samba_share_t:s0"</html:code><html:ul><html:li>The SELinux context of the object (target) the process attempted to access.
In this case, it is the SELinux context of <html:code>file1</html:code>. Note: the <html:code>samba_share_t</html:code>
type is not accessible to processes running in the <html:code>httpd_t</html:code> domain.</html:li></html:ul></html:li><html:li> From the system call (<html:code>SYSCALL</html:code>) message, two items are of interest:
<html:ul><html:li><html:code>success=no</html:code>: indicates whether the denial (AVC) was enforced or not.
<html:code>success=no</html:code> indicates the system call was not successful (SELinux denied
access). <html:code>success=yes</html:code> indicates the system call was successful - this can
be seen for permissive domains or unconfined domains, such as <html:code>initrc_t</html:code>
and <html:code>kernel_t</html:code>.
</html:li><html:li><html:code>exe="/usr/sbin/httpd"</html:code>: the full path to the executable that launched
the process, which in this case, is <html:code>exe="/usr/sbin/httpd"</html:code>.
</html:li></html:ul>
</html:li></html:ul></description>
      <platform idref="cpe:/a:machine"/>
      <Rule id="xccdf_org.ssgproject.content_rule_package_audispd-plugins_installed" selected="false" role="full" severity="medium">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Install audispd-plugins Package</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">audispd-plugins</html:code> package can be installed with the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">
$ sudo dnf install audispd-plugins</html:pre></description>
        <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000342-GPOS-00133</reference>
        <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_SMF_EXT.1</reference>
        <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US"><html:code xmlns:html="http://www.w3.org/1999/xhtml">audispd-plugins</html:code> provides plugins for the real-time interface to the
audit subsystem, <html:code xmlns:html="http://www.w3.org/1999/xhtml">audispd</html:code>. These plugins can do things like relay events
to remote machines or analyze events for suspicious behavior.</rationale>
        <platform idref="cpe:/a:machine"/>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_audispd-plugins_installed" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="enable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

if ! rpm -q --quiet "audispd-plugins" ; then
    dnf install -y "audispd-plugins"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_audispd-plugins_installed" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="enable">- name: Ensure audispd-plugins is installed
  package:
    name: audispd-plugins
    state: present
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - enable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - package_audispd-plugins_installed
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_audispd-plugins_installed" system="urn:xccdf:fix:script:puppet" complexity="low" disruption="low" strategy="enable">include install_audispd-plugins

class install_audispd-plugins {
  package { 'audispd-plugins':
    ensure =&gt; 'installed',
  }
}
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_audispd-plugins_installed" system="urn:redhat:anaconda:pre" complexity="low" disruption="low" strategy="enable">
package --add=audispd-plugins
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_audispd-plugins_installed" system="urn:redhat:osbuild:blueprint">
[[packages]]
name = "audispd-plugins"
version = "*"
</fix>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref name="oval:ssg-package_audispd-plugins_installed:def:1" href="ssg-fedora-oval.xml"/>
        </check>
        <check system="http://scap.nist.gov/schema/ocil/2">
          <check-content-ref name="ocil:ssg-package_audispd-plugins_installed_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
        </check>
      </Rule>
      <Rule id="xccdf_org.ssgproject.content_rule_package_audit-audispd-plugins_installed" selected="false" role="full" severity="medium">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure the default plugins for the audit dispatcher are Installed</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The audit-audispd-plugins package should be installed.</description>
        <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000342-GPOS-00133</reference>
        <reference href="https://public.cyber.mil/stigs/cci/">CCI-001851</reference>
        <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Information stored in one location is vulnerable to accidental or incidental deletion or alteration. Off-loading is a common process in information systems with limited audit storage capacity.</rationale>
        <platform idref="cpe:/a:machine"/>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_audit-audispd-plugins_installed" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="enable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

if ! rpm -q --quiet "audit-audispd-plugins" ; then
    dnf install -y "audit-audispd-plugins"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_audit-audispd-plugins_installed" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="enable">- name: Ensure audit-audispd-plugins is installed
  package:
    name: audit-audispd-plugins
    state: present
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - enable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - package_audit-audispd-plugins_installed
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_audit-audispd-plugins_installed" system="urn:xccdf:fix:script:puppet" complexity="low" disruption="low" strategy="enable">include install_audit-audispd-plugins

class install_audit-audispd-plugins {
  package { 'audit-audispd-plugins':
    ensure =&gt; 'installed',
  }
}
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_audit-audispd-plugins_installed" system="urn:redhat:anaconda:pre" complexity="low" disruption="low" strategy="enable">
package --add=audit-audispd-plugins
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_audit-audispd-plugins_installed" system="urn:redhat:osbuild:blueprint">
[[packages]]
name = "audit-audispd-plugins"
version = "*"
</fix>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref name="oval:ssg-package_audit-audispd-plugins_installed:def:1" href="ssg-fedora-oval.xml"/>
        </check>
        <check system="http://scap.nist.gov/schema/ocil/2">
          <check-content-ref name="ocil:ssg-package_audit-audispd-plugins_installed_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
        </check>
      </Rule>
      <Rule id="xccdf_org.ssgproject.content_rule_package_audit_installed" selected="false" role="full" severity="medium">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure the audit Subsystem is Installed</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The audit package should be installed.</description>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-7(a)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-7(1)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-7(2)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-14</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(2)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(a)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
        <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R50)</reference>
        <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000122-GPOS-00063</reference>
        <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000337-GPOS-00129</reference>
        <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000348-GPOS-00136</reference>
        <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000349-GPOS-00137</reference>
        <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000350-GPOS-00138</reference>
        <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000351-GPOS-00139</reference>
        <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000352-GPOS-00140</reference>
        <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000353-GPOS-00141</reference>
        <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000354-GPOS-00142</reference>
        <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000358-GPOS-00145</reference>
        <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000359-GPOS-00146</reference>
        <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000365-GPOS-00152</reference>
        <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000474-GPOS-00219</reference>
        <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000475-GPOS-00220</reference>
        <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
        <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</reference>
        <reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</reference>
        <reference href="https://public.cyber.mil/stigs/cci/">CCI-001814</reference>
        <reference href="https://public.cyber.mil/stigs/cci/">CCI-001875</reference>
        <reference href="https://public.cyber.mil/stigs/cci/">CCI-001877</reference>
        <reference href="https://public.cyber.mil/stigs/cci/">CCI-001878</reference>
        <reference href="https://public.cyber.mil/stigs/cci/">CCI-001879</reference>
        <reference href="https://public.cyber.mil/stigs/cci/">CCI-001880</reference>
        <reference href="https://public.cyber.mil/stigs/cci/">CCI-001881</reference>
        <reference href="https://public.cyber.mil/stigs/cci/">CCI-001882</reference>
        <reference href="https://public.cyber.mil/stigs/cci/">CCI-001889</reference>
        <reference href="https://public.cyber.mil/stigs/cci/">CCI-001914</reference>
        <reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</reference>
        <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The auditd service is an access monitoring and accounting daemon, watching system calls to audit any access, in comparison with potential local access control policy such as SELinux policy.</rationale>
        <platform idref="cpe:/a:machine"/>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_audit_installed" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="enable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

if ! rpm -q --quiet "audit" ; then
    dnf install -y "audit"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_audit_installed" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="enable">- name: Ensure audit is installed
  package:
    name: audit
    state: present
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-7(a)
    - NIST-800-53-AU-12(2)
    - NIST-800-53-AU-14
    - NIST-800-53-AU-2(a)
    - NIST-800-53-AU-7(1)
    - NIST-800-53-AU-7(2)
    - NIST-800-53-CM-6(a)
    - enable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - package_audit_installed
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_audit_installed" system="urn:xccdf:fix:script:puppet" complexity="low" disruption="low" strategy="enable">include install_audit

class install_audit {
  package { 'audit':
    ensure =&gt; 'installed',
  }
}
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_audit_installed" system="urn:redhat:anaconda:pre" complexity="low" disruption="low" strategy="enable">
package --add=audit
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_audit_installed" system="urn:redhat:osbuild:blueprint">
[[packages]]
name = "audit"
version = "*"
</fix>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref name="oval:ssg-package_audit_installed:def:1" href="ssg-fedora-oval.xml"/>
        </check>
        <check system="http://scap.nist.gov/schema/ocil/2">
          <check-content-ref name="ocil:ssg-package_audit_installed_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
        </check>
      </Rule>
      <Rule id="xccdf_org.ssgproject.content_rule_service_auditd_enabled" selected="false" role="full" severity="medium">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Enable auditd Service</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> service is an essential userspace component of
the Linux Auditing System, as it is responsible for writing audit records to
disk.

The <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> service can be enabled with the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo systemctl enable auditd.service</html:pre></description>
        <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.3.1</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.3.2</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.3.6</reference>
        <reference href="https://public.cyber.mil/stigs/cci/">CCI-000126</reference>
        <reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</reference>
        <reference href="https://public.cyber.mil/stigs/cci/">CCI-000131</reference>
        <reference href="https://public.cyber.mil/stigs/cci/">CCI-000132</reference>
        <reference href="https://public.cyber.mil/stigs/cci/">CCI-000133</reference>
        <reference href="https://public.cyber.mil/stigs/cci/">CCI-000134</reference>
        <reference href="https://public.cyber.mil/stigs/cci/">CCI-000135</reference>
        <reference href="https://public.cyber.mil/stigs/cci/">CCI-000154</reference>
        <reference href="https://public.cyber.mil/stigs/cci/">CCI-000158</reference>
        <reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</reference>
        <reference href="https://public.cyber.mil/stigs/cci/">CCI-001464</reference>
        <reference href="https://public.cyber.mil/stigs/cci/">CCI-001487</reference>
        <reference href="https://public.cyber.mil/stigs/cci/">CCI-001814</reference>
        <reference href="https://public.cyber.mil/stigs/cci/">CCI-001876</reference>
        <reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</reference>
        <reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(iv)</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(2)(iii)</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-2(g)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-3</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-10</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-14(1)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</reference>
        <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.1</reference>
        <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</reference>
        <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000038-GPOS-00016</reference>
        <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000039-GPOS-00017</reference>
        <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000040-GPOS-00018</reference>
        <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000041-GPOS-00019</reference>
        <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00021</reference>
        <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000051-GPOS-00024</reference>
        <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000054-GPOS-00025</reference>
        <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000122-GPOS-00063</reference>
        <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000254-GPOS-00095</reference>
        <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000255-GPOS-00096</reference>
        <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000365-GPOS-00152</reference>
        <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</reference>
        <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
        <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</reference>
        <reference href="">SRG-OS-000037-VMM-000150</reference>
        <reference href="">SRG-OS-000063-VMM-000310</reference>
        <reference href="">SRG-OS-000038-VMM-000160</reference>
        <reference href="">SRG-OS-000039-VMM-000170</reference>
        <reference href="">SRG-OS-000040-VMM-000180</reference>
        <reference href="">SRG-OS-000041-VMM-000190</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.5</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.3</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.3</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.10</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.2.6.7</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.6</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.7</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.8</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO10.01</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO10.03</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO10.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO10.05</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO12.06</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
        <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
        <reference href="https://www.isaca.org/resources/cobit">BAI08.02</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS01.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS02.02</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS02.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS02.07</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.03</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
        <reference href="https://www.isaca.org/resources/cobit">MEA01.01</reference>
        <reference href="https://www.isaca.org/resources/cobit">MEA01.02</reference>
        <reference href="https://www.isaca.org/resources/cobit">MEA01.03</reference>
        <reference href="https://www.isaca.org/resources/cobit">MEA01.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">MEA01.05</reference>
        <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.11.2.6</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.12.4.1</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.12.4.2</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.12.4.3</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.12.4.4</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.12.7.1</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.14.2.7</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.15.2.1</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.15.2.2</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.16.1.4</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.16.1.5</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.16.1.7</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.6.2.1</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.6.2.2</reference>
        <reference href="https://www.cisecurity.org/controls/">1</reference>
        <reference href="https://www.cisecurity.org/controls/">11</reference>
        <reference href="https://www.cisecurity.org/controls/">12</reference>
        <reference href="https://www.cisecurity.org/controls/">13</reference>
        <reference href="https://www.cisecurity.org/controls/">14</reference>
        <reference href="https://www.cisecurity.org/controls/">15</reference>
        <reference href="https://www.cisecurity.org/controls/">16</reference>
        <reference href="https://www.cisecurity.org/controls/">19</reference>
        <reference href="https://www.cisecurity.org/controls/">2</reference>
        <reference href="https://www.cisecurity.org/controls/">3</reference>
        <reference href="https://www.cisecurity.org/controls/">4</reference>
        <reference href="https://www.cisecurity.org/controls/">5</reference>
        <reference href="https://www.cisecurity.org/controls/">6</reference>
        <reference href="https://www.cisecurity.org/controls/">7</reference>
        <reference href="https://www.cisecurity.org/controls/">8</reference>
        <reference href="https://www.cisecurity.org/controls/">9</reference>
        <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Without establishing what type of events occurred, it would be difficult
to establish, correlate, and investigate the events leading up to an outage or attack.
Ensuring the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> service is active ensures audit records
generated by the kernel are appropriately recorded.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Additionally, a properly configured audit subsystem ensures that actions of
individual system users can be uniquely traced to those users so they
can be held accountable for their actions.</rationale>
        <platform idref="cpe:/a:machine"/>
        <requires idref="xccdf_org.ssgproject.content_rule_package_audit_installed"/>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="service_auditd_enabled" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="enable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

SYSTEMCTL_EXEC='/usr/bin/systemctl'
"$SYSTEMCTL_EXEC" unmask 'auditd.service'
"$SYSTEMCTL_EXEC" start 'auditd.service'
"$SYSTEMCTL_EXEC" enable 'auditd.service'

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="service_auditd_enabled" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="enable">- name: Enable service auditd
  block:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: Enable service auditd
      service:
        name: auditd
        enabled: 'yes'
        state: started
        masked: 'no'
      when:
        - '"audit" in ansible_facts.packages'
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.3.1
    - NIST-800-171-3.3.2
    - NIST-800-171-3.3.6
    - NIST-800-53-AC-2(g)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-10
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-14(1)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-AU-3
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.1
    - enable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - service_auditd_enabled
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="service_auditd_enabled" system="urn:xccdf:fix:script:puppet" complexity="low" disruption="low" strategy="enable">include enable_auditd

class enable_auditd {
  service {'auditd':
    enable =&gt; true,
    ensure =&gt; 'running',
  }
}
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="service_auditd_enabled" system="urn:xccdf:fix:script:kubernetes">apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    systemd:
      units:
      - name: auditd.service
        enabled: true
</fix>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref name="oval:ssg-service_auditd_enabled:def:1" href="ssg-fedora-oval.xml"/>
        </check>
        <check system="http://scap.nist.gov/schema/ocil/2">
          <check-content-ref name="ocil:ssg-service_auditd_enabled_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
        </check>
      </Rule>
      <Rule id="xccdf_org.ssgproject.content_rule_grub2_audit_backlog_limit_argument" selected="false" role="full" severity="medium">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Extend Audit Backlog Limit for the Audit Daemon</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To improve the kernel capacity to queue all log events, even those which occurred
prior to the audit daemon, add the argument <html:code xmlns:html="http://www.w3.org/1999/xhtml">audit_backlog_limit=8192</html:code> to the default
GRUB 2 command line for the Linux operating system in
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/default/grub</html:code>, in the manner below:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">GRUB_CMDLINE_LINUX="crashkernel=auto rd.lvm.lv=VolGroup/LogVol06 rd.lvm.lv=VolGroup/lv_swap rhgb quiet rd.shell=0 audit=1 audit_backlog_limit=8192"</html:pre></description>
        <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="management">The GRUB 2 configuration file, <html:code xmlns:html="http://www.w3.org/1999/xhtml">grub.cfg</html:code>,
is automatically updated each time a new kernel is installed. Note that any
changes to <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/default/grub</html:code> require rebuilding the <html:code xmlns:html="http://www.w3.org/1999/xhtml">grub.cfg</html:code>
file. To update the GRUB 2 configuration file manually, use the
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">grub2-mkconfig -o</html:pre> command as follows:
<html:ul xmlns:html="http://www.w3.org/1999/xhtml"><html:li>On BIOS-based machines, issue the following command as <html:code>root</html:code>:
<html:pre>~]# grub2-mkconfig -o /boot/grub2/grub.cfg</html:pre></html:li><html:li>On UEFI-based machines, issue the following command as <html:code>root</html:code>:

<html:pre>~]# grub2-mkconfig -o /boot/efi/EFI/fedora/grub.cfg</html:pre></html:li></html:ul></warning>
        <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000254-GPOS-00095</reference>
        <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000341-GPOS-00132</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
        <reference href="https://public.cyber.mil/stigs/cci/">CCI-001849</reference>
        <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">audit_backlog_limit sets the queue length for audit events awaiting transfer
to the audit daemon. Until the audit daemon is up and running, all log messages
are stored in this queue.  If the queue is overrun during boot process, the action
defined by audit failure flag is taken.</rationale>
        <platform idref="cpe:/a:grub2"/>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="grub2_audit_backlog_limit_argument" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ] &amp;&amp; { rpm --quiet -q grub2-common; }; then

# Correct grub2 kernelopts value using grub2-editenv
if ! grub2-editenv - list | grep -qE '^kernelopts=(.*\s)?audit_backlog_limit=8192(\s.*)?$'; then
  grub2-editenv - set "$(grub2-editenv - list | grep kernelopts) audit_backlog_limit=8192"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="grub2_audit_backlog_limit_argument" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="medium" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-53-CM-6(a)
    - grub2_audit_backlog_limit_argument
    - low_disruption
    - medium_complexity
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: get current kernel parameters
  command: /usr/bin/grub2-editenv - list
  register: kernelopts
  changed_when: false
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - '"grub2-common" in ansible_facts.packages'
  tags:
    - NIST-800-53-CM-6(a)
    - grub2_audit_backlog_limit_argument
    - low_disruption
    - medium_complexity
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Update the bootloader menu
  command: /usr/bin/grub2-editenv - set "{{ item }} audit_backlog_limit=8192"
  with_items: '{{ kernelopts.stdout_lines | select(''match'', ''^kernelopts.*'') |
    list }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - '"grub2-common" in ansible_facts.packages'
    - kernelopts.stdout_lines is defined
    - kernelopts.stdout_lines | length &gt; 0
    - kernelopts.stdout | regex_search('^kernelopts=(?:.*\s)?audit_backlog_limit=8192(?:\s.*)?$',
      multiline=True) is none
  tags:
    - NIST-800-53-CM-6(a)
    - grub2_audit_backlog_limit_argument
    - low_disruption
    - medium_complexity
    - medium_severity
    - reboot_required
    - restrict_strategy
</fix>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref name="oval:ssg-grub2_audit_backlog_limit_argument:def:1" href="ssg-fedora-oval.xml"/>
        </check>
        <check system="http://scap.nist.gov/schema/ocil/2">
          <check-content-ref name="ocil:ssg-grub2_audit_backlog_limit_argument_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
        </check>
      </Rule>
      <Rule id="xccdf_org.ssgproject.content_rule_grub2_audit_argument" selected="false" role="full" severity="medium">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Enable Auditing for Processes Which Start Prior to the Audit Daemon</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To ensure all processes can be audited, even those which start
prior to the audit daemon, add the argument <html:code xmlns:html="http://www.w3.org/1999/xhtml">audit=1</html:code> to the default
GRUB 2 command line for the Linux operating system in

<html:code xmlns:html="http://www.w3.org/1999/xhtml">/boot/grub2/grubenv</html:code>, in the manner below:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml"># grub2-editenv - set "$(grub2-editenv - list | grep kernelopts) audit=1"</html:pre></description>
        <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="management">The GRUB 2 configuration file, <html:code xmlns:html="http://www.w3.org/1999/xhtml">grub.cfg</html:code>,
is automatically updated each time a new kernel is installed. Note that any
changes to <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/default/grub</html:code> require rebuilding the <html:code xmlns:html="http://www.w3.org/1999/xhtml">grub.cfg</html:code>
file. To update the GRUB 2 configuration file manually, use the
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">grub2-mkconfig -o</html:pre> command as follows:
<html:ul xmlns:html="http://www.w3.org/1999/xhtml"><html:li>On BIOS-based machines, issue the following command as <html:code>root</html:code>:
<html:pre>~]# grub2-mkconfig -o /boot/grub2/grub.cfg</html:pre></html:li><html:li>On UEFI-based machines, issue the following command as <html:code>root</html:code>:

<html:pre>~]# grub2-mkconfig -o /boot/efi/EFI/fedora/grub.cfg</html:pre></html:li></html:ul></warning>
        <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.3.1</reference>
        <reference href="https://public.cyber.mil/stigs/cci/">CCI-001464</reference>
        <reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</reference>
        <reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(iv)</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(2)(iii)</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(1)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-14(1)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-10</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IR-5(1)</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</reference>
        <reference href="">SRG-OS-000254-VMM-000880</reference>
        <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.3</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.5</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.3</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.3</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.10</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.2.6.7</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.6</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.7</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.8</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO10.01</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO10.03</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO10.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO10.05</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO12.06</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
        <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
        <reference href="https://www.isaca.org/resources/cobit">BAI08.02</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS01.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS02.02</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS02.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS02.07</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.03</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
        <reference href="https://www.isaca.org/resources/cobit">MEA01.01</reference>
        <reference href="https://www.isaca.org/resources/cobit">MEA01.02</reference>
        <reference href="https://www.isaca.org/resources/cobit">MEA01.03</reference>
        <reference href="https://www.isaca.org/resources/cobit">MEA01.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">MEA01.05</reference>
        <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.11.2.6</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.12.4.1</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.12.4.2</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.12.4.3</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.12.4.4</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.12.7.1</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.15.2.1</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.15.2.2</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.16.1.4</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.16.1.5</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.16.1.7</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.6.2.1</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.6.2.2</reference>
        <reference href="https://www.cisecurity.org/controls/">1</reference>
        <reference href="https://www.cisecurity.org/controls/">11</reference>
        <reference href="https://www.cisecurity.org/controls/">12</reference>
        <reference href="https://www.cisecurity.org/controls/">13</reference>
        <reference href="https://www.cisecurity.org/controls/">14</reference>
        <reference href="https://www.cisecurity.org/controls/">15</reference>
        <reference href="https://www.cisecurity.org/controls/">16</reference>
        <reference href="https://www.cisecurity.org/controls/">19</reference>
        <reference href="https://www.cisecurity.org/controls/">3</reference>
        <reference href="https://www.cisecurity.org/controls/">4</reference>
        <reference href="https://www.cisecurity.org/controls/">5</reference>
        <reference href="https://www.cisecurity.org/controls/">6</reference>
        <reference href="https://www.cisecurity.org/controls/">7</reference>
        <reference href="https://www.cisecurity.org/controls/">8</reference>
        <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000254-GPOS-00095</reference>
        <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</reference>
        <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Each process on the system carries an "auditable" flag which indicates whether
its activities can be audited. Although <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> takes care of enabling
this for all processes which launch after it does, adding the kernel argument
ensures it is set for every process during boot.</rationale>
        <platform idref="cpe:/a:grub2"/>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="grub2_audit_argument" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ] &amp;&amp; { rpm --quiet -q grub2-common; }; then

# Correct grub2 kernelopts value using grub2-editenv
if ! grub2-editenv - list | grep -qE '^kernelopts=(.*\s)?audit=1(\s.*)?$'; then
  grub2-editenv - set "$(grub2-editenv - list | grep kernelopts) audit=1"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="grub2_audit_argument" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="medium" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.3.1
    - NIST-800-53-AC-17(1)
    - NIST-800-53-AU-10
    - NIST-800-53-AU-14(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IR-5(1)
    - PCI-DSS-Req-10.3
    - grub2_audit_argument
    - low_disruption
    - medium_complexity
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: get current kernel parameters
  command: /usr/bin/grub2-editenv - list
  register: kernelopts
  changed_when: false
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - '"grub2-common" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.3.1
    - NIST-800-53-AC-17(1)
    - NIST-800-53-AU-10
    - NIST-800-53-AU-14(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IR-5(1)
    - PCI-DSS-Req-10.3
    - grub2_audit_argument
    - low_disruption
    - medium_complexity
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Update the bootloader menu
  command: /usr/bin/grub2-editenv - set "{{ item }} audit=1"
  with_items: '{{ kernelopts.stdout_lines | select(''match'', ''^kernelopts.*'') |
    list }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - '"grub2-common" in ansible_facts.packages'
    - kernelopts.stdout_lines is defined
    - kernelopts.stdout_lines | length &gt; 0
    - kernelopts.stdout | regex_search('^kernelopts=(?:.*\s)?audit=1(?:\s.*)?$', multiline=True)
      is none
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.3.1
    - NIST-800-53-AC-17(1)
    - NIST-800-53-AU-10
    - NIST-800-53-AU-14(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IR-5(1)
    - PCI-DSS-Req-10.3
    - grub2_audit_argument
    - low_disruption
    - medium_complexity
    - medium_severity
    - reboot_required
    - restrict_strategy
</fix>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref name="oval:ssg-grub2_audit_argument:def:1" href="ssg-fedora-oval.xml"/>
        </check>
        <check system="http://scap.nist.gov/schema/ocil/2">
          <check-content-ref name="ocil:ssg-grub2_audit_argument_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
        </check>
      </Rule>
      <Group id="xccdf_org.ssgproject.content_group_auditd_configure_rules">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Configure auditd Rules for Comprehensive Auditing</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> program can perform comprehensive
monitoring of system activity. This section describes recommended
configuration settings for comprehensive auditing, but a full
description of the auditing system's capabilities is beyond the
scope of this guide. The mailing list <html:i xmlns:html="http://www.w3.org/1999/xhtml">linux-audit@redhat.com</html:i> exists
to facilitate community discussion of the auditing system.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
The audit subsystem supports extensive collection of events, including:
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
<html:ul xmlns:html="http://www.w3.org/1999/xhtml"><html:li>Tracing of arbitrary system calls (identified by name or number)
on entry or exit.</html:li><html:li>Filtering by PID, UID, call success, system call argument (with
some limitations), etc.</html:li><html:li>Monitoring of specific files for modifications to the file's
contents or metadata.</html:li></html:ul>
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Auditing rules at startup are controlled by the file <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code>.
Add rules to it to meet the auditing requirements for your organization.
Each line in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> represents a series of arguments
that can be passed to <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code> and can be individually tested
during runtime. See documentation in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/usr/share/doc/audit-<html:i>VERSION</html:i></html:code> and
in the related man pages for more details.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
If copying any example audit rulesets from <html:code xmlns:html="http://www.w3.org/1999/xhtml">/usr/share/doc/audit-VERSION</html:code>,
be sure to comment out the
lines containing <html:code xmlns:html="http://www.w3.org/1999/xhtml">arch=</html:code> which are not appropriate for your system's
architecture. Then review and understand the following rules,
ensuring rules are activated as needed for the appropriate
architecture.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
After reviewing all the rules, reading the following sections, and
editing as needed, the new rules can be activated as follows:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo service auditd restart</html:pre></description>
        <platform idref="cpe:/a:machine"/>
        <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_etc_shadow_openat" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record Events that Modify User/Group Information via openat syscall - /etc/shadow</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The audit system should collect write events to /etc/shadow file for all users and root.
If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured
to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following lines to a file with suffix
<html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S openat -F a2&amp;03 -F path=/etc/shadow -F auid&gt;=1000 -F auid!=unset -F key=user-modify</html:pre>
If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> file:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S openat -F a2&amp;03 -F path=/etc/shadow -F auid&gt;=1000 -F auid!=unset -F key=user-modify</html:pre>
If the system is 64 bit then also add the following line:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b64 -S openat -F a2&amp;03 -F path=/etc/shadow -F auid&gt;=1000 -F auid!=unset -F key=user-modify</html:pre></description>
          <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping system calls related
to the same event is more efficient. See the following example:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S open,openat,open_by_handle_at -F a2&amp;03 -F path=/etc/shadow -F auid&gt;=1000 -F auid!=unset -F key=user-modify</html:pre></warning>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-2(4)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Creation of users through direct edition of /etc/shadow could be an indicator of malicious activity on a system.
Auditing these events could serve as evidence of potential system compromise.</rationale>
          <platform idref="cpe:/a:machine"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_etc_shadow_openat" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then



# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	PATTERN="-a always,exit -F arch=$ARCH -S openat -F a2&amp;03 -F path=/etc/shadow.*"
	GROUP="modify"
	FULL_RULE="-a always,exit -F arch=$ARCH -S openat -F a2&amp;03 -F path=/etc/shadow -F auid&gt;=1000 -F auid!=unset -F key=modify"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_fix_audit_syscall_rule" use="legacy"/>
	fix_audit_syscall_rule "auditctl" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
	fix_audit_syscall_rule "augenrules" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_etc_shadow_openat" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="low" strategy="restrict">- name: Set architecture for audit openat tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_etc_shadow_openat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Search /etc/audit/rules.d for other DAC audit rules
  find:
    paths: /etc/audit/rules.d
    recurse: false
    contains: .*openat(,[\S]+)?[\s]+-F[\s]+a2&amp;03[\s]+-F[\s]+path=/etc/shadow.*
    patterns: '*.rules'
  register: find_openat
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_etc_shadow_openat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: If existing DAC ruleset not found, use /etc/audit/rules.d/modify.rules as
    the recipient for the rule
  set_fact:
    all_files:
      - /etc/audit/rules.d/modify.rules
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_openat.matched is defined and find_openat.matched == 0
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_etc_shadow_openat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
      - '{{ find_openat.files | map(attribute=''path'') | list | first }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_openat.matched is defined and find_openat.matched &gt; 0
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_etc_shadow_openat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the openat rule in rules.d when on x86
  lineinfile:
    path: '{{ all_files[0] }}'
    line: '{{ item }}'
    create: true
    regexp: -a always,exit -F arch=b32 -S openat -F a2&amp;03 -F path=/etc/shadow -F auid&gt;=1000
      -F auid!=unset -F key=[\S]+
  with_items:
    - -a always,exit -F arch=b32 -S openat -F a2&amp;03 -F path=/etc/shadow -F auid&gt;=1000
      -F auid!=unset -F key=modify
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_etc_shadow_openat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the openat rule in rules.d when on x86_64
  lineinfile:
    path: '{{ all_files[0] }}'
    line: '{{ item }}'
    create: true
    regexp: -a always,exit -F arch=b64 -S openat -F a2&amp;03 -F path=/etc/shadow -F auid&gt;=1000
      -F auid!=unset -F key=[\S]+
  with_items:
    - -a always,exit -F arch=b64 -S openat -F a2&amp;03 -F path=/etc/shadow -F auid&gt;=1000
      -F auid!=unset -F key=modify
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - audit_arch is defined and audit_arch == 'b64'
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_etc_shadow_openat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the openat rule in /etc/audit/audit.rules when on x86
  lineinfile:
    line: '{{ item }}'
    state: present
    dest: /etc/audit/audit.rules
    create: true
    regexp: -a always,exit -F arch=b32 -S openat -F a2&amp;03 -F path=/etc/shadow -F auid&gt;=1000
      -F auid!=unset -F key=[\S]+
  with_items:
    - -a always,exit -F arch=b32 -S openat -F a2&amp;03 -F path=/etc/shadow -F auid&gt;=1000
      -F auid!=unset -F key=modify
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_etc_shadow_openat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the openat rule in audit.rules when on x86_64
  lineinfile:
    line: '{{ item }}'
    state: present
    dest: /etc/audit/audit.rules
    create: true
    regexp: -a always,exit -F arch=b64 -S openat -F a2&amp;03 -F path=/etc/shadow -F auid&gt;=1000
      -F auid!=unset -F key=[\S]+
  with_items:
    - -a always,exit -F arch=b64 -S openat -F a2&amp;03 -F path=/etc/shadow -F auid&gt;=1000
      -F auid!=unset -F key=modify
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - audit_arch is defined and audit_arch == 'b64'
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_etc_shadow_openat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-audit_rules_etc_shadow_openat:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-audit_rules_etc_shadow_openat_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_etc_shadow_open" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record Events that Modify User/Group Information via open syscall - /etc/shadow</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The audit system should collect write events to /etc/shadow file for all users and root.
If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured
to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following lines to a file with suffix
<html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S open -F a1&amp;03 -F path=/etc/shadow -F auid&gt;=1000 -F auid!=unset -F key=user-modify</html:pre>
If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> file:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S open -F a1&amp;03 -F path=/etc/shadow -F auid&gt;=1000 -F auid!=unset -F key=user-modify</html:pre>
If the system is 64 bit then also add the following line:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b64 -S open -F a1&amp;03 -F path=/etc/shadow -F auid&gt;=1000 -F auid!=unset -F key=user-modify</html:pre></description>
          <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping system calls related
to the same event is more efficient. See the following example:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S open,openat,open_by_handle_at -F a1&amp;03 -F path=/etc/shadow -F auid&gt;=1000 -F auid!=unset -F key=user-modify</html:pre></warning>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-2(4)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Creation of users through direct edition of /etc/shadow could be an indicator of malicious activity on a system.
Auditing these events could serve as evidence of potential system compromise.</rationale>
          <platform idref="cpe:/a:machine"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_etc_shadow_open" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then



# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	PATTERN="-a always,exit -F arch=$ARCH -S open -F a1&amp;03 -F path=/etc/shadow.*"
	GROUP="modify"
	FULL_RULE="-a always,exit -F arch=$ARCH -S open -F a1&amp;03 -F path=/etc/shadow -F auid&gt;=1000 -F auid!=unset -F key=modify"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_fix_audit_syscall_rule" use="legacy"/>
	fix_audit_syscall_rule "auditctl" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
	fix_audit_syscall_rule "augenrules" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_etc_shadow_open" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="low" strategy="restrict">- name: Set architecture for audit open tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_etc_shadow_open
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Search /etc/audit/rules.d for other DAC audit rules
  find:
    paths: /etc/audit/rules.d
    recurse: false
    contains: .*open(,[\S]+)?[\s]+-F[\s]+a1&amp;03[\s]+-F[\s]+path=/etc/shadow.*
    patterns: '*.rules'
  register: find_open
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_etc_shadow_open
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: If existing DAC ruleset not found, use /etc/audit/rules.d/modify.rules as
    the recipient for the rule
  set_fact:
    all_files:
      - /etc/audit/rules.d/modify.rules
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_open.matched is defined and find_open.matched == 0
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_etc_shadow_open
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
      - '{{ find_open.files | map(attribute=''path'') | list | first }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_open.matched is defined and find_open.matched &gt; 0
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_etc_shadow_open
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the open rule in rules.d when on x86
  lineinfile:
    path: '{{ all_files[0] }}'
    line: '{{ item }}'
    create: true
    regexp: -a always,exit -F arch=b32 -S open -F a1&amp;03 -F path=/etc/shadow -F auid&gt;=1000
      -F auid!=unset -F key=[\S]+
  with_items:
    - -a always,exit -F arch=b32 -S open -F a1&amp;03 -F path=/etc/shadow -F auid&gt;=1000
      -F auid!=unset -F key=modify
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_etc_shadow_open
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the open rule in rules.d when on x86_64
  lineinfile:
    path: '{{ all_files[0] }}'
    line: '{{ item }}'
    create: true
    regexp: -a always,exit -F arch=b64 -S open -F a1&amp;03 -F path=/etc/shadow -F auid&gt;=1000
      -F auid!=unset -F key=[\S]+
  with_items:
    - -a always,exit -F arch=b64 -S open -F a1&amp;03 -F path=/etc/shadow -F auid&gt;=1000
      -F auid!=unset -F key=modify
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - audit_arch is defined and audit_arch == 'b64'
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_etc_shadow_open
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the open rule in /etc/audit/audit.rules when on x86
  lineinfile:
    line: '{{ item }}'
    state: present
    dest: /etc/audit/audit.rules
    create: true
    regexp: -a always,exit -F arch=b32 -S open -F a1&amp;03 -F path=/etc/shadow -F auid&gt;=1000
      -F auid!=unset -F key=[\S]+
  with_items:
    - -a always,exit -F arch=b32 -S open -F a1&amp;03 -F path=/etc/shadow -F auid&gt;=1000
      -F auid!=unset -F key=modify
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_etc_shadow_open
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the open rule in audit.rules when on x86_64
  lineinfile:
    line: '{{ item }}'
    state: present
    dest: /etc/audit/audit.rules
    create: true
    regexp: -a always,exit -F arch=b64 -S open -F a1&amp;03 -F path=/etc/shadow -F auid&gt;=1000
      -F auid!=unset -F key=[\S]+
  with_items:
    - -a always,exit -F arch=b64 -S open -F a1&amp;03 -F path=/etc/shadow -F auid&gt;=1000
      -F auid!=unset -F key=modify
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - audit_arch is defined and audit_arch == 'b64'
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_etc_shadow_open
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-audit_rules_etc_shadow_open:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-audit_rules_etc_shadow_open_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_sysadmin_actions" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure auditd Collects System Administrator Actions</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">At a minimum, the audit system should collect administrator actions
for all users and root. If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the
<html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program to read audit rules during daemon startup (the default),
add the following line to a file with suffix <html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the directory
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-w /etc/sudoers -p wa -k actions
-w /etc/sudoers.d/ -p wa -k actions</html:pre>
If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the following line to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> file:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-w /etc/sudoers -p wa -k actions
-w /etc/sudoers.d/ -p wa -k actions</html:pre></description>
          <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-000126</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-000135</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-2(7)(b)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</reference>
          <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</reference>
          <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.2.2</reference>
          <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.2.5.b</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</reference>
          <reference href="">SRG-OS-000462-VMM-001840</reference>
          <reference href="">SRG-OS-000471-VMM-001910</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.10</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.2.6.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.2.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO12.06</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI08.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS01.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.11.2.6</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.4.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.4.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.4.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.4.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.7.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.2.7</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.15.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.15.2.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.16.1.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.16.1.5</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.16.1.7</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.6.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.6.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.6.2.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.7.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.6</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.3.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.5</reference>
          <reference href="https://www.cisecurity.org/controls/">1</reference>
          <reference href="https://www.cisecurity.org/controls/">11</reference>
          <reference href="https://www.cisecurity.org/controls/">12</reference>
          <reference href="https://www.cisecurity.org/controls/">13</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">16</reference>
          <reference href="https://www.cisecurity.org/controls/">18</reference>
          <reference href="https://www.cisecurity.org/controls/">19</reference>
          <reference href="https://www.cisecurity.org/controls/">2</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">4</reference>
          <reference href="https://www.cisecurity.org/controls/">5</reference>
          <reference href="https://www.cisecurity.org/controls/">6</reference>
          <reference href="https://www.cisecurity.org/controls/">7</reference>
          <reference href="https://www.cisecurity.org/controls/">8</reference>
          <reference href="https://www.cisecurity.org/controls/">9</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The actions taken by system administrators should be audited to keep a record
of what was executed on the system, as well as, for accountability purposes.</rationale>
          <platform idref="cpe:/a:machine"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_sysadmin_actions" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then



# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_fix_audit_watch_rule" use="legacy"/>
fix_audit_watch_rule "auditctl" "/etc/sudoers" "wa" "actions"
fix_audit_watch_rule "augenrules" "/etc/sudoers" "wa" "actions"
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_fix_audit_watch_rule" use="legacy"/>
fix_audit_watch_rule "auditctl" "/etc/sudoers.d/" "wa" "actions"
fix_audit_watch_rule "augenrules" "/etc/sudoers.d/" "wa" "actions"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_sysadmin_actions" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Search /etc/audit/rules.d for audit rule entries for sysadmin actions
  find:
    paths: /etc/audit/rules.d
    recurse: false
    contains: ^.*/etc/sudoers.*$
    patterns: '*.rules'
  register: find_audit_sysadmin_actions
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(7)(b)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.2
    - PCI-DSS-Req-10.2.5.b
    - audit_rules_sysadmin_actions
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Use /etc/audit/rules.d/actions.rules as the recipient for the rule
  set_fact:
    all_sysadmin_actions_files:
      - /etc/audit/rules.d/actions.rules
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_audit_sysadmin_actions.matched is defined and find_audit_sysadmin_actions.matched
      == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(7)(b)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.2
    - PCI-DSS-Req-10.2.5.b
    - audit_rules_sysadmin_actions
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_sysadmin_actions_files:
      - '{{ find_audit_sysadmin_actions.files | map(attribute=''path'') | list | first
        }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_audit_sysadmin_actions.matched is defined and find_audit_sysadmin_actions.matched
      &gt; 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(7)(b)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.2
    - PCI-DSS-Req-10.2.5.b
    - audit_rules_sysadmin_actions
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Inserts/replaces audit rule for /etc/sudoers rule in rules.d
  lineinfile:
    path: '{{ all_sysadmin_actions_files[0] }}'
    line: -w /etc/sudoers -p wa -k actions
    create: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(7)(b)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.2
    - PCI-DSS-Req-10.2.5.b
    - audit_rules_sysadmin_actions
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Inserts/replaces audit rule for /etc/sudoers.d rule in rules.d
  lineinfile:
    path: '{{ all_sysadmin_actions_files[0] }}'
    line: -w /etc/sudoers.d/ -p wa -k actions
    create: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(7)(b)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.2
    - PCI-DSS-Req-10.2.5.b
    - audit_rules_sysadmin_actions
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Inserts/replaces audit rule for /etc/sudoers in audit.rules
  lineinfile:
    path: /etc/audit/audit.rules
    line: -w /etc/sudoers -p wa -k actions
    create: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(7)(b)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.2
    - PCI-DSS-Req-10.2.5.b
    - audit_rules_sysadmin_actions
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Inserts/replaces audit rule for /etc/sudoers.d in audit.rules
  lineinfile:
    path: /etc/audit/audit.rules
    line: -w /etc/sudoers.d/ -p wa -k actions
    create: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(7)(b)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.2
    - PCI-DSS-Req-10.2.5.b
    - audit_rules_sysadmin_actions
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_sysadmin_actions" system="urn:xccdf:fix:script:kubernetes" reboot="true" complexity="low" disruption="low" strategy="restrict">apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,-w%20/etc/sudoers.d/%20-p%20wa%20-k%20actions%0A-w%20/etc/sudoers%20-p%20wa%20-k%20actions%0A
        mode: 0600
        path: /etc/audit/rules.d/75-audit-sysadmin-actions.rules
        overwrite: true
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-audit_rules_sysadmin_actions:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-audit_rules_sysadmin_actions_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_etc_passwd_openat" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record Events that Modify User/Group Information via openat syscall - /etc/passwd</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The audit system should collect write events to /etc/passwd file for all users and root.
If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured
to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following lines to a file with suffix
<html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S openat -F a2&amp;03 -F path=/etc/passwd -F auid&gt;=1000 -F auid!=unset -F key=modify</html:pre>
If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> file:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S openat -F a2&amp;03 -F path=/etc/passwd -F auid&gt;=1000 -F auid!=unset -F key=modify</html:pre>
If the system is 64 bit then also add the following line:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b64 -S openat -F a2&amp;03 -F path=/etc/passwd -F auid&gt;=1000 -F auid!=unset -F key=modify</html:pre></description>
          <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping system calls related
to the same event is more efficient. See the following example:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&amp;03 -F path=/etc/passwd -F auid&gt;=1000 -F auid!=unset -F key=modify</html:pre></warning>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-2(4)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Creation of users through direct edition of /etc/passwd could be an indicator of malicious activity on a system.
Auditing these events could serve as evidence of potential system compromise.</rationale>
          <platform idref="cpe:/a:machine"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_etc_passwd_openat" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then



# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	PATTERN="-a always,exit -F arch=$ARCH -S openat -F a2&amp;03 -F path=/etc/passwd.*"
	GROUP="modify"
	FULL_RULE="-a always,exit -F arch=$ARCH -S openat -F a2&amp;03 -F path=/etc/passwd -F auid&gt;=1000 -F auid!=unset -F key=modify"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_fix_audit_syscall_rule" use="legacy"/>
	fix_audit_syscall_rule "auditctl" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
	fix_audit_syscall_rule "augenrules" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_etc_passwd_openat" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="low" strategy="restrict">- name: Set architecture for audit openat tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_etc_passwd_openat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Search /etc/audit/rules.d for other DAC audit rules
  find:
    paths: /etc/audit/rules.d
    recurse: false
    contains: .*openat(,[\S]+)?[\s]+-F[\s]+a2&amp;03[\s]+-F[\s]+path=/etc/passwd.*
    patterns: '*.rules'
  register: find_openat
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_etc_passwd_openat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: If existing DAC ruleset not found, use /etc/audit/rules.d/modify.rules as
    the recipient for the rule
  set_fact:
    all_files:
      - /etc/audit/rules.d/modify.rules
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_openat.matched is defined and find_openat.matched == 0
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_etc_passwd_openat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
      - '{{ find_openat.files | map(attribute=''path'') | list | first }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_openat.matched is defined and find_openat.matched &gt; 0
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_etc_passwd_openat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the openat rule in rules.d when on x86
  lineinfile:
    path: '{{ all_files[0] }}'
    line: '{{ item }}'
    create: true
    regexp: -a always,exit -F arch=b32 -S openat -F a2&amp;03 -F path=/etc/passwd -F auid&gt;=1000
      -F auid!=unset -F key=[\S]+
  with_items:
    - -a always,exit -F arch=b32 -S openat -F a2&amp;03 -F path=/etc/passwd -F auid&gt;=1000
      -F auid!=unset -F key=modify
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_etc_passwd_openat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the openat rule in rules.d when on x86_64
  lineinfile:
    path: '{{ all_files[0] }}'
    line: '{{ item }}'
    create: true
    regexp: -a always,exit -F arch=b64 -S openat -F a2&amp;03 -F path=/etc/passwd -F auid&gt;=1000
      -F auid!=unset -F key=[\S]+
  with_items:
    - -a always,exit -F arch=b64 -S openat -F a2&amp;03 -F path=/etc/passwd -F auid&gt;=1000
      -F auid!=unset -F key=modify
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - audit_arch is defined and audit_arch == 'b64'
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_etc_passwd_openat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the openat rule in /etc/audit/audit.rules when on x86
  lineinfile:
    line: '{{ item }}'
    state: present
    dest: /etc/audit/audit.rules
    create: true
    regexp: -a always,exit -F arch=b32 -S openat -F a2&amp;03 -F path=/etc/passwd -F auid&gt;=1000
      -F auid!=unset -F key=[\S]+
  with_items:
    - -a always,exit -F arch=b32 -S openat -F a2&amp;03 -F path=/etc/passwd -F auid&gt;=1000
      -F auid!=unset -F key=modify
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_etc_passwd_openat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the openat rule in audit.rules when on x86_64
  lineinfile:
    line: '{{ item }}'
    state: present
    dest: /etc/audit/audit.rules
    create: true
    regexp: -a always,exit -F arch=b64 -S openat -F a2&amp;03 -F path=/etc/passwd -F auid&gt;=1000
      -F auid!=unset -F key=[\S]+
  with_items:
    - -a always,exit -F arch=b64 -S openat -F a2&amp;03 -F path=/etc/passwd -F auid&gt;=1000
      -F auid!=unset -F key=modify
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - audit_arch is defined and audit_arch == 'b64'
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_etc_passwd_openat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-audit_rules_etc_passwd_openat:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-audit_rules_etc_passwd_openat_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification_shadow" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record Events that Modify User/Group Information - /etc/shadow</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the
<html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program to read audit rules during daemon startup (the
default), add the following lines to a file with suffix <html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the
directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>, in order to capture events that modify
account changes:
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-w /etc/shadow -p wa -k audit_rules_usergroup_modification</html:pre>
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> file, in order to capture events that modify
account changes:
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-w /etc/shadow -p wa -k audit_rules_usergroup_modification</html:pre></description>
          <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-000018</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-001403</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-001404</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-001405</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-001683</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-001684</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-001685</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-001686</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-002130</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-002132</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-2(4)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</reference>
          <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</reference>
          <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.2.5</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000004-GPOS-00004</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000239-GPOS-00089</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000240-GPOS-00090</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000241-GPOS-00091</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000303-GPOS-00120</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000476-GPOS-00221</reference>
          <reference href="">SRG-OS-000004-VMM-000040</reference>
          <reference href="">SRG-OS-000239-VMM-000810</reference>
          <reference href="">SRG-OS-000240-VMM-000820</reference>
          <reference href="">SRG-OS-000241-VMM-000830</reference>
          <reference href="">SRG-OS-000274-VMM-000960</reference>
          <reference href="">SRG-OS-000275-VMM-000970</reference>
          <reference href="">SRG-OS-000276-VMM-000980</reference>
          <reference href="">SRG-OS-000277-VMM-000990</reference>
          <reference href="">SRG-OS-000303-VMM-001090</reference>
          <reference href="">SRG-OS-000304-VMM-001100</reference>
          <reference href="">SRG-OS-000476-VMM-001960</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.10</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.2.6.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.2.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO12.06</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI08.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS01.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.11.2.6</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.4.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.4.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.4.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.4.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.7.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.2.7</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.15.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.15.2.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.16.1.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.16.1.5</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.16.1.7</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.6.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.6.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.6.2.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.7.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.6</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.3.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.5</reference>
          <reference href="https://www.cisecurity.org/controls/">1</reference>
          <reference href="https://www.cisecurity.org/controls/">11</reference>
          <reference href="https://www.cisecurity.org/controls/">12</reference>
          <reference href="https://www.cisecurity.org/controls/">13</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">16</reference>
          <reference href="https://www.cisecurity.org/controls/">18</reference>
          <reference href="https://www.cisecurity.org/controls/">19</reference>
          <reference href="https://www.cisecurity.org/controls/">2</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">4</reference>
          <reference href="https://www.cisecurity.org/controls/">5</reference>
          <reference href="https://www.cisecurity.org/controls/">6</reference>
          <reference href="https://www.cisecurity.org/controls/">7</reference>
          <reference href="https://www.cisecurity.org/controls/">8</reference>
          <reference href="https://www.cisecurity.org/controls/">9</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">In addition to auditing new user and group accounts, these watches
will alert the system administrator(s) to any modifications. Any unexpected
users, groups, or modifications should be investigated for legitimacy.</rationale>
          <platform idref="cpe:/a:machine"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_usergroup_modification_shadow" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then



# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_fix_audit_watch_rule" use="legacy"/>
fix_audit_watch_rule "auditctl" "/etc/shadow" "wa" "audit_rules_usergroup_modification"
fix_audit_watch_rule "augenrules" "/etc/shadow" "wa" "audit_rules_usergroup_modification"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_usergroup_modification_shadow" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="low" strategy="restrict">- name: Set architecture for audit shadow tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - audit_rules_usergroup_modification_shadow
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Search /etc/audit/rules.d for other user/group modification audit rules
  find:
    paths: /etc/audit/rules.d
    recurse: false
    contains: -k audit_rules_usergroup_modification$
    patterns: '*.rules'
  register: find_shadow
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - audit_rules_usergroup_modification_shadow
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: If existing user/group modification ruleset not found, use /etc/audit/rules.d/privileged.rules
    as the recipient for the rule
  set_fact:
    all_files:
      - /etc/audit/rules.d/privileged.rules
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_shadow.matched is defined and find_shadow.matched == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - audit_rules_usergroup_modification_shadow
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
      - '{{ find_shadow.files | map(attribute=''path'') | list | first }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_shadow.matched is defined and find_shadow.matched &gt; 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - audit_rules_usergroup_modification_shadow
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the shadow rule in rules.d when on x86
  lineinfile:
    path: '{{ all_files[0] }}'
    line: -w /etc/shadow -p wa -k audit_rules_usergroup_modification
    create: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - audit_rules_usergroup_modification_shadow
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the shadow rule in /etc/audit/audit.rules
  lineinfile:
    line: -w /etc/shadow -p wa -k audit_rules_usergroup_modification
    state: present
    dest: /etc/audit/audit.rules
    create: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - audit_rules_usergroup_modification_shadow
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-audit_rules_usergroup_modification_shadow:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-audit_rules_usergroup_modification_shadow_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_directory_access_var_log_audit" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record Access Events to Audit Log Directory</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The audit system should collect access events to read audit log directory.
The following audit rule will assure that access to audit log directory are
collected.
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F dir=/var/log/audit/ -F perm=r -F auid&gt;=1000 -F auid!=unset -F key=access-audit-trail</html:pre>
If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code>
program to read audit rules during daemon startup (the default), add the
rule to a file with suffix <html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the directory
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>.
If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the rule to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> file.</description>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Attempts to read the logs should be recorded, suspicious access to audit log files could be an indicator of malicious activity on a system.
Auditing these events could serve as evidence of potential system compromise.'</rationale>
          <platform idref="cpe:/a:machine"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="directory_access_var_log_audit" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then



PATTERN="-a always,exit -F path=/var/log/audit/\\s\\+.*"
GROUP="access-audit-trail"
FULL_RULE="-a always,exit -F dir=/var/log/audit/ -F perm=r -F auid&gt;=1000 -F auid!=unset -F key=access-audit-trail"
# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_fix_audit_syscall_rule" use="legacy"/>
fix_audit_syscall_rule "auditctl" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
fix_audit_syscall_rule "augenrules" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="directory_access_var_log_audit" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Search /etc/audit/rules.d for audit rule entries
  find:
    paths: /etc/audit/rules.d
    recurse: false
    contains: ^.*dir=/var/log/audit/.*$
    patterns: '*.rules'
  register: find_var_log_audit
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - directory_access_var_log_audit
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Use /etc/audit/rules.d/access-audit-trail.rules as the recipient for the rule
  set_fact:
    all_files:
      - /etc/audit/rules.d/access-audit-trail.rules
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_var_log_audit.matched == 0
  tags:
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - directory_access_var_log_audit
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
      - '{{ find_var_log_audit.files | map(attribute=''path'') | list | first }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_var_log_audit.matched &gt; 0
  tags:
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - directory_access_var_log_audit
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Inserts/replaces the /var/log/audit/ rule in rules.d
  lineinfile:
    path: '{{ all_files[0] }}'
    line: -a always,exit -F dir=/var/log/audit/ -F perm=r -F auid&gt;=1000 -F auid!=unset
      -F key=access-audit-trail
    create: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - directory_access_var_log_audit
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Inserts/replaces the /var/log/audit/ rule in audit.rules
  lineinfile:
    path: /etc/audit/audit.rules
    line: -a always,exit -F dir=/var/log/audit/ -F perm=r -F auid&gt;=1000 -F auid!=unset
      -F key=access-audit-trail
    create: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - directory_access_var_log_audit
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-directory_access_var_log_audit:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-directory_access_var_log_audit_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification_group" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record Events that Modify User/Group Information - /etc/group</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the
<html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program to read audit rules during daemon startup (the
default), add the following lines to a file with suffix <html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the
directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>, in order to capture events that modify
account changes:
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-w /etc/group -p wa -k audit_rules_usergroup_modification</html:pre>
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> file, in order to capture events that modify
account changes:
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-w /etc/group -p wa -k audit_rules_usergroup_modification</html:pre></description>
          <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-000018</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-001403</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-001404</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-001405</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-001683</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-001684</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-001685</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-001686</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-002130</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-002132</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-2(4)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</reference>
          <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</reference>
          <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.2.5</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000004-GPOS-00004</reference>
          <reference href="">SRG-OS-000004-VMM-000040</reference>
          <reference href="">SRG-OS-000239-VMM-000810</reference>
          <reference href="">SRG-OS-000240-VMM-000820</reference>
          <reference href="">SRG-OS-000241-VMM-000830</reference>
          <reference href="">SRG-OS-000274-VMM-000960</reference>
          <reference href="">SRG-OS-000275-VMM-000970</reference>
          <reference href="">SRG-OS-000276-VMM-000980</reference>
          <reference href="">SRG-OS-000277-VMM-000990</reference>
          <reference href="">SRG-OS-000303-VMM-001090</reference>
          <reference href="">SRG-OS-000304-VMM-001100</reference>
          <reference href="">SRG-OS-000476-VMM-001960</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.10</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.2.6.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.2.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO12.06</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI08.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS01.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.11.2.6</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.4.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.4.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.4.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.4.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.7.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.2.7</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.15.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.15.2.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.16.1.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.16.1.5</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.16.1.7</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.6.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.6.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.6.2.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.7.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.6</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.3.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.5</reference>
          <reference href="https://www.cisecurity.org/controls/">1</reference>
          <reference href="https://www.cisecurity.org/controls/">11</reference>
          <reference href="https://www.cisecurity.org/controls/">12</reference>
          <reference href="https://www.cisecurity.org/controls/">13</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">16</reference>
          <reference href="https://www.cisecurity.org/controls/">18</reference>
          <reference href="https://www.cisecurity.org/controls/">19</reference>
          <reference href="https://www.cisecurity.org/controls/">2</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">4</reference>
          <reference href="https://www.cisecurity.org/controls/">5</reference>
          <reference href="https://www.cisecurity.org/controls/">6</reference>
          <reference href="https://www.cisecurity.org/controls/">7</reference>
          <reference href="https://www.cisecurity.org/controls/">8</reference>
          <reference href="https://www.cisecurity.org/controls/">9</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">In addition to auditing new user and group accounts, these watches
will alert the system administrator(s) to any modifications. Any unexpected
users, groups, or modifications should be investigated for legitimacy.</rationale>
          <platform idref="cpe:/a:machine"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_usergroup_modification_group" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then



# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_fix_audit_watch_rule" use="legacy"/>
fix_audit_watch_rule "auditctl" "/etc/group" "wa" "audit_rules_usergroup_modification"
fix_audit_watch_rule "augenrules" "/etc/group" "wa" "audit_rules_usergroup_modification"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_usergroup_modification_group" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="low" strategy="restrict">- name: Set architecture for audit group tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - audit_rules_usergroup_modification_group
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Search /etc/audit/rules.d for other user/group modification audit rules
  find:
    paths: /etc/audit/rules.d
    recurse: false
    contains: -k audit_rules_usergroup_modification$
    patterns: '*.rules'
  register: find_group
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - audit_rules_usergroup_modification_group
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: If existing user/group modification ruleset not found, use /etc/audit/rules.d/privileged.rules
    as the recipient for the rule
  set_fact:
    all_files:
      - /etc/audit/rules.d/privileged.rules
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_group.matched is defined and find_group.matched == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - audit_rules_usergroup_modification_group
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
      - '{{ find_group.files | map(attribute=''path'') | list | first }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_group.matched is defined and find_group.matched &gt; 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - audit_rules_usergroup_modification_group
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the group rule in rules.d when on x86
  lineinfile:
    path: '{{ all_files[0] }}'
    line: -w /etc/group -p wa -k audit_rules_usergroup_modification
    create: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - audit_rules_usergroup_modification_group
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the group rule in /etc/audit/audit.rules
  lineinfile:
    line: -w /etc/group -p wa -k audit_rules_usergroup_modification
    state: present
    dest: /etc/audit/audit.rules
    create: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - audit_rules_usergroup_modification_group
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-audit_rules_usergroup_modification_group:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-audit_rules_usergroup_modification_group_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_file_ownership_var_log_audit" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">System Audit Logs Must Be Owned By Root</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">All audit logs must be owned by root user and group. By default, the path for audit log is <html:pre xmlns:html="http://www.w3.org/1999/xhtml">/var/log/audit/</html:pre>.

To properly set the owner of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/var/log/audit</html:code>, run the command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo chown root /var/log/audit </html:pre>

To properly set the owner of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/var/log/audit/*</html:code>, run the command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo chown root /var/log/audit/* </html:pre></description>
          <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.3.1</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-000162</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-000163</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-000164</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-001314</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-9(4)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</reference>
          <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.5.1</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000057-GPOS-00027</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000058-GPOS-00028</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000059-GPOS-00029</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000206-GPOS-00084</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.10</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO12.06</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI08.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.10.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.11.1.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.11.1.5</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.11.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.4.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.4.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.4.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.4.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.7.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.1.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.2.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.16.1.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.16.1.5</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.16.1.7</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.6.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.7.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.7.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.7.3.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.8.2.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.8.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.5</reference>
          <reference href="https://www.cisecurity.org/controls/">1</reference>
          <reference href="https://www.cisecurity.org/controls/">11</reference>
          <reference href="https://www.cisecurity.org/controls/">12</reference>
          <reference href="https://www.cisecurity.org/controls/">13</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">16</reference>
          <reference href="https://www.cisecurity.org/controls/">18</reference>
          <reference href="https://www.cisecurity.org/controls/">19</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">4</reference>
          <reference href="https://www.cisecurity.org/controls/">5</reference>
          <reference href="https://www.cisecurity.org/controls/">6</reference>
          <reference href="https://www.cisecurity.org/controls/">7</reference>
          <reference href="https://www.cisecurity.org/controls/">8</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Unauthorized disclosure of audit records can reveal system and configuration data to
attackers, thus compromising its confidentiality.</rationale>
          <platform idref="cpe:/a:machine"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_ownership_var_log_audit" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

if LC_ALL=C grep -m 1 -q ^log_group /etc/audit/auditd.conf; then
  GROUP=$(awk -F "=" '/log_group/ {print $2}' /etc/audit/auditd.conf | tr -d ' ')
  if ! [ "${GROUP}" == 'root' ] ; then
    chown root.${GROUP} /var/log/audit
    chown root.${GROUP} /var/log/audit/audit.log*
  else
    chown root.root /var/log/audit
    chown root.root /var/log/audit/audit.log*
  fi
else
  chown root.root /var/log/audit
  chown root.root /var/log/audit/audit.log*
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-file_ownership_var_log_audit:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-file_ownership_var_log_audit_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_networkconfig_modification" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record Events that Modify the System's Network Environment</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the
<html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program to read audit rules during daemon startup (the
default), add the following lines to a file with suffix <html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the
directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>, setting ARCH to either b32 or b64 as
appropriate for your system:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=ARCH -S sethostname,setdomainname -F key=audit_rules_networkconfig_modification
-w /etc/issue -p wa -k audit_rules_networkconfig_modification
-w /etc/issue.net -p wa -k audit_rules_networkconfig_modification
-w /etc/hosts -p wa -k audit_rules_networkconfig_modification
-w /etc/sysconfig/network -p wa -k audit_rules_networkconfig_modification</html:pre>
If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> file, setting ARCH to either b32 or b64 as
appropriate for your system:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=ARCH -S sethostname,setdomainname -F key=audit_rules_networkconfig_modification
-w /etc/issue -p wa -k audit_rules_networkconfig_modification
-w /etc/issue.net -p wa -k audit_rules_networkconfig_modification
-w /etc/hosts -p wa -k audit_rules_networkconfig_modification
-w /etc/sysconfig/network -p wa -k audit_rules_networkconfig_modification</html:pre></description>
          <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</reference>
          <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.5.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.10</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.2.6.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO12.06</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI08.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS01.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.11.2.6</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.4.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.4.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.4.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.4.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.7.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.2.7</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.15.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.15.2.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.16.1.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.16.1.5</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.16.1.7</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.6.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.6.2.2</reference>
          <reference href="https://www.cisecurity.org/controls/">1</reference>
          <reference href="https://www.cisecurity.org/controls/">11</reference>
          <reference href="https://www.cisecurity.org/controls/">12</reference>
          <reference href="https://www.cisecurity.org/controls/">13</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">16</reference>
          <reference href="https://www.cisecurity.org/controls/">19</reference>
          <reference href="https://www.cisecurity.org/controls/">2</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">4</reference>
          <reference href="https://www.cisecurity.org/controls/">5</reference>
          <reference href="https://www.cisecurity.org/controls/">6</reference>
          <reference href="https://www.cisecurity.org/controls/">7</reference>
          <reference href="https://www.cisecurity.org/controls/">8</reference>
          <reference href="https://www.cisecurity.org/controls/">9</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The network environment should not be modified by anything other
than administrator action. Any change to network parameters should be
audited.</rationale>
          <platform idref="cpe:/a:machine"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_networkconfig_modification" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then



# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	PATTERN="-a always,exit -F arch=$ARCH -S .* -k *"
	# Use escaped BRE regex to specify rule group
	GROUP="set\(host\|domain\)name"
	FULL_RULE="-a always,exit -F arch=$ARCH -S sethostname -S setdomainname -k audit_rules_networkconfig_modification"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_fix_audit_syscall_rule" use="legacy"/>
	fix_audit_syscall_rule "auditctl" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
	fix_audit_syscall_rule "augenrules" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
done

# Then perform the remediations for the watch rules
# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_fix_audit_watch_rule" use="legacy"/>
fix_audit_watch_rule "auditctl" "/etc/issue" "wa" "audit_rules_networkconfig_modification"
fix_audit_watch_rule "augenrules" "/etc/issue" "wa" "audit_rules_networkconfig_modification"
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_fix_audit_watch_rule" use="legacy"/>
fix_audit_watch_rule "auditctl" "/etc/issue.net" "wa" "audit_rules_networkconfig_modification"
fix_audit_watch_rule "augenrules" "/etc/issue.net" "wa" "audit_rules_networkconfig_modification"
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_fix_audit_watch_rule" use="legacy"/>
fix_audit_watch_rule "auditctl" "/etc/hosts" "wa" "audit_rules_networkconfig_modification"
fix_audit_watch_rule "augenrules" "/etc/hosts" "wa" "audit_rules_networkconfig_modification"
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_fix_audit_watch_rule" use="legacy"/>
fix_audit_watch_rule "auditctl" "/etc/sysconfig/network" "wa" "audit_rules_networkconfig_modification"
fix_audit_watch_rule "augenrules" "/etc/sysconfig/network" "wa" "audit_rules_networkconfig_modification"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_networkconfig_modification" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Set architecture for audit tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_networkconfig_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Remediate audit rules for network configuration for x86
  block:

    - name: Declare list of syscals
      set_fact:
        syscalls:
          - sethostname
          - setdomainname

    - name: Declare number of syscalls
      set_fact: audit_syscalls_number_of_syscalls="{{ syscalls|length|int }}"

    - name: Check existence of syscalls for architecture b32 in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+{{
          item }}[\s]+|([\s]+|[,]){{ item }}([\s]+|[,]))).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$
        patterns: '*.rules'
      register: audit_syscalls_found_b32_rules_d
      loop: '{{ syscalls }}'

    - name: Get number of matched syscalls for architecture b32 in /etc/audit/rules.d/
      set_fact: audit_syscalls_matched_b32_rules_d="{{ audit_syscalls_found_b32_rules_d.results|sum(attribute='matched')|int
        }}"

    - name: Search /etc/audit/rules.d for other rules with the key audit_rules_networkconfig_modification
      find:
        paths: /etc/audit/rules.d
        contains: ^.*(?:-F key=|-k\s+)audit_rules_networkconfig_modification$
        patterns: '*.rules'
      register: find_syscalls_files

    - name: Use /etc/audit/rules.d/audit_rules_networkconfig_modification.rules as
        the recipient for the rule
      set_fact:
        all_files:
          - /etc/audit/rules.d/audit_rules_networkconfig_modification.rules
      when: find_syscalls_files.matched is defined and find_syscalls_files.matched
        == 0

    - name: Use matched file as the recipient for the rule
      set_fact:
        all_files:
          - '{{ find_syscalls_files.files | map(attribute=''path'') | list | first
            }}'
      when: find_syscalls_files.matched is defined and find_syscalls_files.matched
        &gt; 0

    - name: Insert the syscall rule in {{ all_files[0] }}
      block:

        - name: 'Construct rule: add rule list, action and arch'
          set_fact: tmpline="-a always,exit -F arch=b32"

        - name: 'Construct rule: add syscalls'
          set_fact: tmpline="{{ tmpline + ' -S ' + item.item }}"
          loop: '{{ audit_syscalls_found_b32_rules_d.results }}'
          when: item.matched is defined and item.matched == 0

        - name: 'Construct rule: add fields and key'
          set_fact: tmpline="{{ tmpline + ' -k audit_rules_networkconfig_modification'
            }}"

        - name: Insert the line in {{ all_files[0] }}
          lineinfile:
            path: '{{ all_files[0] }}'
            line: '{{ tmpline }}'
            create: true
            state: present
      when: audit_syscalls_matched_b32_rules_d &lt; audit_syscalls_number_of_syscalls

    - name: Declare list of syscals
      set_fact:
        syscalls:
          - sethostname
          - setdomainname

    - name: Declare number of syscalls
      set_fact: audit_syscalls_number_of_syscalls="{{ syscalls|length|int }}"

    - name: Check existence of syscalls for architecture b32 in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+{{
          item }}[\s]+|([\s]+|[,]){{ item }}([\s]+|[,]))).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$
        patterns: audit.rules
      register: audit_syscalls_found_b32_audit_rules
      loop: '{{ syscalls }}'

    - name: Get number of matched syscalls for architecture b32 in /etc/audit/audit.rules
      set_fact: audit_syscalls_matched_b32_audit_rules="{{ audit_syscalls_found_b32_audit_rules.results|sum(attribute='matched')|int
        }}"

    - name: Insert the syscall rule in /etc/audit/audit.rules
      block:

        - name: 'Construct rule: add rule list, action and arch'
          set_fact: tmpline="-a always,exit -F arch=b32"

        - name: 'Construct rule: add syscalls'
          set_fact: tmpline="{{ tmpline + ' -S ' + item.item }}"
          loop: '{{ audit_syscalls_found_b32_audit_rules.results }}'
          when: item.matched is defined and item.matched == 0

        - name: 'Construct rule: add fields and key'
          set_fact: tmpline="{{ tmpline + ' -k audit_rules_networkconfig_modification'
            }}"

        - name: Insert the line in /etc/audit/audit.rules
          lineinfile:
            path: /etc/audit/audit.rules
            line: '{{ tmpline }}'
            create: true
            state: present
      when: audit_syscalls_matched_b32_audit_rules &lt; audit_syscalls_number_of_syscalls
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_networkconfig_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Remediate audit rules for network configuration for x86_64
  block:

    - name: Declare list of syscals
      set_fact:
        syscalls:
          - sethostname
          - setdomainname

    - name: Declare number of syscalls
      set_fact: audit_syscalls_number_of_syscalls="{{ syscalls|length|int }}"

    - name: Check existence of syscalls for architecture b64 in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+{{
          item }}[\s]+|([\s]+|[,]){{ item }}([\s]+|[,]))).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$
        patterns: '*.rules'
      register: audit_syscalls_found_b64_rules_d
      loop: '{{ syscalls }}'

    - name: Get number of matched syscalls for architecture b64 in /etc/audit/rules.d/
      set_fact: audit_syscalls_matched_b64_rules_d="{{ audit_syscalls_found_b64_rules_d.results|sum(attribute='matched')|int
        }}"

    - name: Search /etc/audit/rules.d for other rules with the key audit_rules_networkconfig_modification
      find:
        paths: /etc/audit/rules.d
        contains: ^.*(?:-F key=|-k\s+)audit_rules_networkconfig_modification$
        patterns: '*.rules'
      register: find_syscalls_files

    - name: Use /etc/audit/rules.d/audit_rules_networkconfig_modification.rules as
        the recipient for the rule
      set_fact:
        all_files:
          - /etc/audit/rules.d/audit_rules_networkconfig_modification.rules
      when: find_syscalls_files.matched is defined and find_syscalls_files.matched
        == 0

    - name: Use matched file as the recipient for the rule
      set_fact:
        all_files:
          - '{{ find_syscalls_files.files | map(attribute=''path'') | list | first
            }}'
      when: find_syscalls_files.matched is defined and find_syscalls_files.matched
        &gt; 0

    - name: Insert the syscall rule in {{ all_files[0] }}
      block:

        - name: 'Construct rule: add rule list, action and arch'
          set_fact: tmpline="-a always,exit -F arch=b64"

        - name: 'Construct rule: add syscalls'
          set_fact: tmpline="{{ tmpline + ' -S ' + item.item }}"
          loop: '{{ audit_syscalls_found_b64_rules_d.results }}'
          when: item.matched is defined and item.matched == 0

        - name: 'Construct rule: add fields and key'
          set_fact: tmpline="{{ tmpline + ' -k audit_rules_networkconfig_modification'
            }}"

        - name: Insert the line in {{ all_files[0] }}
          lineinfile:
            path: '{{ all_files[0] }}'
            line: '{{ tmpline }}'
            create: true
            state: present
      when: audit_syscalls_matched_b64_rules_d &lt; audit_syscalls_number_of_syscalls

    - name: Declare list of syscals
      set_fact:
        syscalls:
          - sethostname
          - setdomainname

    - name: Declare number of syscalls
      set_fact: audit_syscalls_number_of_syscalls="{{ syscalls|length|int }}"

    - name: Check existence of syscalls for architecture b64 in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+{{
          item }}[\s]+|([\s]+|[,]){{ item }}([\s]+|[,]))).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$
        patterns: audit.rules
      register: audit_syscalls_found_b64_audit_rules
      loop: '{{ syscalls }}'

    - name: Get number of matched syscalls for architecture b64 in /etc/audit/audit.rules
      set_fact: audit_syscalls_matched_b64_audit_rules="{{ audit_syscalls_found_b64_audit_rules.results|sum(attribute='matched')|int
        }}"

    - name: Insert the syscall rule in /etc/audit/audit.rules
      block:

        - name: 'Construct rule: add rule list, action and arch'
          set_fact: tmpline="-a always,exit -F arch=b64"

        - name: 'Construct rule: add syscalls'
          set_fact: tmpline="{{ tmpline + ' -S ' + item.item }}"
          loop: '{{ audit_syscalls_found_b64_audit_rules.results }}'
          when: item.matched is defined and item.matched == 0

        - name: 'Construct rule: add fields and key'
          set_fact: tmpline="{{ tmpline + ' -k audit_rules_networkconfig_modification'
            }}"

        - name: Insert the line in /etc/audit/audit.rules
          lineinfile:
            path: /etc/audit/audit.rules
            line: '{{ tmpline }}'
            create: true
            state: present
      when: audit_syscalls_matched_b64_audit_rules &lt; audit_syscalls_number_of_syscalls
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - audit_arch == "b64"
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_networkconfig_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Check if watch rule for /etc/issue already exists in /etc/audit/rules.d/
  find:
    paths: /etc/audit/rules.d
    contains: ^\s*-w\s+/etc/issue\s+-p\s+wa(\s|$)+
    patterns: '*.rules'
  register: find_existing_watch_rules_d
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_networkconfig_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Search /etc/audit/rules.d for other rules with specified key audit_rules_networkconfig_modification
  find:
    paths: /etc/audit/rules.d
    contains: ^.*(?:-F key=|-k\s+)audit_rules_networkconfig_modification$
    patterns: '*.rules'
  register: find_watch_key
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
      == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_networkconfig_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Use /etc/audit/rules.d/audit_rules_networkconfig_modification.rules as the
    recipient for the rule
  set_fact:
    all_files:
      - /etc/audit/rules.d/audit_rules_networkconfig_modification.rules
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_watch_key.matched is defined and find_watch_key.matched == 0 and find_existing_watch_rules_d.matched
      is defined and find_existing_watch_rules_d.matched == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_networkconfig_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
      - '{{ find_watch_key.files | map(attribute=''path'') | list | first }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_watch_key.matched is defined and find_watch_key.matched &gt; 0 and find_existing_watch_rules_d.matched
      is defined and find_existing_watch_rules_d.matched == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_networkconfig_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Add watch rule for /etc/issue in /etc/audit/rules.d/
  lineinfile:
    path: '{{ all_files[0] }}'
    line: -w /etc/issue -p wa -k audit_rules_networkconfig_modification
    create: true
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
      == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_networkconfig_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Check if watch rule for /etc/issue already exists in /etc/audit/audit.rules
  find:
    paths: /etc/audit/
    contains: ^\s*-w\s+/etc/issue\s+-p\s+wa(\s|$)+
    patterns: audit.rules
  register: find_existing_watch_audit_rules
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_networkconfig_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Add watch rule for /etc/issue in /etc/audit/audit.rules
  lineinfile:
    line: -w /etc/issue -p wa -k audit_rules_networkconfig_modification
    state: present
    dest: /etc/audit/audit.rules
    create: true
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_existing_watch_audit_rules.matched is defined and find_existing_watch_audit_rules.matched
      == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_networkconfig_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Check if watch rule for /etc/issue.net already exists in /etc/audit/rules.d/
  find:
    paths: /etc/audit/rules.d
    contains: ^\s*-w\s+/etc/issue.net\s+-p\s+wa(\s|$)+
    patterns: '*.rules'
  register: find_existing_watch_rules_d
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_networkconfig_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Search /etc/audit/rules.d for other rules with specified key audit_rules_networkconfig_modification
  find:
    paths: /etc/audit/rules.d
    contains: ^.*(?:-F key=|-k\s+)audit_rules_networkconfig_modification$
    patterns: '*.rules'
  register: find_watch_key
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
      == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_networkconfig_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Use /etc/audit/rules.d/audit_rules_networkconfig_modification.rules as the
    recipient for the rule
  set_fact:
    all_files:
      - /etc/audit/rules.d/audit_rules_networkconfig_modification.rules
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_watch_key.matched is defined and find_watch_key.matched == 0 and find_existing_watch_rules_d.matched
      is defined and find_existing_watch_rules_d.matched == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_networkconfig_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
      - '{{ find_watch_key.files | map(attribute=''path'') | list | first }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_watch_key.matched is defined and find_watch_key.matched &gt; 0 and find_existing_watch_rules_d.matched
      is defined and find_existing_watch_rules_d.matched == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_networkconfig_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Add watch rule for /etc/issue.net in /etc/audit/rules.d/
  lineinfile:
    path: '{{ all_files[0] }}'
    line: -w /etc/issue.net -p wa -k audit_rules_networkconfig_modification
    create: true
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
      == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_networkconfig_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Check if watch rule for /etc/issue.net already exists in /etc/audit/audit.rules
  find:
    paths: /etc/audit/
    contains: ^\s*-w\s+/etc/issue.net\s+-p\s+wa(\s|$)+
    patterns: audit.rules
  register: find_existing_watch_audit_rules
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_networkconfig_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Add watch rule for /etc/issue.net in /etc/audit/audit.rules
  lineinfile:
    line: -w /etc/issue.net -p wa -k audit_rules_networkconfig_modification
    state: present
    dest: /etc/audit/audit.rules
    create: true
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_existing_watch_audit_rules.matched is defined and find_existing_watch_audit_rules.matched
      == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_networkconfig_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Check if watch rule for /etc/hosts already exists in /etc/audit/rules.d/
  find:
    paths: /etc/audit/rules.d
    contains: ^\s*-w\s+/etc/hosts\s+-p\s+wa(\s|$)+
    patterns: '*.rules'
  register: find_existing_watch_rules_d
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_networkconfig_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Search /etc/audit/rules.d for other rules with specified key audit_rules_networkconfig_modification
  find:
    paths: /etc/audit/rules.d
    contains: ^.*(?:-F key=|-k\s+)audit_rules_networkconfig_modification$
    patterns: '*.rules'
  register: find_watch_key
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
      == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_networkconfig_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Use /etc/audit/rules.d/audit_rules_networkconfig_modification.rules as the
    recipient for the rule
  set_fact:
    all_files:
      - /etc/audit/rules.d/audit_rules_networkconfig_modification.rules
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_watch_key.matched is defined and find_watch_key.matched == 0 and find_existing_watch_rules_d.matched
      is defined and find_existing_watch_rules_d.matched == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_networkconfig_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
      - '{{ find_watch_key.files | map(attribute=''path'') | list | first }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_watch_key.matched is defined and find_watch_key.matched &gt; 0 and find_existing_watch_rules_d.matched
      is defined and find_existing_watch_rules_d.matched == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_networkconfig_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Add watch rule for /etc/hosts in /etc/audit/rules.d/
  lineinfile:
    path: '{{ all_files[0] }}'
    line: -w /etc/hosts -p wa -k audit_rules_networkconfig_modification
    create: true
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
      == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_networkconfig_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Check if watch rule for /etc/hosts already exists in /etc/audit/audit.rules
  find:
    paths: /etc/audit/
    contains: ^\s*-w\s+/etc/hosts\s+-p\s+wa(\s|$)+
    patterns: audit.rules
  register: find_existing_watch_audit_rules
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_networkconfig_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Add watch rule for /etc/hosts in /etc/audit/audit.rules
  lineinfile:
    line: -w /etc/hosts -p wa -k audit_rules_networkconfig_modification
    state: present
    dest: /etc/audit/audit.rules
    create: true
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_existing_watch_audit_rules.matched is defined and find_existing_watch_audit_rules.matched
      == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_networkconfig_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Check if watch rule for /etc/sysconfig/network already exists in /etc/audit/rules.d/
  find:
    paths: /etc/audit/rules.d
    contains: ^\s*-w\s+/etc/sysconfig/network\s+-p\s+wa(\s|$)+
    patterns: '*.rules'
  register: find_existing_watch_rules_d
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_networkconfig_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Search /etc/audit/rules.d for other rules with specified key audit_rules_networkconfig_modification
  find:
    paths: /etc/audit/rules.d
    contains: ^.*(?:-F key=|-k\s+)audit_rules_networkconfig_modification$
    patterns: '*.rules'
  register: find_watch_key
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
      == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_networkconfig_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Use /etc/audit/rules.d/audit_rules_networkconfig_modification.rules as the
    recipient for the rule
  set_fact:
    all_files:
      - /etc/audit/rules.d/audit_rules_networkconfig_modification.rules
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_watch_key.matched is defined and find_watch_key.matched == 0 and find_existing_watch_rules_d.matched
      is defined and find_existing_watch_rules_d.matched == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_networkconfig_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
      - '{{ find_watch_key.files | map(attribute=''path'') | list | first }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_watch_key.matched is defined and find_watch_key.matched &gt; 0 and find_existing_watch_rules_d.matched
      is defined and find_existing_watch_rules_d.matched == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_networkconfig_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Add watch rule for /etc/sysconfig/network in /etc/audit/rules.d/
  lineinfile:
    path: '{{ all_files[0] }}'
    line: -w /etc/sysconfig/network -p wa -k audit_rules_networkconfig_modification
    create: true
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
      == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_networkconfig_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Check if watch rule for /etc/sysconfig/network already exists in /etc/audit/audit.rules
  find:
    paths: /etc/audit/
    contains: ^\s*-w\s+/etc/sysconfig/network\s+-p\s+wa(\s|$)+
    patterns: audit.rules
  register: find_existing_watch_audit_rules
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_networkconfig_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Add watch rule for /etc/sysconfig/network in /etc/audit/audit.rules
  lineinfile:
    line: -w /etc/sysconfig/network -p wa -k audit_rules_networkconfig_modification
    state: present
    dest: /etc/audit/audit.rules
    create: true
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_existing_watch_audit_rules.matched is defined and find_existing_watch_audit_rules.matched
      == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_networkconfig_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-audit_rules_networkconfig_modification:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-audit_rules_networkconfig_modification_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_etc_gshadow_open" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record Events that Modify User/Group Information via open syscall - /etc/gshadow</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The audit system should collect write events to /etc/gshadow file for all users and root.
If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured
to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following lines to a file with suffix
<html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S open -F a1&amp;03 -F path=/etc/gshadow -F auid&gt;=1000 -F auid!=unset -F key=user-modify</html:pre>
If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> file:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S open -F a1&amp;03 -F path=/etc/gshadow -F auid&gt;=1000 -F auid!=unset -F key=user-modify</html:pre>
If the system is 64 bit then also add the following line:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b64 -S open -F a1&amp;03 -F path=/etc/gshadow -F auid&gt;=1000 -F auid!=unset -F key=user-modify</html:pre></description>
          <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping system calls related
to the same event is more efficient. See the following example:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S open -F a1&amp;03 -F path=/etc/gshadow -F auid&gt;=1000 -F auid!=unset -F key=user-modify</html:pre></warning>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-2(4)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Creation of users through direct edition of /etc/gshadow could be an indicator of malicious activity on a system.
Auditing these events could serve as evidence of potential system compromise.</rationale>
          <platform idref="cpe:/a:machine"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_etc_gshadow_open" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then



# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	PATTERN="-a always,exit -F arch=$ARCH -S open -F a1&amp;03 -F path=/etc/gshadow.*"
	GROUP="modify"
	FULL_RULE="-a always,exit -F arch=$ARCH -S open -F a1&amp;03 -F path=/etc/gshadow -F auid&gt;=1000 -F auid!=unset -F key=modify"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_fix_audit_syscall_rule" use="legacy"/>
	fix_audit_syscall_rule "auditctl" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
	fix_audit_syscall_rule "augenrules" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_etc_gshadow_open" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="low" strategy="restrict">- name: Set architecture for audit open tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_etc_gshadow_open
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Search /etc/audit/rules.d for other DAC audit rules
  find:
    paths: /etc/audit/rules.d
    recurse: false
    contains: .*open(,[\S]+)?[\s]+-F[\s]+a1&amp;03[\s]+-F[\s]+path=/etc/gshadow.*
    patterns: '*.rules'
  register: find_open
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_etc_gshadow_open
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: If existing DAC ruleset not found, use /etc/audit/rules.d/modify.rules as
    the recipient for the rule
  set_fact:
    all_files:
      - /etc/audit/rules.d/modify.rules
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_open.matched is defined and find_open.matched == 0
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_etc_gshadow_open
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
      - '{{ find_open.files | map(attribute=''path'') | list | first }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_open.matched is defined and find_open.matched &gt; 0
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_etc_gshadow_open
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the open rule in rules.d when on x86
  lineinfile:
    path: '{{ all_files[0] }}'
    line: '{{ item }}'
    create: true
    regexp: -a always,exit -F arch=b32 -S open -F a1&amp;03 -F path=/etc/gshadow -F auid&gt;=1000
      -F auid!=unset -F key=[\S]+
  with_items:
    - -a always,exit -F arch=b32 -S open -F a1&amp;03 -F path=/etc/gshadow -F auid&gt;=1000
      -F auid!=unset -F key=modify
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_etc_gshadow_open
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the open rule in rules.d when on x86_64
  lineinfile:
    path: '{{ all_files[0] }}'
    line: '{{ item }}'
    create: true
    regexp: -a always,exit -F arch=b64 -S open -F a1&amp;03 -F path=/etc/gshadow -F auid&gt;=1000
      -F auid!=unset -F key=[\S]+
  with_items:
    - -a always,exit -F arch=b64 -S open -F a1&amp;03 -F path=/etc/gshadow -F auid&gt;=1000
      -F auid!=unset -F key=modify
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - audit_arch is defined and audit_arch == 'b64'
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_etc_gshadow_open
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the open rule in /etc/audit/audit.rules when on x86
  lineinfile:
    line: '{{ item }}'
    state: present
    dest: /etc/audit/audit.rules
    create: true
    regexp: -a always,exit -F arch=b32 -S open -F a1&amp;03 -F path=/etc/gshadow -F auid&gt;=1000
      -F auid!=unset -F key=[\S]+
  with_items:
    - -a always,exit -F arch=b32 -S open -F a1&amp;03 -F path=/etc/gshadow -F auid&gt;=1000
      -F auid!=unset -F key=modify
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_etc_gshadow_open
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the open rule in audit.rules when on x86_64
  lineinfile:
    line: '{{ item }}'
    state: present
    dest: /etc/audit/audit.rules
    create: true
    regexp: -a always,exit -F arch=b64 -S open -F a1&amp;03 -F path=/etc/gshadow -F auid&gt;=1000
      -F auid!=unset -F key=[\S]+
  with_items:
    - -a always,exit -F arch=b64 -S open -F a1&amp;03 -F path=/etc/gshadow -F auid&gt;=1000
      -F auid!=unset -F key=modify
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - audit_arch is defined and audit_arch == 'b64'
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_etc_gshadow_open
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-audit_rules_etc_gshadow_open:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-audit_rules_etc_gshadow_open_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_etc_passwd_open" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record Events that Modify User/Group Information via open syscall - /etc/passwd</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The audit system should collect write events to /etc/passwd file for all users and root.
If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured
to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following lines to a file with suffix
<html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S open -F a1&amp;03 -F path=/etc/passwd -F auid&gt;=1000 -F auid!=unset -F key=modify</html:pre>
If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> file:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S open -F a1&amp;03 -F path=/etc/passwd -F auid&gt;=1000 -F auid!=unset -F key=modify</html:pre>
If the system is 64 bit then also add the following line:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b64 -S open -F a1&amp;03 -F path=/etc/passwd -F auid&gt;=1000 -F auid!=unset -F key=modify</html:pre></description>
          <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping system calls related
to the same event is more efficient. See the following example:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S open -F a1&amp;03 -F path=/etc/passwd -F auid&gt;=1000 -F auid!=unset -F key=modify</html:pre></warning>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-2(4)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Creation of users through direct edition of /etc/passwd could be an indicator of malicious activity on a system.
Auditing these events could serve as evidence of potential system compromise.</rationale>
          <platform idref="cpe:/a:machine"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_etc_passwd_open" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then



# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	PATTERN="-a always,exit -F arch=$ARCH -S open -F a1&amp;03 -F path=/etc/passwd.*"
	GROUP="modify"
	FULL_RULE="-a always,exit -F arch=$ARCH -S open -F a1&amp;03 -F path=/etc/passwd -F auid&gt;=1000 -F auid!=unset -F key=modify"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_fix_audit_syscall_rule" use="legacy"/>
	fix_audit_syscall_rule "auditctl" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
	fix_audit_syscall_rule "augenrules" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_etc_passwd_open" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="low" strategy="restrict">- name: Set architecture for audit open tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_etc_passwd_open
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Search /etc/audit/rules.d for other DAC audit rules
  find:
    paths: /etc/audit/rules.d
    recurse: false
    contains: .*open(,[\S]+)?[\s]+-F[\s]+a1&amp;03[\s]+-F[\s]+path=/etc/passwd.*
    patterns: '*.rules'
  register: find_open
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_etc_passwd_open
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: If existing DAC ruleset not found, use /etc/audit/rules.d/modify.rules as
    the recipient for the rule
  set_fact:
    all_files:
      - /etc/audit/rules.d/modify.rules
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_open.matched is defined and find_open.matched == 0
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_etc_passwd_open
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
      - '{{ find_open.files | map(attribute=''path'') | list | first }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_open.matched is defined and find_open.matched &gt; 0
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_etc_passwd_open
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the open rule in rules.d when on x86
  lineinfile:
    path: '{{ all_files[0] }}'
    line: '{{ item }}'
    create: true
    regexp: -a always,exit -F arch=b32 -S open -F a1&amp;03 -F path=/etc/passwd -F auid&gt;=1000
      -F auid!=unset -F key=[\S]+
  with_items:
    - -a always,exit -F arch=b32 -S open -F a1&amp;03 -F path=/etc/passwd -F auid&gt;=1000
      -F auid!=unset -F key=modify
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_etc_passwd_open
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the open rule in rules.d when on x86_64
  lineinfile:
    path: '{{ all_files[0] }}'
    line: '{{ item }}'
    create: true
    regexp: -a always,exit -F arch=b64 -S open -F a1&amp;03 -F path=/etc/passwd -F auid&gt;=1000
      -F auid!=unset -F key=[\S]+
  with_items:
    - -a always,exit -F arch=b64 -S open -F a1&amp;03 -F path=/etc/passwd -F auid&gt;=1000
      -F auid!=unset -F key=modify
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - audit_arch is defined and audit_arch == 'b64'
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_etc_passwd_open
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the open rule in /etc/audit/audit.rules when on x86
  lineinfile:
    line: '{{ item }}'
    state: present
    dest: /etc/audit/audit.rules
    create: true
    regexp: -a always,exit -F arch=b32 -S open -F a1&amp;03 -F path=/etc/passwd -F auid&gt;=1000
      -F auid!=unset -F key=[\S]+
  with_items:
    - -a always,exit -F arch=b32 -S open -F a1&amp;03 -F path=/etc/passwd -F auid&gt;=1000
      -F auid!=unset -F key=modify
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_etc_passwd_open
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the open rule in audit.rules when on x86_64
  lineinfile:
    line: '{{ item }}'
    state: present
    dest: /etc/audit/audit.rules
    create: true
    regexp: -a always,exit -F arch=b64 -S open -F a1&amp;03 -F path=/etc/passwd -F auid&gt;=1000
      -F auid!=unset -F key=[\S]+
  with_items:
    - -a always,exit -F arch=b64 -S open -F a1&amp;03 -F path=/etc/passwd -F auid&gt;=1000
      -F auid!=unset -F key=modify
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - audit_arch is defined and audit_arch == 'b64'
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_etc_passwd_open
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-audit_rules_etc_passwd_open:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-audit_rules_etc_passwd_open_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_media_export" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure auditd Collects Information on Exporting to Media (successful)</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">At a minimum, the audit system should collect media exportation
events for all users and root. If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to
use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program to read audit rules during daemon startup
(the default), add the following line to a file with suffix <html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in
the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>, setting ARCH to either b32 or b64 as
appropriate for your system:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=ARCH -S mount -F auid&gt;=1000 -F auid!=unset -F key=export</html:pre>
If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the following line to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> file, setting ARCH to either b32 or b64 as
appropriate for your system:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=ARCH -S mount -F auid&gt;=1000 -F auid!=unset -F key=export</html:pre></description>
          <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-000135</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</reference>
          <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.2.7</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.10</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.2.6.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO12.06</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI08.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS01.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.11.2.6</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.4.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.4.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.4.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.4.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.7.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.2.7</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.15.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.15.2.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.16.1.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.16.1.5</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.16.1.7</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.6.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.6.2.2</reference>
          <reference href="https://www.cisecurity.org/controls/">1</reference>
          <reference href="https://www.cisecurity.org/controls/">11</reference>
          <reference href="https://www.cisecurity.org/controls/">12</reference>
          <reference href="https://www.cisecurity.org/controls/">13</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">16</reference>
          <reference href="https://www.cisecurity.org/controls/">19</reference>
          <reference href="https://www.cisecurity.org/controls/">2</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">4</reference>
          <reference href="https://www.cisecurity.org/controls/">5</reference>
          <reference href="https://www.cisecurity.org/controls/">6</reference>
          <reference href="https://www.cisecurity.org/controls/">7</reference>
          <reference href="https://www.cisecurity.org/controls/">8</reference>
          <reference href="https://www.cisecurity.org/controls/">9</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The unauthorized exportation of data to external media could result in an information leak
where classified information, Privacy Act information, and intellectual property could be lost. An audit
trail should be created each time a filesystem is mounted to help identify and guard against information
loss.</rationale>
          <platform idref="cpe:/a:machine"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_media_export" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then



# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	PATTERN="-a always,exit -F arch=$ARCH -S mount.*"
	GROUP="perm_mod"
	FULL_RULE="-a always,exit -F arch=$ARCH -S mount -F auid&gt;=1000 -F auid!=unset -F key=perm_mod"

	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_fix_audit_syscall_rule" use="legacy"/>
	fix_audit_syscall_rule "augenrules" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
	fix_audit_syscall_rule "auditctl" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_media_export" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="low" strategy="restrict">- name: Set architecture for audit mount tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.7
    - audit_rules_media_export
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Search /etc/audit/rules.d for other DAC audit rules
  find:
    paths: /etc/audit/rules.d
    recurse: false
    contains: -F key=perm_mod$
    patterns: '*.rules'
  register: find_mount
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.7
    - audit_rules_media_export
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: If existing DAC ruleset not found, use /etc/audit/rules.d/privileged.rules
    as the recipient for the rule
  set_fact:
    all_files:
      - /etc/audit/rules.d/privileged.rules
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_mount.matched is defined and find_mount.matched == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.7
    - audit_rules_media_export
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
      - '{{ find_mount.files | map(attribute=''path'') | list | first }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_mount.matched is defined and find_mount.matched &gt; 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.7
    - audit_rules_media_export
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the mount rule in rules.d when on x86
  lineinfile:
    path: '{{ all_files[0] }}'
    line: -a always,exit -F arch=b32 -S mount -F auid&gt;=1000 -F auid!=unset -F key=perm_mod
    create: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.7
    - audit_rules_media_export
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the mount rule in rules.d when on x86_64
  lineinfile:
    path: '{{ all_files[0] }}'
    line: -a always,exit -F arch=b64 -S mount -F auid&gt;=1000 -F auid!=unset -F key=perm_mod
    create: true
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - audit_arch is defined and audit_arch == 'b64'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.7
    - audit_rules_media_export
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the mount rule in /etc/audit/audit.rules when on x86
  lineinfile:
    line: -a always,exit -F arch=b32 -S mount -F auid&gt;=1000 -F auid!=unset -F key=perm_mod
    state: present
    dest: /etc/audit/audit.rules
    create: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.7
    - audit_rules_media_export
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the mount rule in audit.rules when on x86_64
  lineinfile:
    line: -a always,exit -F arch=b64 -S mount -F auid&gt;=1000 -F auid!=unset -F key=perm_mod
    state: present
    dest: /etc/audit/audit.rules
    create: true
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - audit_arch is defined and audit_arch == 'b64'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.7
    - audit_rules_media_export
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-audit_rules_media_export:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-audit_rules_media_export_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification_opasswd" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record Events that Modify User/Group Information - /etc/security/opasswd</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the
<html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program to read audit rules during daemon startup (the
default), add the following lines to a file with suffix <html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the
directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>, in order to capture events that modify
account changes:
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-w /etc/security/opasswd -p wa -k audit_rules_usergroup_modification</html:pre>
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> file, in order to capture events that modify
account changes:
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-w /etc/security/opasswd -p wa -k audit_rules_usergroup_modification</html:pre></description>
          <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-000018</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-001403</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-001404</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-001405</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-001683</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-001684</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-001685</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-001686</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-002130</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-002132</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-2(4)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</reference>
          <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</reference>
          <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.2.5</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000004-GPOS-00004</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000239-GPOS-00089</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000240-GPOS-00090</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000241-GPOS-00091</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000303-GPOS-00120</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000463-GPOS-00207</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000476-GPOS-00221</reference>
          <reference href="">SRG-OS-000004-VMM-000040</reference>
          <reference href="">SRG-OS-000239-VMM-000810</reference>
          <reference href="">SRG-OS-000240-VMM-000820</reference>
          <reference href="">SRG-OS-000241-VMM-000830</reference>
          <reference href="">SRG-OS-000274-VMM-000960</reference>
          <reference href="">SRG-OS-000275-VMM-000970</reference>
          <reference href="">SRG-OS-000276-VMM-000980</reference>
          <reference href="">SRG-OS-000277-VMM-000990</reference>
          <reference href="">SRG-OS-000303-VMM-001090</reference>
          <reference href="">SRG-OS-000304-VMM-001100</reference>
          <reference href="">SRG-OS-000476-VMM-001960</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.10</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.2.6.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.2.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO12.06</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI08.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS01.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.11.2.6</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.4.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.4.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.4.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.4.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.7.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.2.7</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.15.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.15.2.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.16.1.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.16.1.5</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.16.1.7</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.6.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.6.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.6.2.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.7.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.6</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.3.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.5</reference>
          <reference href="https://www.cisecurity.org/controls/">1</reference>
          <reference href="https://www.cisecurity.org/controls/">11</reference>
          <reference href="https://www.cisecurity.org/controls/">12</reference>
          <reference href="https://www.cisecurity.org/controls/">13</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">16</reference>
          <reference href="https://www.cisecurity.org/controls/">18</reference>
          <reference href="https://www.cisecurity.org/controls/">19</reference>
          <reference href="https://www.cisecurity.org/controls/">2</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">4</reference>
          <reference href="https://www.cisecurity.org/controls/">5</reference>
          <reference href="https://www.cisecurity.org/controls/">6</reference>
          <reference href="https://www.cisecurity.org/controls/">7</reference>
          <reference href="https://www.cisecurity.org/controls/">8</reference>
          <reference href="https://www.cisecurity.org/controls/">9</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">In addition to auditing new user and group accounts, these watches
will alert the system administrator(s) to any modifications. Any unexpected
users, groups, or modifications should be investigated for legitimacy.</rationale>
          <platform idref="cpe:/a:machine"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_usergroup_modification_opasswd" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then



# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_fix_audit_watch_rule" use="legacy"/>
fix_audit_watch_rule "auditctl" "/etc/security/opasswd" "wa" "audit_rules_usergroup_modification"
fix_audit_watch_rule "augenrules" "/etc/security/opasswd" "wa" "audit_rules_usergroup_modification"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_usergroup_modification_opasswd" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="low" strategy="restrict">- name: Set architecture for audit opasswd tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - audit_rules_usergroup_modification_opasswd
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Search /etc/audit/rules.d for other user/group modification audit rules
  find:
    paths: /etc/audit/rules.d
    recurse: false
    contains: -k audit_rules_usergroup_modification$
    patterns: '*.rules'
  register: find_opasswd
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - audit_rules_usergroup_modification_opasswd
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: If existing user/group modification ruleset not found, use /etc/audit/rules.d/privileged.rules
    as the recipient for the rule
  set_fact:
    all_files:
      - /etc/audit/rules.d/privileged.rules
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_opasswd.matched is defined and find_opasswd.matched == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - audit_rules_usergroup_modification_opasswd
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
      - '{{ find_opasswd.files | map(attribute=''path'') | list | first }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_opasswd.matched is defined and find_opasswd.matched &gt; 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - audit_rules_usergroup_modification_opasswd
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the opasswd rule in rules.d when on x86
  lineinfile:
    path: '{{ all_files[0] }}'
    line: -w /etc/security/opasswd -p wa -k audit_rules_usergroup_modification
    create: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - audit_rules_usergroup_modification_opasswd
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the opasswd rule in /etc/audit/audit.rules
  lineinfile:
    line: -w /etc/security/opasswd -p wa -k audit_rules_usergroup_modification
    state: present
    dest: /etc/audit/audit.rules
    create: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - audit_rules_usergroup_modification_opasswd
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-audit_rules_usergroup_modification_opasswd:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-audit_rules_usergroup_modification_opasswd_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_session_events" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record Attempts to Alter Process and Session Initiation Information</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The audit system already collects process information for all
users and root. If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the
<html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program to read audit rules during daemon startup (the
default), add the following lines to a file with suffix <html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the
directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code> in order to watch for attempted manual
edits of files involved in storing such process information:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-w /var/run/utmp -p wa -k session
-w /var/log/btmp -p wa -k session
-w /var/log/wtmp -p wa -k session</html:pre>
If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> file in order to watch for attempted manual
edits of files involved in storing such process information:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-w /var/run/utmp -p wa -k session
-w /var/log/btmp -p wa -k session
-w /var/log/wtmp -p wa -k session</html:pre></description>
          <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</reference>
          <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</reference>
          <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.2.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.10</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.2.6.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO12.06</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI08.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS01.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.11.2.6</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.4.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.4.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.4.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.4.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.7.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.2.7</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.15.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.15.2.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.16.1.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.16.1.5</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.16.1.7</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.6.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.6.2.2</reference>
          <reference href="https://www.cisecurity.org/controls/">1</reference>
          <reference href="https://www.cisecurity.org/controls/">11</reference>
          <reference href="https://www.cisecurity.org/controls/">12</reference>
          <reference href="https://www.cisecurity.org/controls/">13</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">16</reference>
          <reference href="https://www.cisecurity.org/controls/">19</reference>
          <reference href="https://www.cisecurity.org/controls/">2</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">4</reference>
          <reference href="https://www.cisecurity.org/controls/">5</reference>
          <reference href="https://www.cisecurity.org/controls/">6</reference>
          <reference href="https://www.cisecurity.org/controls/">7</reference>
          <reference href="https://www.cisecurity.org/controls/">8</reference>
          <reference href="https://www.cisecurity.org/controls/">9</reference>
          <reference href="">0582</reference>
          <reference href="">0584</reference>
          <reference href="">05885</reference>
          <reference href="">0586</reference>
          <reference href="">0846</reference>
          <reference href="">0957</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Manual editing of these files may indicate nefarious activity, such
as an attacker attempting to remove evidence of an intrusion.</rationale>
          <platform idref="cpe:/a:machine"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_session_events" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then



# Perform the remediation
# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_fix_audit_watch_rule" use="legacy"/>
fix_audit_watch_rule "auditctl" "/var/run/utmp" "wa" "session"
fix_audit_watch_rule "augenrules" "/var/run/utmp" "wa" "session"
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_fix_audit_watch_rule" use="legacy"/>
fix_audit_watch_rule "auditctl" "/var/log/btmp" "wa" "session"
fix_audit_watch_rule "augenrules" "/var/log/btmp" "wa" "session"
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_fix_audit_watch_rule" use="legacy"/>
fix_audit_watch_rule "auditctl" "/var/log/wtmp" "wa" "session"
fix_audit_watch_rule "augenrules" "/var/log/wtmp" "wa" "session"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_session_events" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="low" strategy="restrict">- name: Check if watch rule for /var/run/utmp already exists in /etc/audit/rules.d/
  find:
    paths: /etc/audit/rules.d
    contains: ^\s*-w\s+/var/run/utmp\s+-p\s+wa(\s|$)+
    patterns: '*.rules'
  register: find_existing_watch_rules_d
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.3
    - audit_rules_session_events
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Search /etc/audit/rules.d for other rules with specified key session
  find:
    paths: /etc/audit/rules.d
    contains: ^.*(?:-F key=|-k\s+)session$
    patterns: '*.rules'
  register: find_watch_key
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
      == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.3
    - audit_rules_session_events
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Use /etc/audit/rules.d/session.rules as the recipient for the rule
  set_fact:
    all_files:
      - /etc/audit/rules.d/session.rules
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_watch_key.matched is defined and find_watch_key.matched == 0 and find_existing_watch_rules_d.matched
      is defined and find_existing_watch_rules_d.matched == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.3
    - audit_rules_session_events
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
      - '{{ find_watch_key.files | map(attribute=''path'') | list | first }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_watch_key.matched is defined and find_watch_key.matched &gt; 0 and find_existing_watch_rules_d.matched
      is defined and find_existing_watch_rules_d.matched == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.3
    - audit_rules_session_events
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Add watch rule for /var/run/utmp in /etc/audit/rules.d/
  lineinfile:
    path: '{{ all_files[0] }}'
    line: -w /var/run/utmp -p wa -k session
    create: true
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
      == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.3
    - audit_rules_session_events
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Check if watch rule for /var/run/utmp already exists in /etc/audit/audit.rules
  find:
    paths: /etc/audit/
    contains: ^\s*-w\s+/var/run/utmp\s+-p\s+wa(\s|$)+
    patterns: audit.rules
  register: find_existing_watch_audit_rules
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.3
    - audit_rules_session_events
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Add watch rule for /var/run/utmp in /etc/audit/audit.rules
  lineinfile:
    line: -w /var/run/utmp -p wa -k session
    state: present
    dest: /etc/audit/audit.rules
    create: true
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_existing_watch_audit_rules.matched is defined and find_existing_watch_audit_rules.matched
      == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.3
    - audit_rules_session_events
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Check if watch rule for /var/log/btmp already exists in /etc/audit/rules.d/
  find:
    paths: /etc/audit/rules.d
    contains: ^\s*-w\s+/var/log/btmp\s+-p\s+wa(\s|$)+
    patterns: '*.rules'
  register: find_existing_watch_rules_d
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.3
    - audit_rules_session_events
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Search /etc/audit/rules.d for other rules with specified key session
  find:
    paths: /etc/audit/rules.d
    contains: ^.*(?:-F key=|-k\s+)session$
    patterns: '*.rules'
  register: find_watch_key
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
      == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.3
    - audit_rules_session_events
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Use /etc/audit/rules.d/session.rules as the recipient for the rule
  set_fact:
    all_files:
      - /etc/audit/rules.d/session.rules
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_watch_key.matched is defined and find_watch_key.matched == 0 and find_existing_watch_rules_d.matched
      is defined and find_existing_watch_rules_d.matched == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.3
    - audit_rules_session_events
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
      - '{{ find_watch_key.files | map(attribute=''path'') | list | first }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_watch_key.matched is defined and find_watch_key.matched &gt; 0 and find_existing_watch_rules_d.matched
      is defined and find_existing_watch_rules_d.matched == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.3
    - audit_rules_session_events
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Add watch rule for /var/log/btmp in /etc/audit/rules.d/
  lineinfile:
    path: '{{ all_files[0] }}'
    line: -w /var/log/btmp -p wa -k session
    create: true
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
      == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.3
    - audit_rules_session_events
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Check if watch rule for /var/log/btmp already exists in /etc/audit/audit.rules
  find:
    paths: /etc/audit/
    contains: ^\s*-w\s+/var/log/btmp\s+-p\s+wa(\s|$)+
    patterns: audit.rules
  register: find_existing_watch_audit_rules
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.3
    - audit_rules_session_events
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Add watch rule for /var/log/btmp in /etc/audit/audit.rules
  lineinfile:
    line: -w /var/log/btmp -p wa -k session
    state: present
    dest: /etc/audit/audit.rules
    create: true
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_existing_watch_audit_rules.matched is defined and find_existing_watch_audit_rules.matched
      == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.3
    - audit_rules_session_events
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Check if watch rule for /var/log/wtmp already exists in /etc/audit/rules.d/
  find:
    paths: /etc/audit/rules.d
    contains: ^\s*-w\s+/var/log/wtmp\s+-p\s+wa(\s|$)+
    patterns: '*.rules'
  register: find_existing_watch_rules_d
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.3
    - audit_rules_session_events
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Search /etc/audit/rules.d for other rules with specified key session
  find:
    paths: /etc/audit/rules.d
    contains: ^.*(?:-F key=|-k\s+)session$
    patterns: '*.rules'
  register: find_watch_key
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
      == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.3
    - audit_rules_session_events
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Use /etc/audit/rules.d/session.rules as the recipient for the rule
  set_fact:
    all_files:
      - /etc/audit/rules.d/session.rules
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_watch_key.matched is defined and find_watch_key.matched == 0 and find_existing_watch_rules_d.matched
      is defined and find_existing_watch_rules_d.matched == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.3
    - audit_rules_session_events
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
      - '{{ find_watch_key.files | map(attribute=''path'') | list | first }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_watch_key.matched is defined and find_watch_key.matched &gt; 0 and find_existing_watch_rules_d.matched
      is defined and find_existing_watch_rules_d.matched == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.3
    - audit_rules_session_events
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Add watch rule for /var/log/wtmp in /etc/audit/rules.d/
  lineinfile:
    path: '{{ all_files[0] }}'
    line: -w /var/log/wtmp -p wa -k session
    create: true
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
      == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.3
    - audit_rules_session_events
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Check if watch rule for /var/log/wtmp already exists in /etc/audit/audit.rules
  find:
    paths: /etc/audit/
    contains: ^\s*-w\s+/var/log/wtmp\s+-p\s+wa(\s|$)+
    patterns: audit.rules
  register: find_existing_watch_audit_rules
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.3
    - audit_rules_session_events
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Add watch rule for /var/log/wtmp in /etc/audit/audit.rules
  lineinfile:
    line: -w /var/log/wtmp -p wa -k session
    state: present
    dest: /etc/audit/audit.rules
    create: true
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_existing_watch_audit_rules.matched is defined and find_existing_watch_audit_rules.matched
      == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.3
    - audit_rules_session_events
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_session_events" system="urn:xccdf:fix:script:kubernetes" reboot="true" complexity="low" disruption="low" strategy="restrict">

apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,%0A-w%20/var/run/utmp%20-p%20wa%20-k%20session%0A-w%20/var/log/btmp%20-p%20wa%20-k%20session%0A-w%20/var/log/wtmp%20-p%20wa%20-k%20session%0A
        mode: 0600
        path: /etc/audit/rules.d/75-audit-session-events.rules
        overwrite: true
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-audit_rules_session_events:def:1" href="ssg-fedora-oval.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_directory_permissions_var_log_audit" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">System Audit Logs Must Have Mode 0750 or Less Permissive</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">If <html:code xmlns:html="http://www.w3.org/1999/xhtml">log_group</html:code> in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/auditd.conf</html:code> is set to a group other than the <html:code xmlns:html="http://www.w3.org/1999/xhtml">root</html:code>
group account, change the mode of the audit log files with the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo chmod 0750 /var/log/audit</html:pre>
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Otherwise, change the mode of the audit log files with the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo chmod 0700 /var/log/audit</html:pre></description>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-9</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.10</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO12.06</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI08.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.10.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.11.1.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.11.1.5</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.11.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.4.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.4.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.4.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.4.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.7.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.1.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.2.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.16.1.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.16.1.5</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.16.1.7</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.6.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.7.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.7.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.7.3.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.8.2.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.8.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.5</reference>
          <reference href="https://www.cisecurity.org/controls/">1</reference>
          <reference href="https://www.cisecurity.org/controls/">11</reference>
          <reference href="https://www.cisecurity.org/controls/">12</reference>
          <reference href="https://www.cisecurity.org/controls/">13</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">16</reference>
          <reference href="https://www.cisecurity.org/controls/">18</reference>
          <reference href="https://www.cisecurity.org/controls/">19</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">4</reference>
          <reference href="https://www.cisecurity.org/controls/">5</reference>
          <reference href="https://www.cisecurity.org/controls/">6</reference>
          <reference href="https://www.cisecurity.org/controls/">7</reference>
          <reference href="https://www.cisecurity.org/controls/">8</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000057-GPOS-00027</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000058-GPOS-00028</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000059-GPOS-00029</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-000162</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">If users can write to audit logs, audit trails can be modified or destroyed.</rationale>
          <platform idref="cpe:/a:machine"/>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-directory_permissions_var_log_audit:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-directory_permissions_var_log_audit_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification_passwd" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record Events that Modify User/Group Information - /etc/passwd</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the
<html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program to read audit rules during daemon startup (the
default), add the following lines to a file with suffix <html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the
directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>, in order to capture events that modify
account changes:
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-w /etc/passwd -p wa -k audit_rules_usergroup_modification</html:pre>
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> file, in order to capture events that modify
account changes:
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-w /etc/passwd -p wa -k audit_rules_usergroup_modification</html:pre></description>
          <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-000018</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-001403</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-001404</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-001405</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-001683</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-001684</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-001685</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-001686</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-002130</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-002132</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-2(4)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</reference>
          <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</reference>
          <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.2.5</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000004-GPOS-00004</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000239-GPOS-00089</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000240-GPOS-00090</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000241-GPOS-00091</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000274-GPOS-00104</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000275-GPOS-00105</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000276-GPOS-00106</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000277-GPOS-00107</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000303-GPOS-00120</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000476-GPOS-00221</reference>
          <reference href="">SRG-OS-000004-VMM-000040</reference>
          <reference href="">SRG-OS-000239-VMM-000810</reference>
          <reference href="">SRG-OS-000240-VMM-000820</reference>
          <reference href="">SRG-OS-000241-VMM-000830</reference>
          <reference href="">SRG-OS-000274-VMM-000960</reference>
          <reference href="">SRG-OS-000275-VMM-000970</reference>
          <reference href="">SRG-OS-000276-VMM-000980</reference>
          <reference href="">SRG-OS-000277-VMM-000990</reference>
          <reference href="">SRG-OS-000303-VMM-001090</reference>
          <reference href="">SRG-OS-000304-VMM-001100</reference>
          <reference href="">SRG-OS-000476-VMM-001960</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.10</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.2.6.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.2.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO12.06</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI08.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS01.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.11.2.6</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.4.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.4.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.4.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.4.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.7.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.2.7</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.15.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.15.2.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.16.1.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.16.1.5</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.16.1.7</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.6.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.6.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.6.2.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.7.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.6</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.3.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.5</reference>
          <reference href="https://www.cisecurity.org/controls/">1</reference>
          <reference href="https://www.cisecurity.org/controls/">11</reference>
          <reference href="https://www.cisecurity.org/controls/">12</reference>
          <reference href="https://www.cisecurity.org/controls/">13</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">16</reference>
          <reference href="https://www.cisecurity.org/controls/">18</reference>
          <reference href="https://www.cisecurity.org/controls/">19</reference>
          <reference href="https://www.cisecurity.org/controls/">2</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">4</reference>
          <reference href="https://www.cisecurity.org/controls/">5</reference>
          <reference href="https://www.cisecurity.org/controls/">6</reference>
          <reference href="https://www.cisecurity.org/controls/">7</reference>
          <reference href="https://www.cisecurity.org/controls/">8</reference>
          <reference href="https://www.cisecurity.org/controls/">9</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">In addition to auditing new user and group accounts, these watches
will alert the system administrator(s) to any modifications. Any unexpected
users, groups, or modifications should be investigated for legitimacy.</rationale>
          <platform idref="cpe:/a:machine"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_usergroup_modification_passwd" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then



# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_fix_audit_watch_rule" use="legacy"/>
fix_audit_watch_rule "auditctl" "/etc/passwd" "wa" "audit_rules_usergroup_modification"
fix_audit_watch_rule "augenrules" "/etc/passwd" "wa" "audit_rules_usergroup_modification"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_usergroup_modification_passwd" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="low" strategy="restrict">- name: Set architecture for audit passwd tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - audit_rules_usergroup_modification_passwd
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Search /etc/audit/rules.d for other user/group modification audit rules
  find:
    paths: /etc/audit/rules.d
    recurse: false
    contains: -k audit_rules_usergroup_modification$
    patterns: '*.rules'
  register: find_passwd
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - audit_rules_usergroup_modification_passwd
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: If existing user/group modification ruleset not found, use /etc/audit/rules.d/privileged.rules
    as the recipient for the rule
  set_fact:
    all_files:
      - /etc/audit/rules.d/privileged.rules
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_passwd.matched is defined and find_passwd.matched == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - audit_rules_usergroup_modification_passwd
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
      - '{{ find_passwd.files | map(attribute=''path'') | list | first }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_passwd.matched is defined and find_passwd.matched &gt; 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - audit_rules_usergroup_modification_passwd
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the passwd rule in rules.d when on x86
  lineinfile:
    path: '{{ all_files[0] }}'
    line: -w /etc/passwd -p wa -k audit_rules_usergroup_modification
    create: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - audit_rules_usergroup_modification_passwd
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the passwd rule in /etc/audit/audit.rules
  lineinfile:
    line: -w /etc/passwd -p wa -k audit_rules_usergroup_modification
    state: present
    dest: /etc/audit/audit.rules
    create: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - audit_rules_usergroup_modification_passwd
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-audit_rules_usergroup_modification_passwd:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-audit_rules_usergroup_modification_passwd_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record Events that Modify User/Group Information</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the
<html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program to read audit rules during daemon startup (the
default), add the following lines to a file with suffix <html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the
directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>, in order to capture events that modify
account changes:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-w /etc/group -p wa -k audit_rules_usergroup_modification
-w /etc/passwd -p wa -k audit_rules_usergroup_modification
-w /etc/gshadow -p wa -k audit_rules_usergroup_modification
-w /etc/shadow -p wa -k audit_rules_usergroup_modification
-w /etc/security/opasswd -p wa -k audit_rules_usergroup_modification</html:pre>
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> file, in order to capture events that modify
account changes:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-w /etc/group -p wa -k audit_rules_usergroup_modification
-w /etc/passwd -p wa -k audit_rules_usergroup_modification
-w /etc/gshadow -p wa -k audit_rules_usergroup_modification
-w /etc/shadow -p wa -k audit_rules_usergroup_modification
-w /etc/security/opasswd -p wa -k audit_rules_usergroup_modification</html:pre></description>
          <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">This rule checks for multiple syscalls related to account changes;
it was written with DISA STIG in mind. Other policies should use a
separate rule for each syscall that needs to be checked. For example:
<html:ul xmlns:html="http://www.w3.org/1999/xhtml"><html:li><html:code>audit_rules_usergroup_modification_group</html:code></html:li><html:li><html:code>audit_rules_usergroup_modification_gshadow</html:code></html:li><html:li><html:code>audit_rules_usergroup_modification_passwd</html:code></html:li></html:ul></warning>
          <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-000018</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-001403</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-002130</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-2(4)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</reference>
          <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.2.5</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000004-GPOS-00004</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000239-GPOS-00089</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000241-GPOS-00090</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000241-GPOS-00091</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000303-GPOS-00120</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000476-GPOS-00221</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.10</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.2.6.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.2.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO12.06</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI08.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS01.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.11.2.6</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.4.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.4.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.4.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.4.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.7.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.2.7</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.15.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.15.2.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.16.1.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.16.1.5</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.16.1.7</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.6.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.6.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.6.2.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.7.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.6</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.3.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.5</reference>
          <reference href="https://www.cisecurity.org/controls/">1</reference>
          <reference href="https://www.cisecurity.org/controls/">11</reference>
          <reference href="https://www.cisecurity.org/controls/">12</reference>
          <reference href="https://www.cisecurity.org/controls/">13</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">16</reference>
          <reference href="https://www.cisecurity.org/controls/">18</reference>
          <reference href="https://www.cisecurity.org/controls/">19</reference>
          <reference href="https://www.cisecurity.org/controls/">2</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">4</reference>
          <reference href="https://www.cisecurity.org/controls/">5</reference>
          <reference href="https://www.cisecurity.org/controls/">6</reference>
          <reference href="https://www.cisecurity.org/controls/">7</reference>
          <reference href="https://www.cisecurity.org/controls/">8</reference>
          <reference href="https://www.cisecurity.org/controls/">9</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">In addition to auditing new user and group accounts, these watches
will alert the system administrator(s) to any modifications. Any unexpected
users, groups, or modifications should be investigated for legitimacy.</rationale>
          <platform idref="cpe:/a:machine"/>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-audit_rules_usergroup_modification:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-audit_rules_usergroup_modification_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_etc_group_open" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record Events that Modify User/Group Information via open syscall - /etc/group</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The audit system should collect write events to /etc/group file for all users and root.
If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured
to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following lines to a file with suffix
<html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S open -F a1&amp;03 -F path=/etc/group -F auid&gt;=1000 -F auid!=unset -F key=modify</html:pre>
If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> file:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S open -F a1&amp;03 -F path=/etc/group -F auid&gt;=1000 -F auid!=unset -F key=modify</html:pre>
If the system is 64 bit then also add the following line:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b64 -S open -F a1&amp;03 -F path=/etc/group -F auid&gt;=1000 -F auid!=unset -F key=modify</html:pre></description>
          <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping system calls related
to the same event is more efficient. See the following example:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S open -F a1&amp;03 -F path=/etc/group -F auid&gt;=1000 -F auid!=unset -F key=modify</html:pre></warning>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-2(4)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Creation of groups through direct edition of /etc/group could be an indicator of malicious activity on a system.
Auditing these events could serve as evidence of potential system compromise.</rationale>
          <platform idref="cpe:/a:machine"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_etc_group_open" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then



# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	PATTERN="-a always,exit -F arch=$ARCH -S open -F a1&amp;03 -F path=/etc/group.*"
	GROUP="modify"
	FULL_RULE="-a always,exit -F arch=$ARCH -S open -F a1&amp;03 -F path=/etc/group -F auid&gt;=1000 -F auid!=unset -F key=modify"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_fix_audit_syscall_rule" use="legacy"/>
	fix_audit_syscall_rule "auditctl" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
	fix_audit_syscall_rule "augenrules" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_etc_group_open" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="low" strategy="restrict">- name: Set architecture for audit open tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_etc_group_open
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Search /etc/audit/rules.d for other DAC audit rules
  find:
    paths: /etc/audit/rules.d
    recurse: false
    contains: .*open(,[\S]+)?[\s]+-F[\s]+a1&amp;03[\s]+-F[\s]+path=/etc/group.*
    patterns: '*.rules'
  register: find_open
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_etc_group_open
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: If existing DAC ruleset not found, use /etc/audit/rules.d/modify.rules as
    the recipient for the rule
  set_fact:
    all_files:
      - /etc/audit/rules.d/modify.rules
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_open.matched is defined and find_open.matched == 0
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_etc_group_open
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
      - '{{ find_open.files | map(attribute=''path'') | list | first }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_open.matched is defined and find_open.matched &gt; 0
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_etc_group_open
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the open rule in rules.d when on x86
  lineinfile:
    path: '{{ all_files[0] }}'
    line: '{{ item }}'
    create: true
    regexp: -a always,exit -F arch=b32 -S open -F a1&amp;03 -F path=/etc/group -F auid&gt;=1000
      -F auid!=unset -F key=[\S]+
  with_items:
    - -a always,exit -F arch=b32 -S open -F a1&amp;03 -F path=/etc/group -F auid&gt;=1000
      -F auid!=unset -F key=modify
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_etc_group_open
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the open rule in rules.d when on x86_64
  lineinfile:
    path: '{{ all_files[0] }}'
    line: '{{ item }}'
    create: true
    regexp: -a always,exit -F arch=b64 -S open -F a1&amp;03 -F path=/etc/group -F auid&gt;=1000
      -F auid!=unset -F key=[\S]+
  with_items:
    - -a always,exit -F arch=b64 -S open -F a1&amp;03 -F path=/etc/group -F auid&gt;=1000
      -F auid!=unset -F key=modify
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - audit_arch is defined and audit_arch == 'b64'
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_etc_group_open
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the open rule in /etc/audit/audit.rules when on x86
  lineinfile:
    line: '{{ item }}'
    state: present
    dest: /etc/audit/audit.rules
    create: true
    regexp: -a always,exit -F arch=b32 -S open -F a1&amp;03 -F path=/etc/group -F auid&gt;=1000
      -F auid!=unset -F key=[\S]+
  with_items:
    - -a always,exit -F arch=b32 -S open -F a1&amp;03 -F path=/etc/group -F auid&gt;=1000
      -F auid!=unset -F key=modify
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_etc_group_open
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the open rule in audit.rules when on x86_64
  lineinfile:
    line: '{{ item }}'
    state: present
    dest: /etc/audit/audit.rules
    create: true
    regexp: -a always,exit -F arch=b64 -S open -F a1&amp;03 -F path=/etc/group -F auid&gt;=1000
      -F auid!=unset -F key=[\S]+
  with_items:
    - -a always,exit -F arch=b64 -S open -F a1&amp;03 -F path=/etc/group -F auid&gt;=1000
      -F auid!=unset -F key=modify
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - audit_arch is defined and audit_arch == 'b64'
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_etc_group_open
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-audit_rules_etc_group_open:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-audit_rules_etc_group_open_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification_gshadow" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record Events that Modify User/Group Information - /etc/gshadow</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the
<html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program to read audit rules during daemon startup (the
default), add the following lines to a file with suffix <html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the
directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>, in order to capture events that modify
account changes:
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-w /etc/gshadow -p wa -k audit_rules_usergroup_modification</html:pre>
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> file, in order to capture events that modify
account changes:
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-w /etc/gshadow -p wa -k audit_rules_usergroup_modification</html:pre></description>
          <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-000018</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-001403</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-001404</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-001405</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-001683</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-001684</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-001685</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-001686</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-002130</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-002132</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-2(4)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</reference>
          <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</reference>
          <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.2.5</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000004-GPOS-00004</reference>
          <reference href="">SRG-OS-000004-VMM-000040</reference>
          <reference href="">SRG-OS-000239-VMM-000810</reference>
          <reference href="">SRG-OS-000240-VMM-000820</reference>
          <reference href="">SRG-OS-000241-VMM-000830</reference>
          <reference href="">SRG-OS-000274-VMM-000960</reference>
          <reference href="">SRG-OS-000275-VMM-000970</reference>
          <reference href="">SRG-OS-000276-VMM-000980</reference>
          <reference href="">SRG-OS-000277-VMM-000990</reference>
          <reference href="">SRG-OS-000303-VMM-001090</reference>
          <reference href="">SRG-OS-000304-VMM-001100</reference>
          <reference href="">SRG-OS-000476-VMM-001960</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.10</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.2.6.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.2.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO12.06</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI08.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS01.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.11.2.6</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.4.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.4.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.4.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.4.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.7.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.2.7</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.15.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.15.2.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.16.1.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.16.1.5</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.16.1.7</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.6.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.6.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.6.2.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.7.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.6</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.3.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.5</reference>
          <reference href="https://www.cisecurity.org/controls/">1</reference>
          <reference href="https://www.cisecurity.org/controls/">11</reference>
          <reference href="https://www.cisecurity.org/controls/">12</reference>
          <reference href="https://www.cisecurity.org/controls/">13</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">16</reference>
          <reference href="https://www.cisecurity.org/controls/">18</reference>
          <reference href="https://www.cisecurity.org/controls/">19</reference>
          <reference href="https://www.cisecurity.org/controls/">2</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">4</reference>
          <reference href="https://www.cisecurity.org/controls/">5</reference>
          <reference href="https://www.cisecurity.org/controls/">6</reference>
          <reference href="https://www.cisecurity.org/controls/">7</reference>
          <reference href="https://www.cisecurity.org/controls/">8</reference>
          <reference href="https://www.cisecurity.org/controls/">9</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">In addition to auditing new user and group accounts, these watches
will alert the system administrator(s) to any modifications. Any unexpected
users, groups, or modifications should be investigated for legitimacy.</rationale>
          <platform idref="cpe:/a:machine"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_usergroup_modification_gshadow" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then



# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_fix_audit_watch_rule" use="legacy"/>
fix_audit_watch_rule "auditctl" "/etc/gshadow" "wa" "audit_rules_usergroup_modification"
fix_audit_watch_rule "augenrules" "/etc/gshadow" "wa" "audit_rules_usergroup_modification"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_usergroup_modification_gshadow" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="low" strategy="restrict">- name: Set architecture for audit gshadow tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - audit_rules_usergroup_modification_gshadow
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Search /etc/audit/rules.d for other user/group modification audit rules
  find:
    paths: /etc/audit/rules.d
    recurse: false
    contains: -k audit_rules_usergroup_modification$
    patterns: '*.rules'
  register: find_gshadow
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - audit_rules_usergroup_modification_gshadow
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: If existing user/group modification ruleset not found, use /etc/audit/rules.d/privileged.rules
    as the recipient for the rule
  set_fact:
    all_files:
      - /etc/audit/rules.d/privileged.rules
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_gshadow.matched is defined and find_gshadow.matched == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - audit_rules_usergroup_modification_gshadow
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
      - '{{ find_gshadow.files | map(attribute=''path'') | list | first }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_gshadow.matched is defined and find_gshadow.matched &gt; 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - audit_rules_usergroup_modification_gshadow
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the gshadow rule in rules.d when on x86
  lineinfile:
    path: '{{ all_files[0] }}'
    line: -w /etc/gshadow -p wa -k audit_rules_usergroup_modification
    create: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - audit_rules_usergroup_modification_gshadow
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the gshadow rule in /etc/audit/audit.rules
  lineinfile:
    line: -w /etc/gshadow -p wa -k audit_rules_usergroup_modification
    state: present
    dest: /etc/audit/audit.rules
    create: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - audit_rules_usergroup_modification_gshadow
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-audit_rules_usergroup_modification_gshadow:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-audit_rules_usergroup_modification_gshadow_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_file_permissions_var_log_audit" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">System Audit Logs Must Have Mode 0640 or Less Permissive</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">If <html:code xmlns:html="http://www.w3.org/1999/xhtml">log_group</html:code> in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/auditd.conf</html:code> is set to a group other than the <html:code xmlns:html="http://www.w3.org/1999/xhtml">root</html:code>
group account, change the mode of the audit log files with the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo chmod 0640 <html:i>audit_file</html:i></html:pre>
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Otherwise, change the mode of the audit log files with the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo chmod 0600 <html:i>audit_file</html:i></html:pre></description>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-000162</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-000163</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-000164</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-001314</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000057-GPOS-00027</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000058-GPOS-00028</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000059-GPOS-00029</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000206-GPOS-00084</reference>
          <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.3.1</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-9(4)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</reference>
          <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.10</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO12.06</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI08.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.10.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.11.1.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.11.1.5</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.11.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.4.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.4.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.4.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.4.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.7.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.1.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.2.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.16.1.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.16.1.5</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.16.1.7</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.6.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.7.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.7.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.7.3.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.8.2.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.8.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.5</reference>
          <reference href="https://www.cisecurity.org/controls/">1</reference>
          <reference href="https://www.cisecurity.org/controls/">11</reference>
          <reference href="https://www.cisecurity.org/controls/">12</reference>
          <reference href="https://www.cisecurity.org/controls/">13</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">16</reference>
          <reference href="https://www.cisecurity.org/controls/">18</reference>
          <reference href="https://www.cisecurity.org/controls/">19</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">4</reference>
          <reference href="https://www.cisecurity.org/controls/">5</reference>
          <reference href="https://www.cisecurity.org/controls/">6</reference>
          <reference href="https://www.cisecurity.org/controls/">7</reference>
          <reference href="https://www.cisecurity.org/controls/">8</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">If users can write to audit logs, audit trails can be modified or destroyed.</rationale>
          <platform idref="cpe:/a:machine"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_permissions_var_log_audit" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

if LC_ALL=C grep -m 1 -q ^log_group /etc/audit/auditd.conf; then
  GROUP=$(awk -F "=" '/log_group/ {print $2}' /etc/audit/auditd.conf | tr -d ' ')
  if ! [ "${GROUP}" == 'root' ] ; then
    chmod 0640 /var/log/audit/audit.log
    chmod 0440 /var/log/audit/audit.log.*
  else
    chmod 0600 /var/log/audit/audit.log
    chmod 0400 /var/log/audit/audit.log.*
  fi
else
  chmod 0600 /var/log/audit/audit.log
  chmod 0400 /var/log/audit/audit.log.*
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-file_permissions_var_log_audit:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-file_permissions_var_log_audit_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_etc_gshadow_open_by_handle_at" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record Events that Modify User/Group Information via open_by_handle_at syscall - /etc/gshadow</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The audit system should collect write events to /etc/gshadow file for all users and root.
If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured
to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following lines to a file with suffix
<html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S open_by_handle_at -F a2&amp;03 -F path=/etc/gshadow -F auid&gt;=1000 -F auid!=unset -F key=user-modify</html:pre>
If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> file:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S open_by_handle_at -F a2&amp;03 -F path=/etc/gshadow -F auid&gt;=1000 -F auid!=unset -F key=user-modify</html:pre>
If the system is 64 bit then also add the following line:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b64 -S open_by_handle_at -F a2&amp;03 -F path=/etc/gshadow -F auid&gt;=1000 -F auid!=unset -F key=user-modify</html:pre></description>
          <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping system calls related
to the same event is more efficient. See the following example:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&amp;03 -F path=/etc/gshadow -F auid&gt;=1000 -F auid!=unset -F key=user-modify</html:pre></warning>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-2(4)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Creation of users through direct edition of /etc/gshadow could be an indicator of malicious activity on a system.
Auditing these events could serve as evidence of potential system compromise.</rationale>
          <platform idref="cpe:/a:machine"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_etc_gshadow_open_by_handle_at" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then



# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	PATTERN="-a always,exit -F arch=$ARCH -S open_by_handle_at -F a2&amp;03 -F path=/etc/gshadow.*"
	GROUP="modify"
	FULL_RULE="-a always,exit -F arch=$ARCH -S open_by_handle_at -F a2&amp;03 -F path=/etc/gshadow -F auid&gt;=1000 -F auid!=unset -F key=modify"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_fix_audit_syscall_rule" use="legacy"/>
	fix_audit_syscall_rule "auditctl" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
	fix_audit_syscall_rule "augenrules" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_etc_gshadow_open_by_handle_at" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="low" strategy="restrict">- name: Set architecture for audit open_by_handle_at tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_etc_gshadow_open_by_handle_at
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Search /etc/audit/rules.d for other DAC audit rules
  find:
    paths: /etc/audit/rules.d
    recurse: false
    contains: .*open_by_handle_at(,[\S]+)?[\s]+-F[\s]+a2&amp;03[\s]+-F[\s]+path=/etc/gshadow.*
    patterns: '*.rules'
  register: find_open_by_handle_at
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_etc_gshadow_open_by_handle_at
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: If existing DAC ruleset not found, use /etc/audit/rules.d/modify.rules as
    the recipient for the rule
  set_fact:
    all_files:
      - /etc/audit/rules.d/modify.rules
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_open_by_handle_at.matched is defined and find_open_by_handle_at.matched
      == 0
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_etc_gshadow_open_by_handle_at
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
      - '{{ find_open_by_handle_at.files | map(attribute=''path'') | list | first
        }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_open_by_handle_at.matched is defined and find_open_by_handle_at.matched
      &gt; 0
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_etc_gshadow_open_by_handle_at
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the open_by_handle_at rule in rules.d when on x86
  lineinfile:
    path: '{{ all_files[0] }}'
    line: '{{ item }}'
    create: true
    regexp: -a always,exit -F arch=b32 -S open_by_handle_at -F a2&amp;03 -F path=/etc/gshadow
      -F auid&gt;=1000 -F auid!=unset -F key=[\S]+
  with_items:
    - -a always,exit -F arch=b32 -S open_by_handle_at -F a2&amp;03 -F path=/etc/gshadow
      -F auid&gt;=1000 -F auid!=unset -F key=modify
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_etc_gshadow_open_by_handle_at
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the open_by_handle_at rule in rules.d when on x86_64
  lineinfile:
    path: '{{ all_files[0] }}'
    line: '{{ item }}'
    create: true
    regexp: -a always,exit -F arch=b64 -S open_by_handle_at -F a2&amp;03 -F path=/etc/gshadow
      -F auid&gt;=1000 -F auid!=unset -F key=[\S]+
  with_items:
    - -a always,exit -F arch=b64 -S open_by_handle_at -F a2&amp;03 -F path=/etc/gshadow
      -F auid&gt;=1000 -F auid!=unset -F key=modify
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - audit_arch is defined and audit_arch == 'b64'
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_etc_gshadow_open_by_handle_at
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the open_by_handle_at rule in /etc/audit/audit.rules when
    on x86
  lineinfile:
    line: '{{ item }}'
    state: present
    dest: /etc/audit/audit.rules
    create: true
    regexp: -a always,exit -F arch=b32 -S open_by_handle_at -F a2&amp;03 -F path=/etc/gshadow
      -F auid&gt;=1000 -F auid!=unset -F key=[\S]+
  with_items:
    - -a always,exit -F arch=b32 -S open_by_handle_at -F a2&amp;03 -F path=/etc/gshadow
      -F auid&gt;=1000 -F auid!=unset -F key=modify
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_etc_gshadow_open_by_handle_at
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the open_by_handle_at rule in audit.rules when on x86_64
  lineinfile:
    line: '{{ item }}'
    state: present
    dest: /etc/audit/audit.rules
    create: true
    regexp: -a always,exit -F arch=b64 -S open_by_handle_at -F a2&amp;03 -F path=/etc/gshadow
      -F auid&gt;=1000 -F auid!=unset -F key=[\S]+
  with_items:
    - -a always,exit -F arch=b64 -S open_by_handle_at -F a2&amp;03 -F path=/etc/gshadow
      -F auid&gt;=1000 -F auid!=unset -F key=modify
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - audit_arch is defined and audit_arch == 'b64'
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_etc_gshadow_open_by_handle_at
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-audit_rules_etc_gshadow_open_by_handle_at:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-audit_rules_etc_gshadow_open_by_handle_at_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_etc_group_openat" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record Events that Modify User/Group Information via openat syscall - /etc/group</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The audit system should collect write events to /etc/group file for all users and root.
If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured
to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following lines to a file with suffix
<html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S openat -F a2&amp;03 -F path=/etc/group -F auid&gt;=1000 -F auid!=unset -F key=modify</html:pre>
If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> file:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S openat -F a2&amp;03 -F path=/etc/group -F auid&gt;=1000 -F auid!=unset -F key=modify</html:pre>
If the system is 64 bit then also add the following line:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b64 -S openat -F a2&amp;03 -F path=/etc/group -F auid&gt;=1000 -F auid!=unset -F key=modify</html:pre></description>
          <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping system calls related
to the same event is more efficient. See the following example:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&amp;03 -F path=/etc/group -F auid&gt;=1000 -F auid!=unset -F key=modify</html:pre></warning>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-2(4)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Creation of groups through direct edition of /etc/group could be an indicator of malicious activity on a system.
Auditing these events could serve as evidence of potential system compromise.</rationale>
          <platform idref="cpe:/a:machine"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_etc_group_openat" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then



# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	PATTERN="-a always,exit -F arch=$ARCH -S openat -F a2&amp;03 -F path=/etc/group.*"
	GROUP="modify"
	FULL_RULE="-a always,exit -F arch=$ARCH -S openat -F a2&amp;03 -F path=/etc/group -F auid&gt;=1000 -F auid!=unset -F key=modify"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_fix_audit_syscall_rule" use="legacy"/>
	fix_audit_syscall_rule "auditctl" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
	fix_audit_syscall_rule "augenrules" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_etc_group_openat" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="low" strategy="restrict">- name: Set architecture for audit openat tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_etc_group_openat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Search /etc/audit/rules.d for other DAC audit rules
  find:
    paths: /etc/audit/rules.d
    recurse: false
    contains: .*openat(,[\S]+)?[\s]+-F[\s]+a2&amp;03[\s]+-F[\s]+path=/etc/group.*
    patterns: '*.rules'
  register: find_openat
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_etc_group_openat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: If existing DAC ruleset not found, use /etc/audit/rules.d/modify.rules as
    the recipient for the rule
  set_fact:
    all_files:
      - /etc/audit/rules.d/modify.rules
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_openat.matched is defined and find_openat.matched == 0
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_etc_group_openat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
      - '{{ find_openat.files | map(attribute=''path'') | list | first }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_openat.matched is defined and find_openat.matched &gt; 0
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_etc_group_openat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the openat rule in rules.d when on x86
  lineinfile:
    path: '{{ all_files[0] }}'
    line: '{{ item }}'
    create: true
    regexp: -a always,exit -F arch=b32 -S openat -F a2&amp;03 -F path=/etc/group -F auid&gt;=1000
      -F auid!=unset -F key=[\S]+
  with_items:
    - -a always,exit -F arch=b32 -S openat -F a2&amp;03 -F path=/etc/group -F auid&gt;=1000
      -F auid!=unset -F key=modify
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_etc_group_openat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the openat rule in rules.d when on x86_64
  lineinfile:
    path: '{{ all_files[0] }}'
    line: '{{ item }}'
    create: true
    regexp: -a always,exit -F arch=b64 -S openat -F a2&amp;03 -F path=/etc/group -F auid&gt;=1000
      -F auid!=unset -F key=[\S]+
  with_items:
    - -a always,exit -F arch=b64 -S openat -F a2&amp;03 -F path=/etc/group -F auid&gt;=1000
      -F auid!=unset -F key=modify
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - audit_arch is defined and audit_arch == 'b64'
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_etc_group_openat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the openat rule in /etc/audit/audit.rules when on x86
  lineinfile:
    line: '{{ item }}'
    state: present
    dest: /etc/audit/audit.rules
    create: true
    regexp: -a always,exit -F arch=b32 -S openat -F a2&amp;03 -F path=/etc/group -F auid&gt;=1000
      -F auid!=unset -F key=[\S]+
  with_items:
    - -a always,exit -F arch=b32 -S openat -F a2&amp;03 -F path=/etc/group -F auid&gt;=1000
      -F auid!=unset -F key=modify
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_etc_group_openat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the openat rule in audit.rules when on x86_64
  lineinfile:
    line: '{{ item }}'
    state: present
    dest: /etc/audit/audit.rules
    create: true
    regexp: -a always,exit -F arch=b64 -S openat -F a2&amp;03 -F path=/etc/group -F auid&gt;=1000
      -F auid!=unset -F key=[\S]+
  with_items:
    - -a always,exit -F arch=b64 -S openat -F a2&amp;03 -F path=/etc/group -F auid&gt;=1000
      -F auid!=unset -F key=modify
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - audit_arch is defined and audit_arch == 'b64'
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_etc_group_openat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-audit_rules_etc_group_openat:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-audit_rules_etc_group_openat_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_etc_gshadow_openat" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record Events that Modify User/Group Information via openat syscall - /etc/gshadow</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The audit system should collect write events to /etc/gshadow file for all users and root.
If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured
to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following lines to a file with suffix
<html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S openat -F a2&amp;03 -F path=/etc/gshadow -F auid&gt;=1000 -F auid!=unset -F key=user-modify</html:pre>
If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> file:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S openat -F a2&amp;03 -F path=/etc/gshadow -F auid&gt;=1000 -F auid!=unset -F key=user-modify</html:pre>
If the system is 64 bit then also add the following line:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b64 -S openat -F a2&amp;03 -F path=/etc/gshadow -F auid&gt;=1000 -F auid!=unset -F key=user-modify</html:pre></description>
          <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping system calls related
to the same event is more efficient. See the following example:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&amp;03 -F path=/etc/gshadow -F auid&gt;=1000 -F auid!=unset -F key=user-modify</html:pre></warning>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-2(4)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Creation of users through direct edition of /etc/gshadow could be an indicator of malicious activity on a system.
Auditing these events could serve as evidence of potential system compromise.</rationale>
          <platform idref="cpe:/a:machine"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_etc_gshadow_openat" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then



# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	PATTERN="-a always,exit -F arch=$ARCH -S openat -F a2&amp;03 -F path=/etc/gshadow.*"
	GROUP="modify"
	FULL_RULE="-a always,exit -F arch=$ARCH -S openat -F a2&amp;03 -F path=/etc/gshadow -F auid&gt;=1000 -F auid!=unset -F key=modify"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_fix_audit_syscall_rule" use="legacy"/>
	fix_audit_syscall_rule "auditctl" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
	fix_audit_syscall_rule "augenrules" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_etc_gshadow_openat" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="low" strategy="restrict">- name: Set architecture for audit openat tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_etc_gshadow_openat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Search /etc/audit/rules.d for other DAC audit rules
  find:
    paths: /etc/audit/rules.d
    recurse: false
    contains: .*openat(,[\S]+)?[\s]+-F[\s]+a2&amp;03[\s]+-F[\s]+path=/etc/gshadow.*
    patterns: '*.rules'
  register: find_openat
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_etc_gshadow_openat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: If existing DAC ruleset not found, use /etc/audit/rules.d/modify.rules as
    the recipient for the rule
  set_fact:
    all_files:
      - /etc/audit/rules.d/modify.rules
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_openat.matched is defined and find_openat.matched == 0
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_etc_gshadow_openat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
      - '{{ find_openat.files | map(attribute=''path'') | list | first }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_openat.matched is defined and find_openat.matched &gt; 0
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_etc_gshadow_openat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the openat rule in rules.d when on x86
  lineinfile:
    path: '{{ all_files[0] }}'
    line: '{{ item }}'
    create: true
    regexp: -a always,exit -F arch=b32 -S openat -F a2&amp;03 -F path=/etc/gshadow -F
      auid&gt;=1000 -F auid!=unset -F key=[\S]+
  with_items:
    - -a always,exit -F arch=b32 -S openat -F a2&amp;03 -F path=/etc/gshadow -F auid&gt;=1000
      -F auid!=unset -F key=modify
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_etc_gshadow_openat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the openat rule in rules.d when on x86_64
  lineinfile:
    path: '{{ all_files[0] }}'
    line: '{{ item }}'
    create: true
    regexp: -a always,exit -F arch=b64 -S openat -F a2&amp;03 -F path=/etc/gshadow -F
      auid&gt;=1000 -F auid!=unset -F key=[\S]+
  with_items:
    - -a always,exit -F arch=b64 -S openat -F a2&amp;03 -F path=/etc/gshadow -F auid&gt;=1000
      -F auid!=unset -F key=modify
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - audit_arch is defined and audit_arch == 'b64'
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_etc_gshadow_openat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the openat rule in /etc/audit/audit.rules when on x86
  lineinfile:
    line: '{{ item }}'
    state: present
    dest: /etc/audit/audit.rules
    create: true
    regexp: -a always,exit -F arch=b32 -S openat -F a2&amp;03 -F path=/etc/gshadow -F
      auid&gt;=1000 -F auid!=unset -F key=[\S]+
  with_items:
    - -a always,exit -F arch=b32 -S openat -F a2&amp;03 -F path=/etc/gshadow -F auid&gt;=1000
      -F auid!=unset -F key=modify
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_etc_gshadow_openat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the openat rule in audit.rules when on x86_64
  lineinfile:
    line: '{{ item }}'
    state: present
    dest: /etc/audit/audit.rules
    create: true
    regexp: -a always,exit -F arch=b64 -S openat -F a2&amp;03 -F path=/etc/gshadow -F
      auid&gt;=1000 -F auid!=unset -F key=[\S]+
  with_items:
    - -a always,exit -F arch=b64 -S openat -F a2&amp;03 -F path=/etc/gshadow -F auid&gt;=1000
      -F auid!=unset -F key=modify
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - audit_arch is defined and audit_arch == 'b64'
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_etc_gshadow_openat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-audit_rules_etc_gshadow_openat:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-audit_rules_etc_gshadow_openat_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_etc_passwd_open_by_handle_at" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record Events that Modify User/Group Information via open_by_handle_at syscall - /etc/passwd</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The audit system should collect write events to /etc/passwd file for all users and root.
If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured
to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following lines to a file with suffix
<html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S open_by_handle_at -F a2&amp;03 -F path=/etc/passwd -F auid&gt;=1000 -F auid!=unset -F key=modify</html:pre>
If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> file:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S open_by_handle_at -F a2&amp;03 -F path=/etc/passwd -F auid&gt;=1000 -F auid!=unset -F key=modify</html:pre>
If the system is 64 bit then also add the following line:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b64 -S open_by_handle_at -F a2&amp;03 -F path=/etc/passwd -F auid&gt;=1000 -F auid!=unset -F key=modify</html:pre></description>
          <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping system calls related
to the same event is more efficient. See the following example:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&amp;03 -F path=/etc/passwd -F auid&gt;=1000 -F auid!=unset -F key=modify</html:pre></warning>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-2(4)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Creation of users through direct edition of /etc/passwd could be an indicator of malicious activity on a system.
Auditing these events could serve as evidence of potential system compromise.</rationale>
          <platform idref="cpe:/a:machine"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_etc_passwd_open_by_handle_at" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then



# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	PATTERN="-a always,exit -F arch=$ARCH -S open_by_handle_at -F a2&amp;03 -F path=/etc/passwd.*"
	GROUP="modify"
	FULL_RULE="-a always,exit -F arch=$ARCH -S open_by_handle_at -F a2&amp;03 -F path=/etc/passwd -F auid&gt;=1000 -F auid!=unset -F key=modify"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_fix_audit_syscall_rule" use="legacy"/>
	fix_audit_syscall_rule "auditctl" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
	fix_audit_syscall_rule "augenrules" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_etc_passwd_open_by_handle_at" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="low" strategy="restrict">- name: Set architecture for audit open_by_handle_at tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_etc_passwd_open_by_handle_at
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Search /etc/audit/rules.d for other DAC audit rules
  find:
    paths: /etc/audit/rules.d
    recurse: false
    contains: .*open_by_handle_at(,[\S]+)?[\s]+-F[\s]+a2&amp;03[\s]+-F[\s]+path=/etc/passwd.*
    patterns: '*.rules'
  register: find_open_by_handle_at
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_etc_passwd_open_by_handle_at
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: If existing DAC ruleset not found, use /etc/audit/rules.d/modify.rules as
    the recipient for the rule
  set_fact:
    all_files:
      - /etc/audit/rules.d/modify.rules
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_open_by_handle_at.matched is defined and find_open_by_handle_at.matched
      == 0
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_etc_passwd_open_by_handle_at
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
      - '{{ find_open_by_handle_at.files | map(attribute=''path'') | list | first
        }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_open_by_handle_at.matched is defined and find_open_by_handle_at.matched
      &gt; 0
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_etc_passwd_open_by_handle_at
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the open_by_handle_at rule in rules.d when on x86
  lineinfile:
    path: '{{ all_files[0] }}'
    line: '{{ item }}'
    create: true
    regexp: -a always,exit -F arch=b32 -S open_by_handle_at -F a2&amp;03 -F path=/etc/passwd
      -F auid&gt;=1000 -F auid!=unset -F key=[\S]+
  with_items:
    - -a always,exit -F arch=b32 -S open_by_handle_at -F a2&amp;03 -F path=/etc/passwd
      -F auid&gt;=1000 -F auid!=unset -F key=modify
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_etc_passwd_open_by_handle_at
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the open_by_handle_at rule in rules.d when on x86_64
  lineinfile:
    path: '{{ all_files[0] }}'
    line: '{{ item }}'
    create: true
    regexp: -a always,exit -F arch=b64 -S open_by_handle_at -F a2&amp;03 -F path=/etc/passwd
      -F auid&gt;=1000 -F auid!=unset -F key=[\S]+
  with_items:
    - -a always,exit -F arch=b64 -S open_by_handle_at -F a2&amp;03 -F path=/etc/passwd
      -F auid&gt;=1000 -F auid!=unset -F key=modify
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - audit_arch is defined and audit_arch == 'b64'
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_etc_passwd_open_by_handle_at
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the open_by_handle_at rule in /etc/audit/audit.rules when
    on x86
  lineinfile:
    line: '{{ item }}'
    state: present
    dest: /etc/audit/audit.rules
    create: true
    regexp: -a always,exit -F arch=b32 -S open_by_handle_at -F a2&amp;03 -F path=/etc/passwd
      -F auid&gt;=1000 -F auid!=unset -F key=[\S]+
  with_items:
    - -a always,exit -F arch=b32 -S open_by_handle_at -F a2&amp;03 -F path=/etc/passwd
      -F auid&gt;=1000 -F auid!=unset -F key=modify
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_etc_passwd_open_by_handle_at
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the open_by_handle_at rule in audit.rules when on x86_64
  lineinfile:
    line: '{{ item }}'
    state: present
    dest: /etc/audit/audit.rules
    create: true
    regexp: -a always,exit -F arch=b64 -S open_by_handle_at -F a2&amp;03 -F path=/etc/passwd
      -F auid&gt;=1000 -F auid!=unset -F key=[\S]+
  with_items:
    - -a always,exit -F arch=b64 -S open_by_handle_at -F a2&amp;03 -F path=/etc/passwd
      -F auid&gt;=1000 -F auid!=unset -F key=modify
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - audit_arch is defined and audit_arch == 'b64'
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_etc_passwd_open_by_handle_at
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-audit_rules_etc_passwd_open_by_handle_at:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-audit_rules_etc_passwd_open_by_handle_at_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_etc_group_open_by_handle_at" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record Events that Modify User/Group Information via open_by_handle_at syscall - /etc/group</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The audit system should collect write events to /etc/group file for all group and root.
If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured
to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following lines to a file with suffix
<html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S open_by_handle_at -F a2&amp;03 -F path=/etc/group -F auid&gt;=1000 -F auid!=unset -F key=modify</html:pre>
If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> file:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S open_by_handle_at -F a2&amp;03 -F path=/etc/group -F auid&gt;=1000 -F auid!=unset -F key=modify</html:pre>
If the system is 64 bit then also add the following line:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b64 -S open_by_handle_at -F a2&amp;03 -F path=/etc/group -F auid&gt;=1000 -F auid!=unset -F key=modify</html:pre></description>
          <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping system calls related
to the same event is more efficient. See the following example:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&amp;03 -F path=/etc/group -F auid&gt;=1000 -F auid!=unset -F key=modify</html:pre></warning>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-2(4)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Creation of groups through direct edition of /etc/group could be an indicator of malicious activity on a system.
Auditing these events could serve as evidence of potential system compromise.</rationale>
          <platform idref="cpe:/a:machine"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_etc_group_open_by_handle_at" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then



# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	PATTERN="-a always,exit -F arch=$ARCH -S open_by_handle_at -F a2&amp;03 -F path=/etc/group.*"
	GROUP="modify"
	FULL_RULE="-a always,exit -F arch=$ARCH -S open_by_handle_at -F a2&amp;03 -F path=/etc/group -F auid&gt;=1000 -F auid!=unset -F key=modify"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_fix_audit_syscall_rule" use="legacy"/>
	fix_audit_syscall_rule "auditctl" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
	fix_audit_syscall_rule "augenrules" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_etc_group_open_by_handle_at" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="low" strategy="restrict">- name: Set architecture for audit open_by_handle_at tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_etc_group_open_by_handle_at
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Search /etc/audit/rules.d for other DAC audit rules
  find:
    paths: /etc/audit/rules.d
    recurse: false
    contains: .*open_by_handle_at(,[\S]+)?[\s]+-F[\s]+a2&amp;03[\s]+-F[\s]+path=/etc/group.*
    patterns: '*.rules'
  register: find_open_by_handle_at
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_etc_group_open_by_handle_at
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: If existing DAC ruleset not found, use /etc/audit/rules.d/modify.rules as
    the recipient for the rule
  set_fact:
    all_files:
      - /etc/audit/rules.d/modify.rules
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_open_by_handle_at.matched is defined and find_open_by_handle_at.matched
      == 0
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_etc_group_open_by_handle_at
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
      - '{{ find_open_by_handle_at.files | map(attribute=''path'') | list | first
        }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_open_by_handle_at.matched is defined and find_open_by_handle_at.matched
      &gt; 0
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_etc_group_open_by_handle_at
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the open_by_handle_at rule in rules.d when on x86
  lineinfile:
    path: '{{ all_files[0] }}'
    line: '{{ item }}'
    create: true
    regexp: -a always,exit -F arch=b32 -S open_by_handle_at -F a2&amp;03 -F path=/etc/group
      -F auid&gt;=1000 -F auid!=unset -F key=[\S]+
  with_items:
    - -a always,exit -F arch=b32 -S open_by_handle_at -F a2&amp;03 -F path=/etc/group
      -F auid&gt;=1000 -F auid!=unset -F key=modify
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_etc_group_open_by_handle_at
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the open_by_handle_at rule in rules.d when on x86_64
  lineinfile:
    path: '{{ all_files[0] }}'
    line: '{{ item }}'
    create: true
    regexp: -a always,exit -F arch=b64 -S open_by_handle_at -F a2&amp;03 -F path=/etc/group
      -F auid&gt;=1000 -F auid!=unset -F key=[\S]+
  with_items:
    - -a always,exit -F arch=b64 -S open_by_handle_at -F a2&amp;03 -F path=/etc/group
      -F auid&gt;=1000 -F auid!=unset -F key=modify
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - audit_arch is defined and audit_arch == 'b64'
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_etc_group_open_by_handle_at
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the open_by_handle_at rule in /etc/audit/audit.rules when
    on x86
  lineinfile:
    line: '{{ item }}'
    state: present
    dest: /etc/audit/audit.rules
    create: true
    regexp: -a always,exit -F arch=b32 -S open_by_handle_at -F a2&amp;03 -F path=/etc/group
      -F auid&gt;=1000 -F auid!=unset -F key=[\S]+
  with_items:
    - -a always,exit -F arch=b32 -S open_by_handle_at -F a2&amp;03 -F path=/etc/group
      -F auid&gt;=1000 -F auid!=unset -F key=modify
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_etc_group_open_by_handle_at
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the open_by_handle_at rule in audit.rules when on x86_64
  lineinfile:
    line: '{{ item }}'
    state: present
    dest: /etc/audit/audit.rules
    create: true
    regexp: -a always,exit -F arch=b64 -S open_by_handle_at -F a2&amp;03 -F path=/etc/group
      -F auid&gt;=1000 -F auid!=unset -F key=[\S]+
  with_items:
    - -a always,exit -F arch=b64 -S open_by_handle_at -F a2&amp;03 -F path=/etc/group
      -F auid&gt;=1000 -F auid!=unset -F key=modify
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - audit_arch is defined and audit_arch == 'b64'
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_etc_group_open_by_handle_at
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-audit_rules_etc_group_open_by_handle_at:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-audit_rules_etc_group_open_by_handle_at_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_etc_shadow_open_by_handle_at" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record Events that Modify User/Group Information via open_by_handle_at syscall - /etc/shadow</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The audit system should collect write events to /etc/shadow file for all users and root.
If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured
to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following lines to a file with suffix
<html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S open_by_handle_at -F a2&amp;03 -F path=/etc/shadow -F auid&gt;=1000 -F auid!=unset -F key=user-modify</html:pre>
If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> file:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S open_by_handle_at -F a2&amp;03 -F path=/etc/shadow -F auid&gt;=1000 -F auid!=unset -F key=user-modify</html:pre>
If the system is 64 bit then also add the following line:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b64 -S open_by_handle_at -F a2&amp;03 -F path=/etc/shadow -F auid&gt;=1000 -F auid!=unset -F key=user-modify</html:pre></description>
          <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping system calls related
to the same event is more efficient. See the following example:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S open,openat,open_by_handle_at -F a2&amp;03 -F path=/etc/shadow -F auid&gt;=1000 -F auid!=unset -F key=user-modify</html:pre></warning>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-2(4)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Creation of users through direct edition of /etc/shadow could be an indicator of malicious activity on a system.
Auditing these events could serve as evidence of potential system compromise.</rationale>
          <platform idref="cpe:/a:machine"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_etc_shadow_open_by_handle_at" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then



# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	PATTERN="-a always,exit -F arch=$ARCH -S open_by_handle_at -F a2&amp;03 -F path=/etc/shadow.*"
	GROUP="modify"
	FULL_RULE="-a always,exit -F arch=$ARCH -S open_by_handle_at -F a2&amp;03 -F path=/etc/shadow -F auid&gt;=1000 -F auid!=unset -F key=modify"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_fix_audit_syscall_rule" use="legacy"/>
	fix_audit_syscall_rule "auditctl" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
	fix_audit_syscall_rule "augenrules" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_etc_shadow_open_by_handle_at" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="low" strategy="restrict">- name: Set architecture for audit open_by_handle_at tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_etc_shadow_open_by_handle_at
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Search /etc/audit/rules.d for other DAC audit rules
  find:
    paths: /etc/audit/rules.d
    recurse: false
    contains: .*open_by_handle_at(,[\S]+)?[\s]+-F[\s]+a2&amp;03[\s]+-F[\s]+path=/etc/shadow.*
    patterns: '*.rules'
  register: find_open_by_handle_at
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_etc_shadow_open_by_handle_at
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: If existing DAC ruleset not found, use /etc/audit/rules.d/modify.rules as
    the recipient for the rule
  set_fact:
    all_files:
      - /etc/audit/rules.d/modify.rules
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_open_by_handle_at.matched is defined and find_open_by_handle_at.matched
      == 0
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_etc_shadow_open_by_handle_at
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
      - '{{ find_open_by_handle_at.files | map(attribute=''path'') | list | first
        }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_open_by_handle_at.matched is defined and find_open_by_handle_at.matched
      &gt; 0
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_etc_shadow_open_by_handle_at
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the open_by_handle_at rule in rules.d when on x86
  lineinfile:
    path: '{{ all_files[0] }}'
    line: '{{ item }}'
    create: true
    regexp: -a always,exit -F arch=b32 -S open_by_handle_at -F a2&amp;03 -F path=/etc/shadow
      -F auid&gt;=1000 -F auid!=unset -F key=[\S]+
  with_items:
    - -a always,exit -F arch=b32 -S open_by_handle_at -F a2&amp;03 -F path=/etc/shadow
      -F auid&gt;=1000 -F auid!=unset -F key=modify
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_etc_shadow_open_by_handle_at
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the open_by_handle_at rule in rules.d when on x86_64
  lineinfile:
    path: '{{ all_files[0] }}'
    line: '{{ item }}'
    create: true
    regexp: -a always,exit -F arch=b64 -S open_by_handle_at -F a2&amp;03 -F path=/etc/shadow
      -F auid&gt;=1000 -F auid!=unset -F key=[\S]+
  with_items:
    - -a always,exit -F arch=b64 -S open_by_handle_at -F a2&amp;03 -F path=/etc/shadow
      -F auid&gt;=1000 -F auid!=unset -F key=modify
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - audit_arch is defined and audit_arch == 'b64'
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_etc_shadow_open_by_handle_at
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the open_by_handle_at rule in /etc/audit/audit.rules when
    on x86
  lineinfile:
    line: '{{ item }}'
    state: present
    dest: /etc/audit/audit.rules
    create: true
    regexp: -a always,exit -F arch=b32 -S open_by_handle_at -F a2&amp;03 -F path=/etc/shadow
      -F auid&gt;=1000 -F auid!=unset -F key=[\S]+
  with_items:
    - -a always,exit -F arch=b32 -S open_by_handle_at -F a2&amp;03 -F path=/etc/shadow
      -F auid&gt;=1000 -F auid!=unset -F key=modify
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_etc_shadow_open_by_handle_at
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the open_by_handle_at rule in audit.rules when on x86_64
  lineinfile:
    line: '{{ item }}'
    state: present
    dest: /etc/audit/audit.rules
    create: true
    regexp: -a always,exit -F arch=b64 -S open_by_handle_at -F a2&amp;03 -F path=/etc/shadow
      -F auid&gt;=1000 -F auid!=unset -F key=[\S]+
  with_items:
    - -a always,exit -F arch=b64 -S open_by_handle_at -F a2&amp;03 -F path=/etc/shadow
      -F auid&gt;=1000 -F auid!=unset -F key=modify
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - audit_arch is defined and audit_arch == 'b64'
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_etc_shadow_open_by_handle_at
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-audit_rules_etc_shadow_open_by_handle_at:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-audit_rules_etc_shadow_open_by_handle_at_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_immutable" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Make the auditd Configuration Immutable</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the
<html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program to read audit rules during daemon startup (the
default), add the following line to a file with suffix <html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the
directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code> in order to make the auditd configuration
immutable:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-e 2</html:pre>
If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the following line to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> file in order to make the auditd configuration
immutable:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-e 2</html:pre>
With this setting, a reboot will be required to change any audit rules.</description>
          <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.3.1</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.4.3</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(iv)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(2)(iii)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</reference>
          <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.5.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.10</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.2.6.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO12.06</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI08.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.10.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.11.1.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.11.1.5</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.11.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.4.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.4.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.4.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.4.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.7.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.1.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.2.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.15.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.15.2.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.16.1.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.16.1.5</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.16.1.7</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.6.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.7.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.7.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.7.3.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.8.2.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.8.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.5</reference>
          <reference href="https://www.cisecurity.org/controls/">1</reference>
          <reference href="https://www.cisecurity.org/controls/">11</reference>
          <reference href="https://www.cisecurity.org/controls/">12</reference>
          <reference href="https://www.cisecurity.org/controls/">13</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">16</reference>
          <reference href="https://www.cisecurity.org/controls/">18</reference>
          <reference href="https://www.cisecurity.org/controls/">19</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">4</reference>
          <reference href="https://www.cisecurity.org/controls/">5</reference>
          <reference href="https://www.cisecurity.org/controls/">6</reference>
          <reference href="https://www.cisecurity.org/controls/">7</reference>
          <reference href="https://www.cisecurity.org/controls/">8</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Making the audit configuration immutable prevents accidental as
well as malicious modification of the audit rules, although it may be
problematic if legitimate changes are needed during system
operation</rationale>
          <platform idref="cpe:/a:machine"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_immutable" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

# Traverse all of:
#
# /etc/audit/audit.rules,			(for auditctl case)
# /etc/audit/rules.d/*.rules			(for augenrules case)
#
# files to check if '-e .*' setting is present in that '*.rules' file already.
# If found, delete such occurrence since auditctl(8) manual page instructs the
# '-e 2' rule should be placed as the last rule in the configuration
find /etc/audit /etc/audit/rules.d -maxdepth 1 -type f -name '*.rules' -exec sed -i '/-e[[:space:]]\+.*/d' {} ';'

# Append '-e 2' requirement at the end of both:
# * /etc/audit/audit.rules file 		(for auditctl case)
# * /etc/audit/rules.d/immutable.rules		(for augenrules case)

for AUDIT_FILE in "/etc/audit/audit.rules" "/etc/audit/rules.d/immutable.rules"
do
	echo '' &gt;&gt; $AUDIT_FILE
	echo '# Set the audit.rules configuration immutable per security requirements' &gt;&gt; $AUDIT_FILE
	echo '# Reboot is required to change audit rules once this setting is applied' &gt;&gt; $AUDIT_FILE
	echo '-e 2' &gt;&gt; $AUDIT_FILE
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_immutable" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="low" strategy="restrict">- name: Collect all files from /etc/audit/rules.d with .rules extension
  find:
    paths: /etc/audit/rules.d/
    patterns: '*.rules'
  register: find_rules_d
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.3.1
    - NIST-800-171-3.4.3
    - NIST-800-53-AC-6(9)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.2
    - audit_rules_immutable
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Remove the -e option from all Audit config files
  lineinfile:
    path: '{{ item }}'
    regexp: ^\s*(?:-e)\s+.*$
    state: absent
  loop: '{{ find_rules_d.files | map(attribute=''path'') | list + [''/etc/audit/audit.rules'']
    }}'
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.3.1
    - NIST-800-171-3.4.3
    - NIST-800-53-AC-6(9)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.2
    - audit_rules_immutable
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Add Audit -e option into /etc/audit/rules.d/immutable.rules and /etc/audit/audit.rules
  lineinfile:
    path: '{{ item }}'
    create: true
    line: -e 2
  loop:
    - /etc/audit/audit.rules
    - /etc/audit/rules.d/immutable.rules
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.3.1
    - NIST-800-171-3.4.3
    - NIST-800-53-AC-6(9)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.2
    - audit_rules_immutable
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_immutable" system="urn:xccdf:fix:script:kubernetes">apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,-e%202%0A
        mode: 0600
        path: /etc/audit/rules.d/90-immutable.rules
        overwrite: true
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-audit_rules_immutable:def:1" href="ssg-fedora-oval.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_mac_modification" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record Events that Modify the System's Mandatory Access Controls</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the
<html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program to read audit rules during daemon startup (the
default), add the following line to a file with suffix <html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the
directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-w /etc/selinux/ -p wa -k MAC-policy</html:pre>
If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the following line to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> file:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-w /etc/selinux/ -p wa -k MAC-policy</html:pre></description>
          <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.8</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</reference>
          <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</reference>
          <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.5.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.10</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.2.6.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO12.06</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI08.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS01.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.11.2.6</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.4.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.4.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.4.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.4.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.7.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.2.7</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.15.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.15.2.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.16.1.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.16.1.5</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.16.1.7</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.6.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.6.2.2</reference>
          <reference href="https://www.cisecurity.org/controls/">1</reference>
          <reference href="https://www.cisecurity.org/controls/">11</reference>
          <reference href="https://www.cisecurity.org/controls/">12</reference>
          <reference href="https://www.cisecurity.org/controls/">13</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">16</reference>
          <reference href="https://www.cisecurity.org/controls/">19</reference>
          <reference href="https://www.cisecurity.org/controls/">2</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">4</reference>
          <reference href="https://www.cisecurity.org/controls/">5</reference>
          <reference href="https://www.cisecurity.org/controls/">6</reference>
          <reference href="https://www.cisecurity.org/controls/">7</reference>
          <reference href="https://www.cisecurity.org/controls/">8</reference>
          <reference href="https://www.cisecurity.org/controls/">9</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The system's mandatory access policy (SELinux) should not be
arbitrarily changed by anything other than administrator action. All changes to
MAC policy should be audited.</rationale>
          <platform idref="cpe:/a:machine"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_mac_modification" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then



# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_fix_audit_watch_rule" use="legacy"/>
fix_audit_watch_rule "auditctl" "/etc/selinux/" "wa" "MAC-policy"
fix_audit_watch_rule "augenrules" "/etc/selinux/" "wa" "MAC-policy"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_mac_modification" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="low" strategy="restrict">- name: Check if watch rule for /etc/selinux/ already exists in /etc/audit/rules.d/
  find:
    paths: /etc/audit/rules.d
    contains: ^\s*-w\s+/etc/selinux/\s+-p\s+wa(\s|$)+
    patterns: '*.rules'
  register: find_existing_watch_rules_d
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.8
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_mac_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Search /etc/audit/rules.d for other rules with specified key MAC-policy
  find:
    paths: /etc/audit/rules.d
    contains: ^.*(?:-F key=|-k\s+)MAC-policy$
    patterns: '*.rules'
  register: find_watch_key
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
      == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.8
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_mac_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Use /etc/audit/rules.d/MAC-policy.rules as the recipient for the rule
  set_fact:
    all_files:
      - /etc/audit/rules.d/MAC-policy.rules
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_watch_key.matched is defined and find_watch_key.matched == 0 and find_existing_watch_rules_d.matched
      is defined and find_existing_watch_rules_d.matched == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.8
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_mac_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
      - '{{ find_watch_key.files | map(attribute=''path'') | list | first }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_watch_key.matched is defined and find_watch_key.matched &gt; 0 and find_existing_watch_rules_d.matched
      is defined and find_existing_watch_rules_d.matched == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.8
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_mac_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Add watch rule for /etc/selinux/ in /etc/audit/rules.d/
  lineinfile:
    path: '{{ all_files[0] }}'
    line: -w /etc/selinux/ -p wa -k MAC-policy
    create: true
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
      == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.8
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_mac_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Check if watch rule for /etc/selinux/ already exists in /etc/audit/audit.rules
  find:
    paths: /etc/audit/
    contains: ^\s*-w\s+/etc/selinux/\s+-p\s+wa(\s|$)+
    patterns: audit.rules
  register: find_existing_watch_audit_rules
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.8
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_mac_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Add watch rule for /etc/selinux/ in /etc/audit/audit.rules
  lineinfile:
    line: -w /etc/selinux/ -p wa -k MAC-policy
    state: present
    dest: /etc/audit/audit.rules
    create: true
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_existing_watch_audit_rules.matched is defined and find_existing_watch_audit_rules.matched
      == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.8
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_mac_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_mac_modification" system="urn:xccdf:fix:script:kubernetes" reboot="true" complexity="low" disruption="low" strategy="restrict">
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,-w%20/etc/selinux/%20-p%20wa%20-k%20MAC-policy%0A
        mode: 0600
        path: /etc/audit/rules.d/75-etcselinux-wa-MAC-policy.rules
        overwrite: true
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-audit_rules_mac_modification:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-audit_rules_mac_modification_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Group id="xccdf_org.ssgproject.content_group_audit_file_modification">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record Unauthorized Access Attempts Events to Files (unsuccessful)</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">At a minimum, the audit system should collect unauthorized file
accesses for all users and root. Note that the "-F arch=b32" lines should be
present even on a 64 bit system. These commands identify system calls for
auditing. Even if the system is 64 bit it can still execute 32 bit system
calls. Additionally, these rules can be configured in a number of ways while
still achieving the desired effect. An example of this is that the "-S" calls
could be split up and placed on separate lines, however, this is less efficient.
Add the following to <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S creat,open,openat,open_by_handle_at,truncate,ftruncate -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=access
    -a always,exit -F arch=b32 -S creat,open,openat,open_by_handle_at,truncate,ftruncate -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=access</html:pre>
If your system is 64 bit then these lines should be duplicated and the
arch=b32 replaced with arch=b64 as follows:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b64 -S creat,open,openat,open_by_handle_at,truncate,ftruncate -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=access
    -a always,exit -F arch=b64 -S creat,open,openat,open_by_handle_at,truncate,ftruncate -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=access</html:pre></description>
          <platform idref="cpe:/a:machine"/>
          <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_successful_file_modification_ftruncate" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record Successful Access Attempts to Files - ftruncate</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">At a minimum, the audit system should collect unauthorized file
accesses for all users and root. If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured
to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following lines to a file with suffix
<html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>:

<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S ftruncate -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-access</html:pre>

If the system is 64 bit then also add the following lines:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b64 -S ftruncate -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-access</html:pre>

If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> file:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S ftruncate -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-access</html:pre>

If the system is 64 bit then also add the following lines:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b64 -S ftruncate -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-access</html:pre></description>
            <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.</warning>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">File access attempts could be an indicator of malicious activity on a system. Auditing
these events could serve as evidence of potential system compromise.</rationale>
            <platform idref="cpe:/a:machine"/>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-audit_rules_successful_file_modification_ftruncate_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_successful_file_modification_lsetxattr" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record Successful Permission Changes to Files - lsetxattr</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">At a minimum, the audit system should collect file permission changes
for all users and root. If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured
to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following lines to a file with suffix
<html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>:

<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S lsetxattr -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-perm-change</html:pre>

If the system is 64 bit then also add the following lines:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b64 -S lsetxattr -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-perm-change</html:pre>

If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> file:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S lsetxattr -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-perm-change</html:pre>

If the system is 64 bit then also add the following lines:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b64 -S lsetxattr -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-perm-change</html:pre></description>
            <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.</warning>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">File permission changes could be an indicator of malicious activity on a system. Auditing
these events could serve as evidence of potential system compromise.</rationale>
            <platform idref="cpe:/a:machine"/>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-audit_rules_successful_file_modification_lsetxattr_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_successful_file_modification_openat" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record Successful Access Attempts to Files - openat</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">At a minimum, the audit system should collect unauthorized file
accesses for all users and root. If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured
to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following lines to a file with suffix
<html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>:

<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S openat -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-access</html:pre>

If the system is 64 bit then also add the following lines:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b64 -S openat -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-access</html:pre>

If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> file:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S openat -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-access</html:pre>

If the system is 64 bit then also add the following lines:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b64 -S openat -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-access</html:pre></description>
            <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.</warning>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">File access attempts could be an indicator of malicious activity on a system. Auditing
these events could serve as evidence of potential system compromise.</rationale>
            <platform idref="cpe:/a:machine"/>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-audit_rules_successful_file_modification_openat_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_lsetxattr" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record Unsuccessul Permission Changes to Files - lsetxattr</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The audit system should collect unsuccessful file permission change
attempts for all users and root.
If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured
to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following lines to a file with suffix
<html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>.
If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> file.
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S lsetxattr -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-perm-change
-a always,exit -F arch=b32 -S lsetxattr -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-perm-change</html:pre>
If the system is 64 bit then also add the following lines:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b64 -S lsetxattr -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-perm-change
-a always,exit -F arch=b64 -S lsetxattr -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-perm-change</html:pre></description>
            <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the audit rule checks a
system call independently of other system calls. Grouping system calls related
to the same event is more efficient. See the following example:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S chmod,fchmod,fchmodat,setxattr,lsetxattr,fsetxattr -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-perm-change</html:pre></warning>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="">SRG-OS-000458-VMM-001810</reference>
            <reference href="">SRG-OS-000461-VMM-001830</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Unsuccessful attempts to change permissions of files could be an indicator of malicious activity on a system. Auditing
these events could serve as evidence of potential system compromise.</rationale>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_unsuccessful_file_modification_lsetxattr" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then



# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	PATTERN="-a always,exit -F arch=$ARCH -S lsetxattr -F exit=-EACCES.*"
	GROUP="access"
	FULL_RULE="-a always,exit -F arch=$ARCH -S lsetxattr -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=access"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_fix_audit_syscall_rule" use="legacy"/>
	fix_audit_syscall_rule "auditctl" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
	fix_audit_syscall_rule "augenrules" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
done

for ARCH in "${RULE_ARCHS[@]}"
do
        PATTERN="-a always,exit -F arch=$ARCH -S lsetxattr -F exit=-EPERM.*"
        GROUP="access"
        FULL_RULE="-a always,exit -F arch=$ARCH -S lsetxattr -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=access"
        # Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_fix_audit_syscall_rule" use="legacy"/>
        fix_audit_syscall_rule "auditctl" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
        fix_audit_syscall_rule "augenrules" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_unsuccessful_file_modification_lsetxattr" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="low" strategy="restrict">- name: Set architecture for audit lsetxattr tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_lsetxattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Search /etc/audit/rules.d for other DAC audit rules
  find:
    paths: /etc/audit/rules.d
    recurse: false
    contains: -F key=perm_mod$
    patterns: '*.rules'
  register: find_lsetxattr
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_lsetxattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: If existing DAC ruleset not found, use /etc/audit/rules.d/access.rules as
    the recipient for the rule
  set_fact:
    all_files:
      - /etc/audit/rules.d/access.rules
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_lsetxattr.matched is defined and find_lsetxattr.matched == 0
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_lsetxattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
      - '{{ find_lsetxattr.files | map(attribute=''path'') | list | first }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_lsetxattr.matched is defined and find_lsetxattr.matched &gt; 0
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_lsetxattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the lsetxattr rule in rules.d when on x86
  lineinfile:
    path: '{{ all_files[0] }}'
    line: '{{ item }}'
    create: true
  with_items:
    - -a always,exit -F arch=b32 -S lsetxattr -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset
      -F key=access
    - -a always,exit -F arch=b32 -S lsetxattr -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
      -F key=access
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_lsetxattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the lsetxattr rule in rules.d when on x86_64
  lineinfile:
    path: '{{ all_files[0] }}'
    line: '{{ item }}'
    create: true
  with_items:
    - -a always,exit -F arch=b64 -S lsetxattr -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset
      -F key=access
    - -a always,exit -F arch=b64 -S lsetxattr -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
      -F key=access
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - audit_arch is defined and audit_arch == 'b64'
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_lsetxattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the lsetxattr rule in /etc/audit/audit.rules when on x86
  lineinfile:
    line: '{{ item }}'
    state: present
    dest: /etc/audit/audit.rules
    create: true
  with_items:
    - -a always,exit -F arch=b32 -S lsetxattr -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset
      -F key=access
    - -a always,exit -F arch=b32 -S lsetxattr -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
      -F key=access
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_lsetxattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the lsetxattr rule in audit.rules when on x86_64
  lineinfile:
    line: '{{ item }}'
    state: present
    dest: /etc/audit/audit.rules
    create: true
  with_items:
    - -a always,exit -F arch=b64 -S lsetxattr -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset
      -F key=access
    - -a always,exit -F arch=b64 -S lsetxattr -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
      -F key=access
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - audit_arch is defined and audit_arch == 'b64'
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_lsetxattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_unsuccessful_file_modification_lsetxattr:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-audit_rules_unsuccessful_file_modification_lsetxattr_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_truncate" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record Unsuccessful Access Attempts to Files - truncate</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">At a minimum, the audit system should collect unauthorized file
accesses for all users and root. If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured
to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following lines to a file with suffix
<html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S truncate -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b32 -S truncate -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=access</html:pre>

If the system is 64 bit then also add the following lines:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">
-a always,exit -F arch=b64 -S truncate -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b64 -S truncate -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=access</html:pre>

If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> file:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S truncate -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b32 -S truncate -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=access</html:pre>

If the system is 64 bit then also add the following lines:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">
-a always,exit -F arch=b64 -S truncate -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b64 -S truncate -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=access</html:pre></description>
            <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.</warning>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</reference>
            <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</reference>
            <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.2.4</reference>
            <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.2.1</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000064-GPOS-00033</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000458-GPOS-00203</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000461-GPOS-00205</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</reference>
            <reference href="">SRG-OS-000458-VMM-001810</reference>
            <reference href="">SRG-OS-000461-VMM-001830</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.2.6.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO12.06</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI08.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS02.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS02.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS02.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.2.6</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.7.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.7</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.15.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.15.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.5</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.7</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.2.2</reference>
            <reference href="https://www.cisecurity.org/controls/">1</reference>
            <reference href="https://www.cisecurity.org/controls/">11</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">13</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">19</reference>
            <reference href="https://www.cisecurity.org/controls/">2</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">4</reference>
            <reference href="https://www.cisecurity.org/controls/">5</reference>
            <reference href="https://www.cisecurity.org/controls/">6</reference>
            <reference href="https://www.cisecurity.org/controls/">7</reference>
            <reference href="https://www.cisecurity.org/controls/">8</reference>
            <reference href="https://www.cisecurity.org/controls/">9</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Unsuccessful attempts to access files could be an indicator of malicious activity on a system. Auditing
these events could serve as evidence of potential system compromise.</rationale>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_unsuccessful_file_modification_truncate" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then



# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	PATTERN="-a always,exit -F arch=$ARCH -S truncate -F exit=-EACCES.*"
	GROUP="access"
	FULL_RULE="-a always,exit -F arch=$ARCH -S truncate -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=access"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_fix_audit_syscall_rule" use="legacy"/>
	fix_audit_syscall_rule "auditctl" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
	fix_audit_syscall_rule "augenrules" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
done

for ARCH in "${RULE_ARCHS[@]}"
do
        PATTERN="-a always,exit -F arch=$ARCH -S truncate -F exit=-EPERM.*"
        GROUP="access"
        FULL_RULE="-a always,exit -F arch=$ARCH -S truncate -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=access"
        # Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_fix_audit_syscall_rule" use="legacy"/>
        fix_audit_syscall_rule "auditctl" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
        fix_audit_syscall_rule "augenrules" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_unsuccessful_file_modification_truncate" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="low" strategy="restrict">- name: Set architecture for audit truncate tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_truncate
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Search /etc/audit/rules.d for other DAC audit rules
  find:
    paths: /etc/audit/rules.d
    recurse: false
    contains: -F key=perm_mod$
    patterns: '*.rules'
  register: find_truncate
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_truncate
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: If existing DAC ruleset not found, use /etc/audit/rules.d/access.rules as
    the recipient for the rule
  set_fact:
    all_files:
      - /etc/audit/rules.d/access.rules
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_truncate.matched is defined and find_truncate.matched == 0
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_truncate
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
      - '{{ find_truncate.files | map(attribute=''path'') | list | first }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_truncate.matched is defined and find_truncate.matched &gt; 0
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_truncate
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the truncate rule in rules.d when on x86
  lineinfile:
    path: '{{ all_files[0] }}'
    line: '{{ item }}'
    create: true
  with_items:
    - -a always,exit -F arch=b32 -S truncate -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset
      -F key=access
    - -a always,exit -F arch=b32 -S truncate -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
      -F key=access
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_truncate
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the truncate rule in rules.d when on x86_64
  lineinfile:
    path: '{{ all_files[0] }}'
    line: '{{ item }}'
    create: true
  with_items:
    - -a always,exit -F arch=b64 -S truncate -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset
      -F key=access
    - -a always,exit -F arch=b64 -S truncate -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
      -F key=access
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - audit_arch is defined and audit_arch == 'b64'
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_truncate
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the truncate rule in /etc/audit/audit.rules when on x86
  lineinfile:
    line: '{{ item }}'
    state: present
    dest: /etc/audit/audit.rules
    create: true
  with_items:
    - -a always,exit -F arch=b32 -S truncate -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset
      -F key=access
    - -a always,exit -F arch=b32 -S truncate -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
      -F key=access
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_truncate
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the truncate rule in audit.rules when on x86_64
  lineinfile:
    line: '{{ item }}'
    state: present
    dest: /etc/audit/audit.rules
    create: true
  with_items:
    - -a always,exit -F arch=b64 -S truncate -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset
      -F key=access
    - -a always,exit -F arch=b64 -S truncate -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
      -F key=access
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - audit_arch is defined and audit_arch == 'b64'
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_truncate
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_unsuccessful_file_modification_truncate:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-audit_rules_unsuccessful_file_modification_truncate_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_successful_file_modification_fchmod" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record Successful Permission Changes to Files - fchmod</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">At a minimum, the audit system should collect file permission changes
for all users and root. If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured
to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following lines to a file with suffix
<html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>:

<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S fchmod -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-perm-change</html:pre>

If the system is 64 bit then also add the following lines:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b64 -S fchmod -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-perm-change</html:pre>

If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> file:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S fchmod -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-perm-change</html:pre>

If the system is 64 bit then also add the following lines:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b64 -S fchmod -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-perm-change</html:pre></description>
            <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.</warning>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">File permission changes could be an indicator of malicious activity on a system. Auditing
these events could serve as evidence of potential system compromise.</rationale>
            <platform idref="cpe:/a:machine"/>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-audit_rules_successful_file_modification_fchmod_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_successful_file_modification_creat" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record Successful Access Attempts to Files - creat</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">At a minimum, the audit system should collect unauthorized file
accesses for all users and root. If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured
to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following lines to a file with suffix
<html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>:

<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S creat -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-access</html:pre>

If the system is 64 bit then also add the following lines:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b64 -S creat -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-access</html:pre>

If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> file:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S creat -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-access</html:pre>

If the system is 64 bit then also add the following lines:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b64 -S creat -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-access</html:pre></description>
            <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.</warning>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">File access attempts could be an indicator of malicious activity on a system. Auditing
these events could serve as evidence of potential system compromise.</rationale>
            <platform idref="cpe:/a:machine"/>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-audit_rules_successful_file_modification_creat_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_successful_file_modification_open_by_handle_at_o_creat" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record Successful Creation Attempts to Files - open_by_handle_at O_CREAT</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">open_by_handle_at</html:code> syscall can be used to create new files
when O_CREAT flag is specified.

The following audit rules will assure that successful attempts to create a
file via <html:code xmlns:html="http://www.w3.org/1999/xhtml">open_by_handle_at</html:code> syscall are collected.

If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code>
program to read audit rules during daemon startup (the default), add the
rules below to a file with suffix <html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the directory
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>.

If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the rules below to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> file.

<html:pre xmlns:html="http://www.w3.org/1999/xhtml">
-a always,exit -F arch=b32 -S open_by_handle_at -F a2&amp;0100 -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-create
</html:pre>

If the system is 64 bit then also add the following lines:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">
-a always,exit -F arch=b64 -S open_by_handle_at -F a2&amp;0100 -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-create
</html:pre></description>
            <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping system calls related
to the same event is more efficient. See the following example:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S open_by_handle_at,open_by_handle_at -F a2&amp;0100 -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-create</html:pre></warning>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Successful attempts to access files could be an indicator of malicious activity on a system. Auditing
these events could serve as evidence of potential system compromise.</rationale>
            <platform idref="cpe:/a:machine"/>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-audit_rules_successful_file_modification_open_by_handle_at_o_creat_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_successful_file_modification_fremovexattr" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record Successful Permission Changes to Files - fremovexattr</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">At a minimum, the audit system should collect file permission changes
for all users and root. If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured
to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following lines to a file with suffix
<html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>:

<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S fremovexattr -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-perm-change</html:pre>

If the system is 64 bit then also add the following lines:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b64 -S fremovexattr -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-perm-change</html:pre>

If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> file:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S fremovexattr -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-perm-change</html:pre>

If the system is 64 bit then also add the following lines:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b64 -S fremovexattr -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-perm-change</html:pre></description>
            <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.</warning>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">File permission changes could be an indicator of malicious activity on a system. Auditing
these events could serve as evidence of potential system compromise.</rationale>
            <platform idref="cpe:/a:machine"/>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-audit_rules_successful_file_modification_fremovexattr_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_setxattr" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record Unsuccessul Permission Changes to Files - setxattr</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The audit system should collect unsuccessful file permission change
attempts for all users and root.
If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured
to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following lines to a file with suffix
<html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>.
If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> file.
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S setxattr -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-perm-change
-a always,exit -F arch=b32 -S setxattr -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-perm-change</html:pre>
If the system is 64 bit then also add the following lines:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b64 -S setxattr -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-perm-change
-a always,exit -F arch=b64 -S setxattr -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-perm-change</html:pre></description>
            <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the audit rule checks a
system call independently of other system calls. Grouping system calls related
to the same event is more efficient. See the following example:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S chmod,fchmod,fchmodat,setxattr,lsetxattr,fsetxattr -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-perm-change</html:pre></warning>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="">SRG-OS-000458-VMM-001810</reference>
            <reference href="">SRG-OS-000461-VMM-001830</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Unsuccessful attempts to change permissions of files could be an indicator of malicious activity on a system. Auditing
these events could serve as evidence of potential system compromise.</rationale>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_unsuccessful_file_modification_setxattr" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then



# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	PATTERN="-a always,exit -F arch=$ARCH -S setxattr -F exit=-EACCES.*"
	GROUP="access"
	FULL_RULE="-a always,exit -F arch=$ARCH -S setxattr -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=access"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_fix_audit_syscall_rule" use="legacy"/>
	fix_audit_syscall_rule "auditctl" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
	fix_audit_syscall_rule "augenrules" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
done

for ARCH in "${RULE_ARCHS[@]}"
do
        PATTERN="-a always,exit -F arch=$ARCH -S setxattr -F exit=-EPERM.*"
        GROUP="access"
        FULL_RULE="-a always,exit -F arch=$ARCH -S setxattr -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=access"
        # Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_fix_audit_syscall_rule" use="legacy"/>
        fix_audit_syscall_rule "auditctl" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
        fix_audit_syscall_rule "augenrules" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_unsuccessful_file_modification_setxattr" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="low" strategy="restrict">- name: Set architecture for audit setxattr tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_setxattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Search /etc/audit/rules.d for other DAC audit rules
  find:
    paths: /etc/audit/rules.d
    recurse: false
    contains: -F key=perm_mod$
    patterns: '*.rules'
  register: find_setxattr
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_setxattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: If existing DAC ruleset not found, use /etc/audit/rules.d/access.rules as
    the recipient for the rule
  set_fact:
    all_files:
      - /etc/audit/rules.d/access.rules
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_setxattr.matched is defined and find_setxattr.matched == 0
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_setxattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
      - '{{ find_setxattr.files | map(attribute=''path'') | list | first }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_setxattr.matched is defined and find_setxattr.matched &gt; 0
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_setxattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the setxattr rule in rules.d when on x86
  lineinfile:
    path: '{{ all_files[0] }}'
    line: '{{ item }}'
    create: true
  with_items:
    - -a always,exit -F arch=b32 -S setxattr -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset
      -F key=access
    - -a always,exit -F arch=b32 -S setxattr -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
      -F key=access
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_setxattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the setxattr rule in rules.d when on x86_64
  lineinfile:
    path: '{{ all_files[0] }}'
    line: '{{ item }}'
    create: true
  with_items:
    - -a always,exit -F arch=b64 -S setxattr -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset
      -F key=access
    - -a always,exit -F arch=b64 -S setxattr -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
      -F key=access
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - audit_arch is defined and audit_arch == 'b64'
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_setxattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the setxattr rule in /etc/audit/audit.rules when on x86
  lineinfile:
    line: '{{ item }}'
    state: present
    dest: /etc/audit/audit.rules
    create: true
  with_items:
    - -a always,exit -F arch=b32 -S setxattr -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset
      -F key=access
    - -a always,exit -F arch=b32 -S setxattr -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
      -F key=access
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_setxattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the setxattr rule in audit.rules when on x86_64
  lineinfile:
    line: '{{ item }}'
    state: present
    dest: /etc/audit/audit.rules
    create: true
  with_items:
    - -a always,exit -F arch=b64 -S setxattr -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset
      -F key=access
    - -a always,exit -F arch=b64 -S setxattr -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
      -F key=access
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - audit_arch is defined and audit_arch == 'b64'
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_setxattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_unsuccessful_file_modification_setxattr:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-audit_rules_unsuccessful_file_modification_setxattr_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_successful_file_modification_open_by_handle_at_o_trunc_write" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record Successful Creation Attempts to Files - open_by_handle_at O_TRUNC_WRITE</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The audit system should collect detailed file access records for
all users and root. The <html:code xmlns:html="http://www.w3.org/1999/xhtml">open_by_handle_at</html:code> syscall can be used to modify
files if called for write operation with the O_TRUNC_WRITE flag.

The following audit rules will assure that successful attempts to create a
file via <html:code xmlns:html="http://www.w3.org/1999/xhtml">open_by_handle_at</html:code> syscall are collected.

If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code>
program to read audit rules during daemon startup (the default), add the
rules below to a file with suffix <html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the directory
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>.

If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the rules below to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> file.

<html:pre xmlns:html="http://www.w3.org/1999/xhtml">
-a always,exit -F arch=b32 -S open_by_handle_at -F a2&amp;01003 -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-modification
</html:pre>

If the system is 64 bit then also add the following lines:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">
-a always,exit -F arch=b64 -S open_by_handle_at -F a2&amp;01003 -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-modification
</html:pre></description>
            <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping system calls related
to the same event is more efficient. See the following example:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S open,open_by_handle_at -F a2&amp;01003 -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-modification</html:pre></warning>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Successful attempts to access files could be an indicator of malicious activity on a system. Auditing
these events could serve as evidence of potential system compromise.</rationale>
            <platform idref="cpe:/a:machine"/>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-audit_rules_successful_file_modification_open_by_handle_at_o_trunc_write_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_write" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The audit system should collect detailed unauthorized file accesses for
all users and root. The <html:code xmlns:html="http://www.w3.org/1999/xhtml">open_by_handle_at</html:code> syscall can be used to modify files
if called for write operation of with O_TRUNC_WRITE flag.

The following auidt rules will asure that unsuccessful attempts to modify a
file via <html:code xmlns:html="http://www.w3.org/1999/xhtml">open_by_handle_at</html:code> syscall are collected.

If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code>
program to read audit rules during daemon startup (the default), add the
rules below to a file with suffix <html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the directory
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>.

If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the rules below to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> file.
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">
-a always,exit -F arch=b32 -S open_by_handle_at -F a2&amp;01003 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
-a always,exit -F arch=b32 -S open_by_handle_at -F a2&amp;01003 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
</html:pre>

If the system is 64 bit then also add the following lines:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">
-a always,exit -F arch=b64 -S open_by_handle_at -F a2&amp;01003 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
-a always,exit -F arch=b64 -S open_by_handle_at -F a2&amp;01003 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
</html:pre></description>
            <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping system calls related
to the same event is more efficient. See the following example:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&amp;01003 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification</html:pre></warning>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</reference>
            <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</reference>
            <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.2.4</reference>
            <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.2.1</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000064-GPOS-00033</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000458-GPOS-00203</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000461-GPOS-00205</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</reference>
            <reference href="">SRG-OS-000458-VMM-001810</reference>
            <reference href="">SRG-OS-000461-VMM-001830</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.2.6.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO12.06</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI08.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS02.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS02.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS02.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.2.6</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.7.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.7</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.15.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.15.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.5</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.7</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.2.2</reference>
            <reference href="https://www.cisecurity.org/controls/">1</reference>
            <reference href="https://www.cisecurity.org/controls/">11</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">13</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">19</reference>
            <reference href="https://www.cisecurity.org/controls/">2</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">4</reference>
            <reference href="https://www.cisecurity.org/controls/">5</reference>
            <reference href="https://www.cisecurity.org/controls/">6</reference>
            <reference href="https://www.cisecurity.org/controls/">7</reference>
            <reference href="https://www.cisecurity.org/controls/">8</reference>
            <reference href="https://www.cisecurity.org/controls/">9</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Unsuccessful attempts to access files could be an indicator of malicious activity on a system. Auditing
these events could serve as evidence of potential system compromise.</rationale>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_write" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Add unsuccessful file operations audit rules
  blockinfile:
    path: /etc/audit/rules.d/30-ospp-v42-remediation.rules
    create: true
    block: |-
      ## This content is a section of an Audit config snapshot recommended for Fedora systems that target OSPP compliance.
      ## The following content has been retreived on 2019-03-11 from: https://github.com/linux-audit/audit-userspace/blob/master/rules/30-ospp-v42.rules

      ## The purpose of these rules is to meet the requirements for Operating
      ## System Protection Profile (OSPP)v4.2. These rules depends on having
      ## 10-base-config.rules, 11-loginuid.rules, and 43-module-load.rules installed.

      ## Unsuccessful file creation (open with O_CREAT)
      -a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&amp;0100 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
      -a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&amp;0100 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
      -a always,exit -F arch=b32 -S open -F a1&amp;0100 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
      -a always,exit -F arch=b64 -S open -F a1&amp;0100 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
      -a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&amp;0100 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
      -a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&amp;0100 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
      -a always,exit -F arch=b32 -S open -F a1&amp;0100 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
      -a always,exit -F arch=b64 -S open -F a1&amp;0100 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
      -a always,exit -F arch=b32 -S creat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
      -a always,exit -F arch=b64 -S creat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
      -a always,exit -F arch=b32 -S creat -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
      -a always,exit -F arch=b64 -S creat -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create

      ## Unsuccessful file modifications (open for write or truncate)
      -a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&amp;01003 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
      -a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&amp;01003 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
      -a always,exit -F arch=b32 -S open -F a1&amp;01003 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
      -a always,exit -F arch=b64 -S open -F a1&amp;01003 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
      -a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&amp;01003 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
      -a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&amp;01003 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
      -a always,exit -F arch=b32 -S open -F a1&amp;01003 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
      -a always,exit -F arch=b64 -S open -F a1&amp;01003 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
      -a always,exit -F arch=b32 -S truncate,ftruncate -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
      -a always,exit -F arch=b64 -S truncate,ftruncate -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
      -a always,exit -F arch=b32 -S truncate,ftruncate -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
      -a always,exit -F arch=b64 -S truncate,ftruncate -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification

      ## Unsuccessful file access (any other opens) This has to go last.
      -a always,exit -F arch=b32 -S open,creat,truncate,ftruncate,openat,open_by_handle_at -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-access
      -a always,exit -F arch=b64 -S open,creat,truncate,ftruncate,openat,open_by_handle_at -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-access
      -a always,exit -F arch=b32 -S open,creat,truncate,ftruncate,openat,open_by_handle_at -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-access
      -a always,exit -F arch=b64 -S open,creat,truncate,ftruncate,openat,open_by_handle_at -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-access
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_write
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_write:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_write_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_open_o_trunc_write" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The audit system should collect detailed unauthorized file accesses for
all users and root. The <html:code xmlns:html="http://www.w3.org/1999/xhtml">open</html:code> syscall can be used to modify files
if called for write operation of with O_TRUNC_WRITE flag.
The following auidt rules will asure that unsuccessful attempts to modify a
file via <html:code xmlns:html="http://www.w3.org/1999/xhtml">open</html:code> syscall are collected.
If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code>
program to read audit rules during daemon startup (the default), add the
rules below to a file with suffix <html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the directory
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>.
If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the rules below to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> file.
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">
-a always,exit -F arch=b32 -S open -F a1&amp;01003 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
-a always,exit -F arch=b32 -S open -F a1&amp;01003 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
</html:pre>
If the system is 64 bit then also add the following lines:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">
-a always,exit -F arch=b64 -S open -F a1&amp;01003 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
-a always,exit -F arch=b64 -S open -F a1&amp;01003 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
</html:pre></description>
            <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping system calls related
to the same event is more efficient. See the following example:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S open -F a1&amp;01003 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification</html:pre></warning>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</reference>
            <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</reference>
            <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.2.4</reference>
            <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.2.1</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000064-GPOS-00033</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000458-GPOS-00203</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000461-GPOS-00205</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</reference>
            <reference href="">SRG-OS-000458-VMM-001810</reference>
            <reference href="">SRG-OS-000461-VMM-001830</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.2.6.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO12.06</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI08.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS02.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS02.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS02.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.2.6</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.7.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.7</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.15.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.15.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.5</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.7</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.2.2</reference>
            <reference href="https://www.cisecurity.org/controls/">1</reference>
            <reference href="https://www.cisecurity.org/controls/">11</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">13</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">19</reference>
            <reference href="https://www.cisecurity.org/controls/">2</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">4</reference>
            <reference href="https://www.cisecurity.org/controls/">5</reference>
            <reference href="https://www.cisecurity.org/controls/">6</reference>
            <reference href="https://www.cisecurity.org/controls/">7</reference>
            <reference href="https://www.cisecurity.org/controls/">8</reference>
            <reference href="https://www.cisecurity.org/controls/">9</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Unsuccessful attempts to access files could be an indicator of malicious activity on a system. Auditing
these events could serve as evidence of potential system compromise.</rationale>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_unsuccessful_file_modification_open_o_trunc_write" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Add unsuccessful file operations audit rules
  blockinfile:
    path: /etc/audit/rules.d/30-ospp-v42-remediation.rules
    create: true
    block: |-
      ## This content is a section of an Audit config snapshot recommended for Fedora systems that target OSPP compliance.
      ## The following content has been retreived on 2019-03-11 from: https://github.com/linux-audit/audit-userspace/blob/master/rules/30-ospp-v42.rules

      ## The purpose of these rules is to meet the requirements for Operating
      ## System Protection Profile (OSPP)v4.2. These rules depends on having
      ## 10-base-config.rules, 11-loginuid.rules, and 43-module-load.rules installed.

      ## Unsuccessful file creation (open with O_CREAT)
      -a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&amp;0100 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
      -a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&amp;0100 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
      -a always,exit -F arch=b32 -S open -F a1&amp;0100 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
      -a always,exit -F arch=b64 -S open -F a1&amp;0100 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
      -a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&amp;0100 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
      -a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&amp;0100 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
      -a always,exit -F arch=b32 -S open -F a1&amp;0100 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
      -a always,exit -F arch=b64 -S open -F a1&amp;0100 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
      -a always,exit -F arch=b32 -S creat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
      -a always,exit -F arch=b64 -S creat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
      -a always,exit -F arch=b32 -S creat -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
      -a always,exit -F arch=b64 -S creat -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create

      ## Unsuccessful file modifications (open for write or truncate)
      -a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&amp;01003 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
      -a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&amp;01003 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
      -a always,exit -F arch=b32 -S open -F a1&amp;01003 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
      -a always,exit -F arch=b64 -S open -F a1&amp;01003 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
      -a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&amp;01003 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
      -a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&amp;01003 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
      -a always,exit -F arch=b32 -S open -F a1&amp;01003 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
      -a always,exit -F arch=b64 -S open -F a1&amp;01003 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
      -a always,exit -F arch=b32 -S truncate,ftruncate -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
      -a always,exit -F arch=b64 -S truncate,ftruncate -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
      -a always,exit -F arch=b32 -S truncate,ftruncate -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
      -a always,exit -F arch=b64 -S truncate,ftruncate -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification

      ## Unsuccessful file access (any other opens) This has to go last.
      -a always,exit -F arch=b32 -S open,creat,truncate,ftruncate,openat,open_by_handle_at -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-access
      -a always,exit -F arch=b64 -S open,creat,truncate,ftruncate,openat,open_by_handle_at -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-access
      -a always,exit -F arch=b32 -S open,creat,truncate,ftruncate,openat,open_by_handle_at -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-access
      -a always,exit -F arch=b64 -S open,creat,truncate,ftruncate,openat,open_by_handle_at -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-access
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_open_o_trunc_write
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_unsuccessful_file_modification_open_o_trunc_write:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-audit_rules_unsuccessful_file_modification_open_o_trunc_write_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_openat_o_trunc_write" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The audit system should collect detailed unauthorized file accesses for
all users and root. The <html:code xmlns:html="http://www.w3.org/1999/xhtml">openat</html:code> syscall can be used to modify files
if called for write operation of with O_TRUNC_WRITE flag.

The following auidt rules will asure that unsuccessful attempts to modify a
file via <html:code xmlns:html="http://www.w3.org/1999/xhtml">openat</html:code> syscall are collected.

If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code>
program to read audit rules during daemon startup (the default), add the
rules below to a file with suffix <html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the directory
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>.

If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the rules below to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> file.
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">
-a always,exit -F arch=b32 -S openat -F a2&amp;01003 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
-a always,exit -F arch=b32 -S openat -F a2&amp;01003 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
</html:pre>

If the system is 64 bit then also add the following lines:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">
-a always,exit -F arch=b64 -S openat -F a2&amp;01003 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
-a always,exit -F arch=b64 -S openat -F a2&amp;01003 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
</html:pre></description>
            <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping system calls related
to the same event is more efficient. See the following example:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&amp;01003 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification</html:pre></warning>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</reference>
            <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</reference>
            <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.2.4</reference>
            <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.2.1</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000064-GPOS-00033</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000458-GPOS-00203</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000461-GPOS-00205</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</reference>
            <reference href="">SRG-OS-000458-VMM-001810</reference>
            <reference href="">SRG-OS-000461-VMM-001830</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.2.6.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO12.06</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI08.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS02.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS02.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS02.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.2.6</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.7.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.7</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.15.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.15.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.5</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.7</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.2.2</reference>
            <reference href="https://www.cisecurity.org/controls/">1</reference>
            <reference href="https://www.cisecurity.org/controls/">11</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">13</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">19</reference>
            <reference href="https://www.cisecurity.org/controls/">2</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">4</reference>
            <reference href="https://www.cisecurity.org/controls/">5</reference>
            <reference href="https://www.cisecurity.org/controls/">6</reference>
            <reference href="https://www.cisecurity.org/controls/">7</reference>
            <reference href="https://www.cisecurity.org/controls/">8</reference>
            <reference href="https://www.cisecurity.org/controls/">9</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Unsuccessful attempts to access files could be an indicator of malicious activity on a system. Auditing
these events could serve as evidence of potential system compromise.</rationale>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_unsuccessful_file_modification_openat_o_trunc_write" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Add unsuccessful file operations audit rules
  blockinfile:
    path: /etc/audit/rules.d/30-ospp-v42-remediation.rules
    create: true
    block: |-
      ## This content is a section of an Audit config snapshot recommended for Fedora systems that target OSPP compliance.
      ## The following content has been retreived on 2019-03-11 from: https://github.com/linux-audit/audit-userspace/blob/master/rules/30-ospp-v42.rules

      ## The purpose of these rules is to meet the requirements for Operating
      ## System Protection Profile (OSPP)v4.2. These rules depends on having
      ## 10-base-config.rules, 11-loginuid.rules, and 43-module-load.rules installed.

      ## Unsuccessful file creation (open with O_CREAT)
      -a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&amp;0100 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
      -a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&amp;0100 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
      -a always,exit -F arch=b32 -S open -F a1&amp;0100 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
      -a always,exit -F arch=b64 -S open -F a1&amp;0100 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
      -a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&amp;0100 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
      -a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&amp;0100 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
      -a always,exit -F arch=b32 -S open -F a1&amp;0100 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
      -a always,exit -F arch=b64 -S open -F a1&amp;0100 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
      -a always,exit -F arch=b32 -S creat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
      -a always,exit -F arch=b64 -S creat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
      -a always,exit -F arch=b32 -S creat -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
      -a always,exit -F arch=b64 -S creat -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create

      ## Unsuccessful file modifications (open for write or truncate)
      -a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&amp;01003 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
      -a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&amp;01003 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
      -a always,exit -F arch=b32 -S open -F a1&amp;01003 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
      -a always,exit -F arch=b64 -S open -F a1&amp;01003 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
      -a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&amp;01003 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
      -a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&amp;01003 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
      -a always,exit -F arch=b32 -S open -F a1&amp;01003 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
      -a always,exit -F arch=b64 -S open -F a1&amp;01003 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
      -a always,exit -F arch=b32 -S truncate,ftruncate -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
      -a always,exit -F arch=b64 -S truncate,ftruncate -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
      -a always,exit -F arch=b32 -S truncate,ftruncate -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
      -a always,exit -F arch=b64 -S truncate,ftruncate -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification

      ## Unsuccessful file access (any other opens) This has to go last.
      -a always,exit -F arch=b32 -S open,creat,truncate,ftruncate,openat,open_by_handle_at -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-access
      -a always,exit -F arch=b64 -S open,creat,truncate,ftruncate,openat,open_by_handle_at -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-access
      -a always,exit -F arch=b32 -S open,creat,truncate,ftruncate,openat,open_by_handle_at -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-access
      -a always,exit -F arch=b64 -S open,creat,truncate,ftruncate,openat,open_by_handle_at -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-access
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_openat_o_trunc_write
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_unsuccessful_file_modification_openat_o_trunc_write:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-audit_rules_unsuccessful_file_modification_openat_o_trunc_write_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_successful_file_modification_chown" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record Successful Ownership Changes to Files - chown</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">At a minimum, the audit system should collect file ownership changes
for all users and root. If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured
to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following lines to a file with suffix
<html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>:

<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S chown -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-perm-change</html:pre>

If the system is 64 bit then also add the following lines:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b64 -S chown -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-perm-change</html:pre>

If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> file:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S chown -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-perm-change</html:pre>

If the system is 64 bit then also add the following lines:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b64 -S chown -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-perm-change</html:pre></description>
            <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.</warning>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">File ownership attempts could be an indicator of malicious activity on a system. Auditing
these events could serve as evidence of potential system compromise.</rationale>
            <platform idref="cpe:/a:machine"/>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-audit_rules_successful_file_modification_chown_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creat" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The audit system should collect unauthorized file accesses for
all users and root. The <html:code xmlns:html="http://www.w3.org/1999/xhtml">open_by_handle_at</html:code> syscall can be used to create new files
when O_CREAT flag is specified.

The following auidt rules will asure that unsuccessful attempts to create a
file via <html:code xmlns:html="http://www.w3.org/1999/xhtml">open_by_handle_at</html:code> syscall are collected.

If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code>
program to read audit rules during daemon startup (the default), add the
rules below to a file with suffix <html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the directory
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>.

If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the rules below to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> file.
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">
-a always,exit -F arch=b32 -S open_by_handle_at -F a2&amp;0100 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
-a always,exit -F arch=b32 -S open_by_handle_at -F a2&amp;0100 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
</html:pre>

If the system is 64 bit then also add the following lines:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">
-a always,exit -F arch=b64 -S open_by_handle_at -F a2&amp;0100 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
-a always,exit -F arch=b64 -S open_by_handle_at -F a2&amp;0100 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
</html:pre></description>
            <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping system calls related
to the same event is more efficient. See the following example:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&amp;0100 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create</html:pre></warning>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</reference>
            <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</reference>
            <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.2.4</reference>
            <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.2.1</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000064-GPOS-00033</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000458-GPOS-00203</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000461-GPOS-00205</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</reference>
            <reference href="">SRG-OS-000458-VMM-001810</reference>
            <reference href="">SRG-OS-000461-VMM-001830</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.2.6.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO12.06</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI08.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS02.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS02.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS02.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.2.6</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.7.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.7</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.15.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.15.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.5</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.7</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.2.2</reference>
            <reference href="https://www.cisecurity.org/controls/">1</reference>
            <reference href="https://www.cisecurity.org/controls/">11</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">13</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">19</reference>
            <reference href="https://www.cisecurity.org/controls/">2</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">4</reference>
            <reference href="https://www.cisecurity.org/controls/">5</reference>
            <reference href="https://www.cisecurity.org/controls/">6</reference>
            <reference href="https://www.cisecurity.org/controls/">7</reference>
            <reference href="https://www.cisecurity.org/controls/">8</reference>
            <reference href="https://www.cisecurity.org/controls/">9</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Unsuccessful attempts to access files could be an indicator of malicious activity on a system. Auditing
these events could serve as evidence of potential system compromise.</rationale>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creat" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Add unsuccessful file operations audit rules
  blockinfile:
    path: /etc/audit/rules.d/30-ospp-v42-remediation.rules
    create: true
    block: |-
      ## This content is a section of an Audit config snapshot recommended for Fedora systems that target OSPP compliance.
      ## The following content has been retreived on 2019-03-11 from: https://github.com/linux-audit/audit-userspace/blob/master/rules/30-ospp-v42.rules

      ## The purpose of these rules is to meet the requirements for Operating
      ## System Protection Profile (OSPP)v4.2. These rules depends on having
      ## 10-base-config.rules, 11-loginuid.rules, and 43-module-load.rules installed.

      ## Unsuccessful file creation (open with O_CREAT)
      -a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&amp;0100 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
      -a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&amp;0100 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
      -a always,exit -F arch=b32 -S open -F a1&amp;0100 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
      -a always,exit -F arch=b64 -S open -F a1&amp;0100 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
      -a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&amp;0100 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
      -a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&amp;0100 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
      -a always,exit -F arch=b32 -S open -F a1&amp;0100 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
      -a always,exit -F arch=b64 -S open -F a1&amp;0100 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
      -a always,exit -F arch=b32 -S creat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
      -a always,exit -F arch=b64 -S creat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
      -a always,exit -F arch=b32 -S creat -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
      -a always,exit -F arch=b64 -S creat -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create

      ## Unsuccessful file modifications (open for write or truncate)
      -a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&amp;01003 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
      -a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&amp;01003 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
      -a always,exit -F arch=b32 -S open -F a1&amp;01003 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
      -a always,exit -F arch=b64 -S open -F a1&amp;01003 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
      -a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&amp;01003 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
      -a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&amp;01003 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
      -a always,exit -F arch=b32 -S open -F a1&amp;01003 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
      -a always,exit -F arch=b64 -S open -F a1&amp;01003 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
      -a always,exit -F arch=b32 -S truncate,ftruncate -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
      -a always,exit -F arch=b64 -S truncate,ftruncate -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
      -a always,exit -F arch=b32 -S truncate,ftruncate -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
      -a always,exit -F arch=b64 -S truncate,ftruncate -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification

      ## Unsuccessful file access (any other opens) This has to go last.
      -a always,exit -F arch=b32 -S open,creat,truncate,ftruncate,openat,open_by_handle_at -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-access
      -a always,exit -F arch=b64 -S open,creat,truncate,ftruncate,openat,open_by_handle_at -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-access
      -a always,exit -F arch=b32 -S open,creat,truncate,ftruncate,openat,open_by_handle_at -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-access
      -a always,exit -F arch=b64 -S open,creat,truncate,ftruncate,openat,open_by_handle_at -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-access
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creat
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creat:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creat_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_fchownat" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record Unsuccessul Ownership Changes to Files - fchownat</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The audit system should collect unsuccessful file ownership change
attempts for all users and root.
If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured
to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following lines to a file with suffix
<html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>.
If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> file.
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S fchownat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-perm-change
-a always,exit -F arch=b32 -S fchownat -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-perm-change</html:pre>
If the system is 64 bit then also add the following lines:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b64 -S fchownat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-perm-change
-a always,exit -F arch=b64 -S fchownat -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-perm-change</html:pre></description>
            <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the audit rule checks a
system call independently of other system calls. Grouping system calls related
to the same event is more efficient. See the following example:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S lchown,fchown,chown,fchownat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-perm-change</html:pre></warning>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="">SRG-OS-000458-VMM-001810</reference>
            <reference href="">SRG-OS-000461-VMM-001830</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Unsuccessful attempts to change ownership of files could be an indicator of malicious activity on a system. Auditing
these events could serve as evidence of potential system compromise.</rationale>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_unsuccessful_file_modification_fchownat" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then



# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	PATTERN="-a always,exit -F arch=$ARCH -S fchownat -F exit=-EACCES.*"
	GROUP="access"
	FULL_RULE="-a always,exit -F arch=$ARCH -S fchownat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=access"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_fix_audit_syscall_rule" use="legacy"/>
	fix_audit_syscall_rule "auditctl" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
	fix_audit_syscall_rule "augenrules" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
done

for ARCH in "${RULE_ARCHS[@]}"
do
        PATTERN="-a always,exit -F arch=$ARCH -S fchownat -F exit=-EPERM.*"
        GROUP="access"
        FULL_RULE="-a always,exit -F arch=$ARCH -S fchownat -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=access"
        # Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_fix_audit_syscall_rule" use="legacy"/>
        fix_audit_syscall_rule "auditctl" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
        fix_audit_syscall_rule "augenrules" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_unsuccessful_file_modification_fchownat" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="low" strategy="restrict">- name: Set architecture for audit fchownat tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_fchownat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Search /etc/audit/rules.d for other DAC audit rules
  find:
    paths: /etc/audit/rules.d
    recurse: false
    contains: -F key=perm_mod$
    patterns: '*.rules'
  register: find_fchownat
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_fchownat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: If existing DAC ruleset not found, use /etc/audit/rules.d/access.rules as
    the recipient for the rule
  set_fact:
    all_files:
      - /etc/audit/rules.d/access.rules
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_fchownat.matched is defined and find_fchownat.matched == 0
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_fchownat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
      - '{{ find_fchownat.files | map(attribute=''path'') | list | first }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_fchownat.matched is defined and find_fchownat.matched &gt; 0
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_fchownat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the fchownat rule in rules.d when on x86
  lineinfile:
    path: '{{ all_files[0] }}'
    line: '{{ item }}'
    create: true
  with_items:
    - -a always,exit -F arch=b32 -S fchownat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset
      -F key=access
    - -a always,exit -F arch=b32 -S fchownat -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
      -F key=access
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_fchownat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the fchownat rule in rules.d when on x86_64
  lineinfile:
    path: '{{ all_files[0] }}'
    line: '{{ item }}'
    create: true
  with_items:
    - -a always,exit -F arch=b64 -S fchownat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset
      -F key=access
    - -a always,exit -F arch=b64 -S fchownat -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
      -F key=access
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - audit_arch is defined and audit_arch == 'b64'
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_fchownat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the fchownat rule in /etc/audit/audit.rules when on x86
  lineinfile:
    line: '{{ item }}'
    state: present
    dest: /etc/audit/audit.rules
    create: true
  with_items:
    - -a always,exit -F arch=b32 -S fchownat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset
      -F key=access
    - -a always,exit -F arch=b32 -S fchownat -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
      -F key=access
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_fchownat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the fchownat rule in audit.rules when on x86_64
  lineinfile:
    line: '{{ item }}'
    state: present
    dest: /etc/audit/audit.rules
    create: true
  with_items:
    - -a always,exit -F arch=b64 -S fchownat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset
      -F key=access
    - -a always,exit -F arch=b64 -S fchownat -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
      -F key=access
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - audit_arch is defined and audit_arch == 'b64'
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_fchownat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_unsuccessful_file_modification_fchownat:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-audit_rules_unsuccessful_file_modification_fchownat_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_chmod" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record Unsuccessul Permission Changes to Files - chmod</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The audit system should collect unsuccessful file permission change
attempts for all users and root.
If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured
to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following lines to a file with suffix
<html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>.
If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> file.
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S chmod -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-perm-change
-a always,exit -F arch=b32 -S chmod -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-perm-change</html:pre>
If the system is 64 bit then also add the following lines:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b64 -S chmod -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-perm-change
-a always,exit -F arch=b64 -S chmod -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-perm-change</html:pre></description>
            <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the audit rule checks a
system call independently of other system calls. Grouping system calls related
to the same event is more efficient. See the following example:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S chmod,fchmod,fchmodat,setxattr,lsetxattr,fsetxattr -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-perm-change</html:pre></warning>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="">SRG-OS-000458-VMM-001810</reference>
            <reference href="">SRG-OS-000461-VMM-001830</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Unsuccessful attempts to change permissions of files could be an indicator of malicious activity on a system. Auditing
these events could serve as evidence of potential system compromise.</rationale>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_unsuccessful_file_modification_chmod" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then



# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	PATTERN="-a always,exit -F arch=$ARCH -S chmod -F exit=-EACCES.*"
	GROUP="access"
	FULL_RULE="-a always,exit -F arch=$ARCH -S chmod -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=access"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_fix_audit_syscall_rule" use="legacy"/>
	fix_audit_syscall_rule "auditctl" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
	fix_audit_syscall_rule "augenrules" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
done

for ARCH in "${RULE_ARCHS[@]}"
do
        PATTERN="-a always,exit -F arch=$ARCH -S chmod -F exit=-EPERM.*"
        GROUP="access"
        FULL_RULE="-a always,exit -F arch=$ARCH -S chmod -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=access"
        # Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_fix_audit_syscall_rule" use="legacy"/>
        fix_audit_syscall_rule "auditctl" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
        fix_audit_syscall_rule "augenrules" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_unsuccessful_file_modification_chmod" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="low" strategy="restrict">- name: Set architecture for audit chmod tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_chmod
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Search /etc/audit/rules.d for other DAC audit rules
  find:
    paths: /etc/audit/rules.d
    recurse: false
    contains: -F key=perm_mod$
    patterns: '*.rules'
  register: find_chmod
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_chmod
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: If existing DAC ruleset not found, use /etc/audit/rules.d/access.rules as
    the recipient for the rule
  set_fact:
    all_files:
      - /etc/audit/rules.d/access.rules
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_chmod.matched is defined and find_chmod.matched == 0
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_chmod
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
      - '{{ find_chmod.files | map(attribute=''path'') | list | first }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_chmod.matched is defined and find_chmod.matched &gt; 0
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_chmod
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the chmod rule in rules.d when on x86
  lineinfile:
    path: '{{ all_files[0] }}'
    line: '{{ item }}'
    create: true
  with_items:
    - -a always,exit -F arch=b32 -S chmod -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset
      -F key=access
    - -a always,exit -F arch=b32 -S chmod -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
      -F key=access
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_chmod
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the chmod rule in rules.d when on x86_64
  lineinfile:
    path: '{{ all_files[0] }}'
    line: '{{ item }}'
    create: true
  with_items:
    - -a always,exit -F arch=b64 -S chmod -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset
      -F key=access
    - -a always,exit -F arch=b64 -S chmod -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
      -F key=access
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - audit_arch is defined and audit_arch == 'b64'
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_chmod
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the chmod rule in /etc/audit/audit.rules when on x86
  lineinfile:
    line: '{{ item }}'
    state: present
    dest: /etc/audit/audit.rules
    create: true
  with_items:
    - -a always,exit -F arch=b32 -S chmod -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset
      -F key=access
    - -a always,exit -F arch=b32 -S chmod -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
      -F key=access
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_chmod
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the chmod rule in audit.rules when on x86_64
  lineinfile:
    line: '{{ item }}'
    state: present
    dest: /etc/audit/audit.rules
    create: true
  with_items:
    - -a always,exit -F arch=b64 -S chmod -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset
      -F key=access
    - -a always,exit -F arch=b64 -S chmod -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
      -F key=access
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - audit_arch is defined and audit_arch == 'b64'
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_chmod
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_unsuccessful_file_modification_chmod:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-audit_rules_unsuccessful_file_modification_chmod_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_successful_file_modification_open" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record Successful Access Attempts to Files - open</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">At a minimum, the audit system should collect unauthorized file
accesses for all users and root. If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured
to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following lines to a file with suffix
<html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>:

<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S open -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-access</html:pre>

If the system is 64 bit then also add the following lines:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b64 -S open -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-access</html:pre>

If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> file:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S open -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-access</html:pre>

If the system is 64 bit then also add the following lines:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b64 -S open -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-access</html:pre></description>
            <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.</warning>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">File access attempts could be an indicator of malicious activity on a system. Auditing
these events could serve as evidence of potential system compromise.</rationale>
            <platform idref="cpe:/a:machine"/>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-audit_rules_successful_file_modification_open_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_unlink" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record Unsuccessul Delete Attempts to Files - unlink</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The audit system should collect unsuccessful file deletion
attempts for all users and root. If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured
to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following lines to a file with suffix
<html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>.

If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> file.
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S unlink -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-delete
-a always,exit -F arch=b32 -S unlink -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-delete</html:pre>

If the system is 64 bit then also add the following lines:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">
-a always,exit -F arch=b64 -S unlink -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-delete
-a always,exit -F arch=b64 -S unlink -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-delete</html:pre></description>
            <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping system calls related
to the same event is more efficient. See the following example:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S unlink,unlinkat,rename,renameat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-delete</html:pre></warning>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</reference>
            <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</reference>
            <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.2.4</reference>
            <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.2.1</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000064-GPOS-00033</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000458-GPOS-00203</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000461-GPOS-00205</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000468-GPOS-00212</reference>
            <reference href="">SRG-OS-000458-VMM-001810</reference>
            <reference href="">SRG-OS-000461-VMM-001830</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.2.6.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO12.06</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI08.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS02.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS02.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS02.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.2.6</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.7.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.7</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.15.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.15.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.5</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.7</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.2.2</reference>
            <reference href="https://www.cisecurity.org/controls/">1</reference>
            <reference href="https://www.cisecurity.org/controls/">11</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">13</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">19</reference>
            <reference href="https://www.cisecurity.org/controls/">2</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">4</reference>
            <reference href="https://www.cisecurity.org/controls/">5</reference>
            <reference href="https://www.cisecurity.org/controls/">6</reference>
            <reference href="https://www.cisecurity.org/controls/">7</reference>
            <reference href="https://www.cisecurity.org/controls/">8</reference>
            <reference href="https://www.cisecurity.org/controls/">9</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Unsuccessful attempts to delete files could be an indicator of malicious activity on a system. Auditing
these events could serve as evidence of potential system compromise.</rationale>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_unsuccessful_file_modification_unlink" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then



# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	PATTERN="-a always,exit -F arch=$ARCH -S unlink -F exit=-EACCES.*"
	GROUP="access"
	FULL_RULE="-a always,exit -F arch=$ARCH -S unlink -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=access"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_fix_audit_syscall_rule" use="legacy"/>
	fix_audit_syscall_rule "auditctl" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
	fix_audit_syscall_rule "augenrules" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
done

for ARCH in "${RULE_ARCHS[@]}"
do
        PATTERN="-a always,exit -F arch=$ARCH -S unlink -F exit=-EPERM.*"
        GROUP="access"
        FULL_RULE="-a always,exit -F arch=$ARCH -S unlink -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=access"
        # Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_fix_audit_syscall_rule" use="legacy"/>
        fix_audit_syscall_rule "auditctl" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
        fix_audit_syscall_rule "augenrules" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_unsuccessful_file_modification_unlink" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="low" strategy="restrict">- name: Set architecture for audit unlink tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_unlink
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Search /etc/audit/rules.d for other DAC audit rules
  find:
    paths: /etc/audit/rules.d
    recurse: false
    contains: -F key=perm_mod$
    patterns: '*.rules'
  register: find_unlink
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_unlink
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: If existing DAC ruleset not found, use /etc/audit/rules.d/access.rules as
    the recipient for the rule
  set_fact:
    all_files:
      - /etc/audit/rules.d/access.rules
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_unlink.matched is defined and find_unlink.matched == 0
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_unlink
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
      - '{{ find_unlink.files | map(attribute=''path'') | list | first }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_unlink.matched is defined and find_unlink.matched &gt; 0
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_unlink
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the unlink rule in rules.d when on x86
  lineinfile:
    path: '{{ all_files[0] }}'
    line: '{{ item }}'
    create: true
  with_items:
    - -a always,exit -F arch=b32 -S unlink -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset
      -F key=access
    - -a always,exit -F arch=b32 -S unlink -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
      -F key=access
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_unlink
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the unlink rule in rules.d when on x86_64
  lineinfile:
    path: '{{ all_files[0] }}'
    line: '{{ item }}'
    create: true
  with_items:
    - -a always,exit -F arch=b64 -S unlink -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset
      -F key=access
    - -a always,exit -F arch=b64 -S unlink -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
      -F key=access
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - audit_arch is defined and audit_arch == 'b64'
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_unlink
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the unlink rule in /etc/audit/audit.rules when on x86
  lineinfile:
    line: '{{ item }}'
    state: present
    dest: /etc/audit/audit.rules
    create: true
  with_items:
    - -a always,exit -F arch=b32 -S unlink -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset
      -F key=access
    - -a always,exit -F arch=b32 -S unlink -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
      -F key=access
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_unlink
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the unlink rule in audit.rules when on x86_64
  lineinfile:
    line: '{{ item }}'
    state: present
    dest: /etc/audit/audit.rules
    create: true
  with_items:
    - -a always,exit -F arch=b64 -S unlink -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset
      -F key=access
    - -a always,exit -F arch=b64 -S unlink -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
      -F key=access
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - audit_arch is defined and audit_arch == 'b64'
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_unlink
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_unsuccessful_file_modification_unlink:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-audit_rules_unsuccessful_file_modification_unlink_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_successful_file_modification_rename" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record Successful Delete Attempts to Files - rename</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">At a minimum, the audit system should collect file
deletion for all users and root. If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured
to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following lines to a file with suffix
<html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>:

<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S rename -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-delete</html:pre>

If the system is 64 bit then also add the following lines:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b64 -S rename -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-delete</html:pre>

If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> file:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S rename -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-delete</html:pre>

If the system is 64 bit then also add the following lines:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b64 -S rename -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-delete</html:pre></description>
            <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.</warning>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">File deletion attempts could be an indicator of malicious activity on a system. Auditing
these events could serve as evidence of potential system compromise.</rationale>
            <platform idref="cpe:/a:machine"/>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-audit_rules_successful_file_modification_rename_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_chown" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record Unsuccessul Ownership Changes to Files - chown</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The audit system should collect unsuccessful file ownership change
attempts for all users and root.
If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured
to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following lines to a file with suffix
<html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>.
If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> file.
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S chown -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-perm-change
-a always,exit -F arch=b32 -S chown -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-perm-change</html:pre>
If the system is 64 bit then also add the following lines:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b64 -S chown -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-perm-change
-a always,exit -F arch=b64 -S chown -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-perm-change</html:pre></description>
            <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the audit rule checks a
system call independently of other system calls. Grouping system calls related
to the same event is more efficient. See the following example:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S lchown,fchown,chown,fchownat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-perm-change</html:pre></warning>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="">SRG-OS-000458-VMM-001810</reference>
            <reference href="">SRG-OS-000461-VMM-001830</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Unsuccessful attempts to change ownership of files could be an indicator of malicious activity on a system. Auditing
these events could serve as evidence of potential system compromise.</rationale>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_unsuccessful_file_modification_chown" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then



# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	PATTERN="-a always,exit -F arch=$ARCH -S chown -F exit=-EACCES.*"
	GROUP="access"
	FULL_RULE="-a always,exit -F arch=$ARCH -S chown -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=access"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_fix_audit_syscall_rule" use="legacy"/>
	fix_audit_syscall_rule "auditctl" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
	fix_audit_syscall_rule "augenrules" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
done

for ARCH in "${RULE_ARCHS[@]}"
do
        PATTERN="-a always,exit -F arch=$ARCH -S chown -F exit=-EPERM.*"
        GROUP="access"
        FULL_RULE="-a always,exit -F arch=$ARCH -S chown -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=access"
        # Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_fix_audit_syscall_rule" use="legacy"/>
        fix_audit_syscall_rule "auditctl" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
        fix_audit_syscall_rule "augenrules" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_unsuccessful_file_modification_chown" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="low" strategy="restrict">- name: Set architecture for audit chown tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_chown
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Search /etc/audit/rules.d for other DAC audit rules
  find:
    paths: /etc/audit/rules.d
    recurse: false
    contains: -F key=perm_mod$
    patterns: '*.rules'
  register: find_chown
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_chown
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: If existing DAC ruleset not found, use /etc/audit/rules.d/access.rules as
    the recipient for the rule
  set_fact:
    all_files:
      - /etc/audit/rules.d/access.rules
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_chown.matched is defined and find_chown.matched == 0
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_chown
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
      - '{{ find_chown.files | map(attribute=''path'') | list | first }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_chown.matched is defined and find_chown.matched &gt; 0
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_chown
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the chown rule in rules.d when on x86
  lineinfile:
    path: '{{ all_files[0] }}'
    line: '{{ item }}'
    create: true
  with_items:
    - -a always,exit -F arch=b32 -S chown -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset
      -F key=access
    - -a always,exit -F arch=b32 -S chown -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
      -F key=access
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_chown
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the chown rule in rules.d when on x86_64
  lineinfile:
    path: '{{ all_files[0] }}'
    line: '{{ item }}'
    create: true
  with_items:
    - -a always,exit -F arch=b64 -S chown -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset
      -F key=access
    - -a always,exit -F arch=b64 -S chown -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
      -F key=access
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - audit_arch is defined and audit_arch == 'b64'
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_chown
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the chown rule in /etc/audit/audit.rules when on x86
  lineinfile:
    line: '{{ item }}'
    state: present
    dest: /etc/audit/audit.rules
    create: true
  with_items:
    - -a always,exit -F arch=b32 -S chown -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset
      -F key=access
    - -a always,exit -F arch=b32 -S chown -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
      -F key=access
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_chown
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the chown rule in audit.rules when on x86_64
  lineinfile:
    line: '{{ item }}'
    state: present
    dest: /etc/audit/audit.rules
    create: true
  with_items:
    - -a always,exit -F arch=b64 -S chown -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset
      -F key=access
    - -a always,exit -F arch=b64 -S chown -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
      -F key=access
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - audit_arch is defined and audit_arch == 'b64'
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_chown
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_unsuccessful_file_modification_chown:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-audit_rules_unsuccessful_file_modification_chown_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_successful_file_modification_unlinkat" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record Successful Delete Attempts to Files - unlinkat</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">At a minimum, the audit system should collect file
deletion for all users and root. If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured
to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following lines to a file with suffix
<html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>:

<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S unlinkat -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-delete</html:pre>

If the system is 64 bit then also add the following lines:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b64 -S unlinkat -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-delete</html:pre>

If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> file:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S unlinkat -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-delete</html:pre>

If the system is 64 bit then also add the following lines:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b64 -S unlinkat -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-delete</html:pre></description>
            <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.</warning>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">File deletion attempts could be an indicator of malicious activity on a system. Auditing
these events could serve as evidence of potential system compromise.</rationale>
            <platform idref="cpe:/a:machine"/>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-audit_rules_successful_file_modification_unlinkat_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_successful_file_modification_openat_o_creat" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record Successful Creation Attempts to Files - openat O_CREAT</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">openat</html:code> syscall can be used to create new files
when O_CREAT flag is specified.

The following audit rules will assure that successful attempts to create a
file via <html:code xmlns:html="http://www.w3.org/1999/xhtml">openat</html:code> syscall are collected.

If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code>
program to read audit rules during daemon startup (the default), add the
rules below to a file with suffix <html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the directory
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>.

If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the rules below to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> file.

<html:pre xmlns:html="http://www.w3.org/1999/xhtml">
-a always,exit -F arch=b32 -S openat -F a2&amp;0100 -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-create
</html:pre>

If the system is 64 bit then also add the following lines:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">
-a always,exit -F arch=b64 -S openat -F a2&amp;0100 -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-create
</html:pre></description>
            <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping system calls related
to the same event is more efficient. See the following example:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&amp;0100 -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-create</html:pre></warning>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Successful attempts to access files could be an indicator of malicious activity on a system. Auditing
these events could serve as evidence of potential system compromise.</rationale>
            <platform idref="cpe:/a:machine"/>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-audit_rules_successful_file_modification_openat_o_creat_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_successful_file_modification_openat_o_trunc_write" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record Successful Creation Attempts to Files - openat O_TRUNC_WRITE</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The audit system should collect detailed file access records for
all users and root. The <html:code xmlns:html="http://www.w3.org/1999/xhtml">openat</html:code> syscall can be used to modify
files if called for write operation with the O_TRUNC_WRITE flag.

The following audit rules will assure that successful attempts to create a
file via <html:code xmlns:html="http://www.w3.org/1999/xhtml">openat</html:code> syscall are collected.

If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code>
program to read audit rules during daemon startup (the default), add the
rules below to a file with suffix <html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the directory
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>.

If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the rules below to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> file.

<html:pre xmlns:html="http://www.w3.org/1999/xhtml">
-a always,exit -F arch=b32 -S openat -F a2&amp;01003 -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-modification
</html:pre>

If the system is 64 bit then also add the following lines:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">
-a always,exit -F arch=b64 -S openat -F a2&amp;01003 -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-modification
</html:pre></description>
            <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping system calls related
to the same event is more efficient. See the following example:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S open,openat -F a2&amp;01003 -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-modification</html:pre></warning>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Successful attempts to access files could be an indicator of malicious activity on a system. Auditing
these events could serve as evidence of potential system compromise.</rationale>
            <platform idref="cpe:/a:machine"/>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-audit_rules_successful_file_modification_openat_o_trunc_write_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_successful_file_modification_setxattr" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record Successful Permission Changes to Files - setxattr</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">At a minimum, the audit system should collect file permission changes
for all users and root. If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured
to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following lines to a file with suffix
<html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>:

<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S setxattr -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-perm-change</html:pre>

If the system is 64 bit then also add the following lines:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b64 -S setxattr -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-perm-change</html:pre>

If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> file:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S setxattr -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-perm-change</html:pre>

If the system is 64 bit then also add the following lines:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b64 -S setxattr -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-perm-change</html:pre></description>
            <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.</warning>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">File deletion attempts could be an indicator of malicious activity on a system. Auditing
these events could serve as evidence of potential system compromise.</rationale>
            <platform idref="cpe:/a:machine"/>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-audit_rules_successful_file_modification_setxattr_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_successful_file_modification_lchown" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record Successful Ownership Changes to Files - lchown</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">At a minimum, the audit system should collect file ownership changes
for all users and root. If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured
to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following lines to a file with suffix
<html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>:

<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S lchown -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-perm-change</html:pre>

If the system is 64 bit then also add the following lines:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b64 -S lchown -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-perm-change</html:pre>

If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> file:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S lchown -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-perm-change</html:pre>

If the system is 64 bit then also add the following lines:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b64 -S lchown -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-perm-change</html:pre></description>
            <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.</warning>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">File ownership attempts could be an indicator of malicious activity on a system. Auditing
these events could serve as evidence of potential system compromise.</rationale>
            <platform idref="cpe:/a:machine"/>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-audit_rules_successful_file_modification_lchown_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_open" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record Unsuccessful Access Attempts to Files - open</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">At a minimum, the audit system should collect unauthorized file
accesses for all users and root. If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured
to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following lines to a file with suffix
<html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S open -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b32 -S open -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=access</html:pre>

If the system is 64 bit then also add the following lines:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">
-a always,exit -F arch=b64 -S open -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b64 -S open -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=access</html:pre>

If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> file:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S open -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b32 -S open -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=access</html:pre>

If the system is 64 bit then also add the following lines:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">
-a always,exit -F arch=b64 -S open -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b64 -S open -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=access</html:pre></description>
            <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.</warning>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</reference>
            <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</reference>
            <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.2.4</reference>
            <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.2.1</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000064-GPOS-00033</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000458-GPOS-00203</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000461-GPOS-00205</reference>
            <reference href="">SRG-OS-000458-VMM-001810</reference>
            <reference href="">SRG-OS-000461-VMM-001830</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.2.6.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO12.06</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI08.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS02.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS02.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS02.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.2.6</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.7.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.7</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.15.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.15.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.5</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.7</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.2.2</reference>
            <reference href="https://www.cisecurity.org/controls/">1</reference>
            <reference href="https://www.cisecurity.org/controls/">11</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">13</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">19</reference>
            <reference href="https://www.cisecurity.org/controls/">2</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">4</reference>
            <reference href="https://www.cisecurity.org/controls/">5</reference>
            <reference href="https://www.cisecurity.org/controls/">6</reference>
            <reference href="https://www.cisecurity.org/controls/">7</reference>
            <reference href="https://www.cisecurity.org/controls/">8</reference>
            <reference href="https://www.cisecurity.org/controls/">9</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Unsuccessful attempts to access files could be an indicator of malicious activity on a system. Auditing
these events could serve as evidence of potential system compromise.</rationale>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_unsuccessful_file_modification_open" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="low" strategy="restrict">- name: Set architecture for audit open tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_open
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Search /etc/audit/rules.d for other DAC audit rules
  find:
    paths: /etc/audit/rules.d
    recurse: false
    contains: -F key=perm_mod$
    patterns: '*.rules'
  register: find_open
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_open
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: If existing DAC ruleset not found, use /etc/audit/rules.d/access.rules as
    the recipient for the rule
  set_fact:
    all_files:
      - /etc/audit/rules.d/access.rules
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_open.matched is defined and find_open.matched == 0
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_open
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
      - '{{ find_open.files | map(attribute=''path'') | list | first }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_open.matched is defined and find_open.matched &gt; 0
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_open
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the open rule in rules.d when on x86
  lineinfile:
    path: '{{ all_files[0] }}'
    line: '{{ item }}'
    create: true
  with_items:
    - -a always,exit -F arch=b32 -S open -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset
      -F key=access
    - -a always,exit -F arch=b32 -S open -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
      -F key=access
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_open
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the open rule in rules.d when on x86_64
  lineinfile:
    path: '{{ all_files[0] }}'
    line: '{{ item }}'
    create: true
  with_items:
    - -a always,exit -F arch=b64 -S open -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset
      -F key=access
    - -a always,exit -F arch=b64 -S open -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
      -F key=access
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - audit_arch is defined and audit_arch == 'b64'
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_open
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the open rule in /etc/audit/audit.rules when on x86
  lineinfile:
    line: '{{ item }}'
    state: present
    dest: /etc/audit/audit.rules
    create: true
  with_items:
    - -a always,exit -F arch=b32 -S open -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset
      -F key=access
    - -a always,exit -F arch=b32 -S open -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
      -F key=access
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_open
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the open rule in audit.rules when on x86_64
  lineinfile:
    line: '{{ item }}'
    state: present
    dest: /etc/audit/audit.rules
    create: true
  with_items:
    - -a always,exit -F arch=b64 -S open -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset
      -F key=access
    - -a always,exit -F arch=b64 -S open -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
      -F key=access
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - audit_arch is defined and audit_arch == 'b64'
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_open
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_unsuccessful_file_modification_open:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-audit_rules_unsuccessful_file_modification_open_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_openat_rule_order" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure auditd Rules For Unauthorized Attempts To openat Are Ordered Correctly</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The audit system should collect detailed unauthorized file
accesses for all users and root.
To correctly identify unsuccessful creation, unsuccessful modification and unsuccessful access
of files via <html:code xmlns:html="http://www.w3.org/1999/xhtml">openat</html:code> syscall the audit rules collecting these events need to be in certain order.
The more specific rules need to come before the less specific rules. The reason for that is that more
specific rules cover a subset of events covered in the less specific rules, thus, they need to come
before to not be overshadowed by less specific rules, which match a bigger set of events.
Make sure that rules for unsuccessful calls of <html:code xmlns:html="http://www.w3.org/1999/xhtml">openat</html:code> syscall are in the order shown below.
If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code>
program to read audit rules during daemon startup (the default), check the order of
rules below in a file with suffix <html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the directory
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>.
If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, check the order of rules below in
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> file.
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">
-a always,exit -F arch=b32 -S openat -F a2&amp;0100 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
-a always,exit -F arch=b32 -S openat -F a2&amp;0100 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
-a always,exit -F arch=b32 -S openat -F a2&amp;01003 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
-a always,exit -F arch=b32 -S openat -F a2&amp;01003 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
-a always,exit -F arch=b32 -S openat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-access
-a always,exit -F arch=b32 -S openat -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-access
</html:pre>
If the system is 64 bit then also add the following lines:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">
-a always,exit -F arch=b64 -S openat -F a2&amp;0100 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
-a always,exit -F arch=b64 -S openat -F a2&amp;0100 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
-a always,exit -F arch=b64 -S openat -F a2&amp;01003 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
-a always,exit -F arch=b64 -S openat -F a2&amp;01003 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
-a always,exit -F arch=b64 -S openat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-access
-a always,exit -F arch=b64 -S openat -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-access
</html:pre></description>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</reference>
            <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</reference>
            <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.2.4</reference>
            <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.2.1</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000064-GPOS-00033</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000458-GPOS-00203</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000461-GPOS-00205</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</reference>
            <reference href="">SRG-OS-000458-VMM-001810</reference>
            <reference href="">SRG-OS-000461-VMM-001830</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.2.6.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO12.06</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI08.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS02.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS02.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS02.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.2.6</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.7.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.7</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.15.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.15.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.5</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.7</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.2.2</reference>
            <reference href="https://www.cisecurity.org/controls/">1</reference>
            <reference href="https://www.cisecurity.org/controls/">11</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">13</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">19</reference>
            <reference href="https://www.cisecurity.org/controls/">2</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">4</reference>
            <reference href="https://www.cisecurity.org/controls/">5</reference>
            <reference href="https://www.cisecurity.org/controls/">6</reference>
            <reference href="https://www.cisecurity.org/controls/">7</reference>
            <reference href="https://www.cisecurity.org/controls/">8</reference>
            <reference href="https://www.cisecurity.org/controls/">9</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The more specific rules cover a subset of events covered by the less specific rules.
By ordering them from more specific to less specific, it is assured that the less specific
rule will not catch events better recorded by the more specific rule.</rationale>
            <platform idref="cpe:/a:machine"/>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_unsuccessful_file_modification_openat_rule_order:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-audit_rules_unsuccessful_file_modification_openat_rule_order_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_ftruncate" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record Unsuccessful Access Attempts to Files - ftruncate</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">At a minimum, the audit system should collect unauthorized file
accesses for all users and root. If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured
to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following lines to a file with suffix
<html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S ftruncate -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b32 -S ftruncate -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=access</html:pre>

If the system is 64 bit then also add the following lines:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">
-a always,exit -F arch=b64 -S ftruncate -F exiu=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b64 -S ftruncate -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=access</html:pre>

If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> file:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S ftruncate -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b32 -S ftruncate -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=access</html:pre>

If the system is 64 bit then also add the following lines:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">
-a always,exit -F arch=b64 -S ftruncate -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b64 -S ftruncate -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=access</html:pre></description>
            <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.</warning>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</reference>
            <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</reference>
            <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.2.4</reference>
            <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.2.1</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000064-GPOS-00033</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000458-GPOS-00203</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000461-GPOS-00205</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</reference>
            <reference href="">SRG-OS-000458-VMM-001810</reference>
            <reference href="">SRG-OS-000461-VMM-001830</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.2.6.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO12.06</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI08.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS02.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS02.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS02.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.2.6</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.7.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.7</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.15.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.15.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.5</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.7</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.2.2</reference>
            <reference href="https://www.cisecurity.org/controls/">1</reference>
            <reference href="https://www.cisecurity.org/controls/">11</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">13</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">19</reference>
            <reference href="https://www.cisecurity.org/controls/">2</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">4</reference>
            <reference href="https://www.cisecurity.org/controls/">5</reference>
            <reference href="https://www.cisecurity.org/controls/">6</reference>
            <reference href="https://www.cisecurity.org/controls/">7</reference>
            <reference href="https://www.cisecurity.org/controls/">8</reference>
            <reference href="https://www.cisecurity.org/controls/">9</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Unsuccessful attempts to access files could be an indicator of malicious activity on a system. Auditing
these events could serve as evidence of potential system compromise.</rationale>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_unsuccessful_file_modification_ftruncate" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then



# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	PATTERN="-a always,exit -F arch=$ARCH -S ftruncate -F exit=-EACCES.*"
	GROUP="access"
	FULL_RULE="-a always,exit -F arch=$ARCH -S ftruncate -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=access"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_fix_audit_syscall_rule" use="legacy"/>
	fix_audit_syscall_rule "auditctl" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
	fix_audit_syscall_rule "augenrules" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
done

for ARCH in "${RULE_ARCHS[@]}"
do
        PATTERN="-a always,exit -F arch=$ARCH -S ftruncate -F exit=-EPERM.*"
        GROUP="access"
        FULL_RULE="-a always,exit -F arch=$ARCH -S ftruncate -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=access"
        # Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_fix_audit_syscall_rule" use="legacy"/>
        fix_audit_syscall_rule "auditctl" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
        fix_audit_syscall_rule "augenrules" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_unsuccessful_file_modification_ftruncate" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="low" strategy="restrict">- name: Set architecture for audit ftruncate tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_ftruncate
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Search /etc/audit/rules.d for other DAC audit rules
  find:
    paths: /etc/audit/rules.d
    recurse: false
    contains: -F key=perm_mod$
    patterns: '*.rules'
  register: find_ftruncate
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_ftruncate
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: If existing DAC ruleset not found, use /etc/audit/rules.d/access.rules as
    the recipient for the rule
  set_fact:
    all_files:
      - /etc/audit/rules.d/access.rules
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_ftruncate.matched is defined and find_ftruncate.matched == 0
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_ftruncate
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
      - '{{ find_ftruncate.files | map(attribute=''path'') | list | first }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_ftruncate.matched is defined and find_ftruncate.matched &gt; 0
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_ftruncate
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the ftruncate rule in rules.d when on x86
  lineinfile:
    path: '{{ all_files[0] }}'
    line: '{{ item }}'
    create: true
  with_items:
    - -a always,exit -F arch=b32 -S ftruncate -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset
      -F key=access
    - -a always,exit -F arch=b32 -S ftruncate -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
      -F key=access
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_ftruncate
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the ftruncate rule in rules.d when on x86_64
  lineinfile:
    path: '{{ all_files[0] }}'
    line: '{{ item }}'
    create: true
  with_items:
    - -a always,exit -F arch=b64 -S ftruncate -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset
      -F key=access
    - -a always,exit -F arch=b64 -S ftruncate -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
      -F key=access
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - audit_arch is defined and audit_arch == 'b64'
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_ftruncate
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the ftruncate rule in /etc/audit/audit.rules when on x86
  lineinfile:
    line: '{{ item }}'
    state: present
    dest: /etc/audit/audit.rules
    create: true
  with_items:
    - -a always,exit -F arch=b32 -S ftruncate -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset
      -F key=access
    - -a always,exit -F arch=b32 -S ftruncate -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
      -F key=access
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_ftruncate
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the ftruncate rule in audit.rules when on x86_64
  lineinfile:
    line: '{{ item }}'
    state: present
    dest: /etc/audit/audit.rules
    create: true
  with_items:
    - -a always,exit -F arch=b64 -S ftruncate -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset
      -F key=access
    - -a always,exit -F arch=b64 -S ftruncate -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
      -F key=access
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - audit_arch is defined and audit_arch == 'b64'
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_ftruncate
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_unsuccessful_file_modification_ftruncate:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-audit_rules_unsuccessful_file_modification_ftruncate_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_removexattr" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record Unsuccessul Permission Changes to Files - removexattr</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The audit system should collect unsuccessful file permission change
attempts for all users and root.
If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured
to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following lines to a file with suffix
<html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>.
If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> file.
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S removexattr -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-perm-change
-a always,exit -F arch=b32 -S removexattr -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-perm-change</html:pre>
If the system is 64 bit then also add the following lines:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b64 -S removexattr -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-perm-change
-a always,exit -F arch=b64 -S removexattr -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-perm-change</html:pre></description>
            <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the audit rule checks a
system call independently of other system calls. Grouping system calls related
to the same event is more efficient. See the following example:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S chmod,fchmod,fchmodat,setxattr,lsetxattr,fsetxattr -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-perm-change</html:pre></warning>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="">SRG-OS-000458-VMM-001810</reference>
            <reference href="">SRG-OS-000461-VMM-001830</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Unsuccessful attempts to change permissions of files could be an indicator of malicious activity on a system. Auditing
these events could serve as evidence of potential system compromise.</rationale>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_unsuccessful_file_modification_removexattr" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then



# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	PATTERN="-a always,exit -F arch=$ARCH -S removexattr -F exit=-EACCES.*"
	GROUP="access"
	FULL_RULE="-a always,exit -F arch=$ARCH -S removexattr -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=access"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_fix_audit_syscall_rule" use="legacy"/>
	fix_audit_syscall_rule "auditctl" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
	fix_audit_syscall_rule "augenrules" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
done

for ARCH in "${RULE_ARCHS[@]}"
do
        PATTERN="-a always,exit -F arch=$ARCH -S removexattr -F exit=-EPERM.*"
        GROUP="access"
        FULL_RULE="-a always,exit -F arch=$ARCH -S removexattr -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=access"
        # Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_fix_audit_syscall_rule" use="legacy"/>
        fix_audit_syscall_rule "auditctl" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
        fix_audit_syscall_rule "augenrules" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_unsuccessful_file_modification_removexattr" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="low" strategy="restrict">- name: Set architecture for audit removexattr tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_removexattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Search /etc/audit/rules.d for other DAC audit rules
  find:
    paths: /etc/audit/rules.d
    recurse: false
    contains: -F key=perm_mod$
    patterns: '*.rules'
  register: find_removexattr
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_removexattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: If existing DAC ruleset not found, use /etc/audit/rules.d/access.rules as
    the recipient for the rule
  set_fact:
    all_files:
      - /etc/audit/rules.d/access.rules
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_removexattr.matched is defined and find_removexattr.matched == 0
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_removexattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
      - '{{ find_removexattr.files | map(attribute=''path'') | list | first }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_removexattr.matched is defined and find_removexattr.matched &gt; 0
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_removexattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the removexattr rule in rules.d when on x86
  lineinfile:
    path: '{{ all_files[0] }}'
    line: '{{ item }}'
    create: true
  with_items:
    - -a always,exit -F arch=b32 -S removexattr -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset
      -F key=access
    - -a always,exit -F arch=b32 -S removexattr -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
      -F key=access
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_removexattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the removexattr rule in rules.d when on x86_64
  lineinfile:
    path: '{{ all_files[0] }}'
    line: '{{ item }}'
    create: true
  with_items:
    - -a always,exit -F arch=b64 -S removexattr -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset
      -F key=access
    - -a always,exit -F arch=b64 -S removexattr -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
      -F key=access
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - audit_arch is defined and audit_arch == 'b64'
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_removexattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the removexattr rule in /etc/audit/audit.rules when on x86
  lineinfile:
    line: '{{ item }}'
    state: present
    dest: /etc/audit/audit.rules
    create: true
  with_items:
    - -a always,exit -F arch=b32 -S removexattr -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset
      -F key=access
    - -a always,exit -F arch=b32 -S removexattr -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
      -F key=access
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_removexattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the removexattr rule in audit.rules when on x86_64
  lineinfile:
    line: '{{ item }}'
    state: present
    dest: /etc/audit/audit.rules
    create: true
  with_items:
    - -a always,exit -F arch=b64 -S removexattr -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset
      -F key=access
    - -a always,exit -F arch=b64 -S removexattr -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
      -F key=access
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - audit_arch is defined and audit_arch == 'b64'
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_removexattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_unsuccessful_file_modification_removexattr:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-audit_rules_unsuccessful_file_modification_removexattr_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_successful_file_modification_truncate" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record Successful Access Attempts to Files - truncate</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">At a minimum, the audit system should collect unauthorized file
accesses for all users and root. If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured
to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following lines to a file with suffix
<html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>:

<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S truncate -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-access</html:pre>

If the system is 64 bit then also add the following lines:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b64 -S truncate -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-access</html:pre>

If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> file:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S truncate -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-access</html:pre>

If the system is 64 bit then also add the following lines:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b64 -S truncate -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-access</html:pre></description>
            <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.</warning>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">File access attempts could be an indicator of malicious activity on a system. Auditing
these events could serve as evidence of potential system compromise.</rationale>
            <platform idref="cpe:/a:machine"/>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-audit_rules_successful_file_modification_truncate_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_successful_file_modification_open_o_trunc_write" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record Successful Creation Attempts to Files - open O_TRUNC_WRITE</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The audit system should collect detailed file access records for
all users and root. The <html:code xmlns:html="http://www.w3.org/1999/xhtml">open</html:code> syscall can be used to modify
files if called for write operation with the O_TRUNC_WRITE flag.

The following audit rules will assure that successful attempts to create a
file via <html:code xmlns:html="http://www.w3.org/1999/xhtml">open</html:code> syscall are collected.

If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code>
program to read audit rules during daemon startup (the default), add the
rules below to a file with suffix <html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the directory
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>.

If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the rules below to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> file.

<html:pre xmlns:html="http://www.w3.org/1999/xhtml">
-a always,exit -F arch=b32 -S open -F a2&amp;01003 -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-modification
</html:pre>

If the system is 64 bit then also add the following lines:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">
-a always,exit -F arch=b64 -S open -F a2&amp;01003 -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-modification
</html:pre></description>
            <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping system calls related
to the same event is more efficient. See the following example:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S open,openat -F a2&amp;01003 -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-modification</html:pre></warning>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Successful attempts to access files could be an indicator of malicious activity on a system. Auditing
these events could serve as evidence of potential system compromise.</rationale>
            <platform idref="cpe:/a:machine"/>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-audit_rules_successful_file_modification_open_o_trunc_write_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_fchmod" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record Unsuccessul Permission Changes to Files - fchmod</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The audit system should collect unsuccessful file permission change
attempts for all users and root.
If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured
to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following lines to a file with suffix
<html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>.
If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> file.
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S fchmod -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-perm-change
-a always,exit -F arch=b32 -S fchmod -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-perm-change</html:pre>
If the system is 64 bit then also add the following lines:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b64 -S fchmod -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-perm-change
-a always,exit -F arch=b64 -S fchmod -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-perm-change</html:pre></description>
            <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the audit rule checks a
system call independently of other system calls. Grouping system calls related
to the same event is more efficient. See the following example:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S chmod,fchmod,fchmodat,setxattr,lsetxattr,fsetxattr -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-perm-change</html:pre></warning>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="">SRG-OS-000458-VMM-001810</reference>
            <reference href="">SRG-OS-000461-VMM-001830</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Unsuccessful attempts to change permissions of files could be an indicator of malicious activity on a system. Auditing
these events could serve as evidence of potential system compromise.</rationale>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_unsuccessful_file_modification_fchmod" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then



# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	PATTERN="-a always,exit -F arch=$ARCH -S fchmod -F exit=-EACCES.*"
	GROUP="access"
	FULL_RULE="-a always,exit -F arch=$ARCH -S fchmod -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=access"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_fix_audit_syscall_rule" use="legacy"/>
	fix_audit_syscall_rule "auditctl" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
	fix_audit_syscall_rule "augenrules" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
done

for ARCH in "${RULE_ARCHS[@]}"
do
        PATTERN="-a always,exit -F arch=$ARCH -S fchmod -F exit=-EPERM.*"
        GROUP="access"
        FULL_RULE="-a always,exit -F arch=$ARCH -S fchmod -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=access"
        # Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_fix_audit_syscall_rule" use="legacy"/>
        fix_audit_syscall_rule "auditctl" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
        fix_audit_syscall_rule "augenrules" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_unsuccessful_file_modification_fchmod" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="low" strategy="restrict">- name: Set architecture for audit fchmod tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_fchmod
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Search /etc/audit/rules.d for other DAC audit rules
  find:
    paths: /etc/audit/rules.d
    recurse: false
    contains: -F key=perm_mod$
    patterns: '*.rules'
  register: find_fchmod
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_fchmod
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: If existing DAC ruleset not found, use /etc/audit/rules.d/access.rules as
    the recipient for the rule
  set_fact:
    all_files:
      - /etc/audit/rules.d/access.rules
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_fchmod.matched is defined and find_fchmod.matched == 0
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_fchmod
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
      - '{{ find_fchmod.files | map(attribute=''path'') | list | first }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_fchmod.matched is defined and find_fchmod.matched &gt; 0
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_fchmod
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the fchmod rule in rules.d when on x86
  lineinfile:
    path: '{{ all_files[0] }}'
    line: '{{ item }}'
    create: true
  with_items:
    - -a always,exit -F arch=b32 -S fchmod -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset
      -F key=access
    - -a always,exit -F arch=b32 -S fchmod -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
      -F key=access
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_fchmod
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the fchmod rule in rules.d when on x86_64
  lineinfile:
    path: '{{ all_files[0] }}'
    line: '{{ item }}'
    create: true
  with_items:
    - -a always,exit -F arch=b64 -S fchmod -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset
      -F key=access
    - -a always,exit -F arch=b64 -S fchmod -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
      -F key=access
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - audit_arch is defined and audit_arch == 'b64'
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_fchmod
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the fchmod rule in /etc/audit/audit.rules when on x86
  lineinfile:
    line: '{{ item }}'
    state: present
    dest: /etc/audit/audit.rules
    create: true
  with_items:
    - -a always,exit -F arch=b32 -S fchmod -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset
      -F key=access
    - -a always,exit -F arch=b32 -S fchmod -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
      -F key=access
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_fchmod
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the fchmod rule in audit.rules when on x86_64
  lineinfile:
    line: '{{ item }}'
    state: present
    dest: /etc/audit/audit.rules
    create: true
  with_items:
    - -a always,exit -F arch=b64 -S fchmod -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset
      -F key=access
    - -a always,exit -F arch=b64 -S fchmod -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
      -F key=access
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - audit_arch is defined and audit_arch == 'b64'
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_fchmod
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_unsuccessful_file_modification_fchmod:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-audit_rules_unsuccessful_file_modification_fchmod_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_successful_file_modification_unlink" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record Successful Delete Attempts to Files - unlink</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">At a minimum, the audit system should collect file
deletion for all users and root. If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured
to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following lines to a file with suffix
<html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>:

<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S unlink -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-delete</html:pre>

If the system is 64 bit then also add the following lines:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b64 -S unlink -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-delete</html:pre>

If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> file:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S unlink -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-delete</html:pre>

If the system is 64 bit then also add the following lines:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b64 -S unlink -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-delete</html:pre></description>
            <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.</warning>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">File deletion attempts could be an indicator of malicious activity on a system. Auditing
these events could serve as evidence of potential system compromise.</rationale>
            <platform idref="cpe:/a:machine"/>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-audit_rules_successful_file_modification_unlink_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_lchown" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record Unsuccessul Ownership Changes to Files - lchown</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The audit system should collect unsuccessful file ownership change
attempts for all users and root.

If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured
to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following lines to a file with suffix
<html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>.

If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> file.

<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S lchown -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-perm-change
-a always,exit -F arch=b32 -S lchown -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-perm-change</html:pre>

If the system is 64 bit then also add the following lines:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b64 -S lchown -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-perm-change
-a always,exit -F arch=b64 -S lchown -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-perm-change</html:pre></description>
            <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the audit rule checks a
system call independently of other system calls. Grouping system calls related
to the same event is more efficient. See the following example:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S lchown,fchown,chown,fchownat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-perm-change</html:pre></warning>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="">SRG-OS-000458-VMM-001810</reference>
            <reference href="">SRG-OS-000461-VMM-001830</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Unsuccessful attempts to change ownership of files could be an indicator of malicious activity on a system. Auditing
these events could serve as evidence of potential system compromise.</rationale>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_unsuccessful_file_modification_lchown" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then



# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	PATTERN="-a always,exit -F arch=$ARCH -S lchown -F exit=-EACCES.*"
	GROUP="access"
	FULL_RULE="-a always,exit -F arch=$ARCH -S lchown -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=access"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_fix_audit_syscall_rule" use="legacy"/>
	fix_audit_syscall_rule "auditctl" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
	fix_audit_syscall_rule "augenrules" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
done

for ARCH in "${RULE_ARCHS[@]}"
do
        PATTERN="-a always,exit -F arch=$ARCH -S lchown -F exit=-EPERM.*"
        GROUP="access"
        FULL_RULE="-a always,exit -F arch=$ARCH -S lchown -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=access"
        # Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_fix_audit_syscall_rule" use="legacy"/>
        fix_audit_syscall_rule "auditctl" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
        fix_audit_syscall_rule "augenrules" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_unsuccessful_file_modification_lchown" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="low" strategy="restrict">- name: Set architecture for audit lchown tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_lchown
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Search /etc/audit/rules.d for other DAC audit rules
  find:
    paths: /etc/audit/rules.d
    recurse: false
    contains: -F key=perm_mod$
    patterns: '*.rules'
  register: find_lchown
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_lchown
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: If existing DAC ruleset not found, use /etc/audit/rules.d/access.rules as
    the recipient for the rule
  set_fact:
    all_files:
      - /etc/audit/rules.d/access.rules
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_lchown.matched is defined and find_lchown.matched == 0
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_lchown
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
      - '{{ find_lchown.files | map(attribute=''path'') | list | first }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_lchown.matched is defined and find_lchown.matched &gt; 0
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_lchown
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the lchown rule in rules.d when on x86
  lineinfile:
    path: '{{ all_files[0] }}'
    line: '{{ item }}'
    create: true
  with_items:
    - -a always,exit -F arch=b32 -S lchown -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset
      -F key=access
    - -a always,exit -F arch=b32 -S lchown -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
      -F key=access
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_lchown
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the lchown rule in rules.d when on x86_64
  lineinfile:
    path: '{{ all_files[0] }}'
    line: '{{ item }}'
    create: true
  with_items:
    - -a always,exit -F arch=b64 -S lchown -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset
      -F key=access
    - -a always,exit -F arch=b64 -S lchown -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
      -F key=access
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - audit_arch is defined and audit_arch == 'b64'
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_lchown
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the lchown rule in /etc/audit/audit.rules when on x86
  lineinfile:
    line: '{{ item }}'
    state: present
    dest: /etc/audit/audit.rules
    create: true
  with_items:
    - -a always,exit -F arch=b32 -S lchown -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset
      -F key=access
    - -a always,exit -F arch=b32 -S lchown -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
      -F key=access
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_lchown
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the lchown rule in audit.rules when on x86_64
  lineinfile:
    line: '{{ item }}'
    state: present
    dest: /etc/audit/audit.rules
    create: true
  with_items:
    - -a always,exit -F arch=b64 -S lchown -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset
      -F key=access
    - -a always,exit -F arch=b64 -S lchown -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
      -F key=access
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - audit_arch is defined and audit_arch == 'b64'
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_lchown
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_unsuccessful_file_modification_lchown:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-audit_rules_unsuccessful_file_modification_lchown_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_openat_o_creat" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record Unsuccessful Creation Attempts to Files - openat O_CREAT</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The audit system should collect unauthorized file accesses for
all users and root. The <html:code xmlns:html="http://www.w3.org/1999/xhtml">openat</html:code> syscall can be used to create new files
when O_CREAT flag is specified.

The following auidt rules will asure that unsuccessful attempts to create a
file via <html:code xmlns:html="http://www.w3.org/1999/xhtml">openat</html:code> syscall are collected.

If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code>
program to read audit rules during daemon startup (the default), add the
rules below to a file with suffix <html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the directory
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>.

If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the rules below to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> file.
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">
-a always,exit -F arch=b32 -S openat -F a2&amp;0100 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
-a always,exit -F arch=b32 -S openat -F a2&amp;0100 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
</html:pre>

If the system is 64 bit then also add the following lines:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">
-a always,exit -F arch=b64 -S openat -F a2&amp;0100 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
-a always,exit -F arch=b64 -S openat -F a2&amp;0100 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
</html:pre></description>
            <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping system calls related
to the same event is more efficient. See the following example:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&amp;0100 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create</html:pre></warning>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</reference>
            <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</reference>
            <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.2.4</reference>
            <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.2.1</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000064-GPOS-00033</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000458-GPOS-00203</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000461-GPOS-00205</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</reference>
            <reference href="">SRG-OS-000458-VMM-001810</reference>
            <reference href="">SRG-OS-000461-VMM-001830</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.2.6.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO12.06</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI08.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS02.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS02.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS02.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.2.6</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.7.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.7</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.15.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.15.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.5</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.7</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.2.2</reference>
            <reference href="https://www.cisecurity.org/controls/">1</reference>
            <reference href="https://www.cisecurity.org/controls/">11</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">13</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">19</reference>
            <reference href="https://www.cisecurity.org/controls/">2</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">4</reference>
            <reference href="https://www.cisecurity.org/controls/">5</reference>
            <reference href="https://www.cisecurity.org/controls/">6</reference>
            <reference href="https://www.cisecurity.org/controls/">7</reference>
            <reference href="https://www.cisecurity.org/controls/">8</reference>
            <reference href="https://www.cisecurity.org/controls/">9</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Unsuccessful attempts to access files could be an indicator of malicious activity on a system. Auditing
these events could serve as evidence of potential system compromise.</rationale>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_unsuccessful_file_modification_openat_o_creat" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Add unsuccessful file operations audit rules
  blockinfile:
    path: /etc/audit/rules.d/30-ospp-v42-remediation.rules
    create: true
    block: |-
      ## This content is a section of an Audit config snapshot recommended for Fedora systems that target OSPP compliance.
      ## The following content has been retreived on 2019-03-11 from: https://github.com/linux-audit/audit-userspace/blob/master/rules/30-ospp-v42.rules

      ## The purpose of these rules is to meet the requirements for Operating
      ## System Protection Profile (OSPP)v4.2. These rules depends on having
      ## 10-base-config.rules, 11-loginuid.rules, and 43-module-load.rules installed.

      ## Unsuccessful file creation (open with O_CREAT)
      -a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&amp;0100 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
      -a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&amp;0100 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
      -a always,exit -F arch=b32 -S open -F a1&amp;0100 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
      -a always,exit -F arch=b64 -S open -F a1&amp;0100 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
      -a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&amp;0100 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
      -a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&amp;0100 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
      -a always,exit -F arch=b32 -S open -F a1&amp;0100 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
      -a always,exit -F arch=b64 -S open -F a1&amp;0100 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
      -a always,exit -F arch=b32 -S creat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
      -a always,exit -F arch=b64 -S creat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
      -a always,exit -F arch=b32 -S creat -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
      -a always,exit -F arch=b64 -S creat -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create

      ## Unsuccessful file modifications (open for write or truncate)
      -a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&amp;01003 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
      -a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&amp;01003 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
      -a always,exit -F arch=b32 -S open -F a1&amp;01003 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
      -a always,exit -F arch=b64 -S open -F a1&amp;01003 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
      -a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&amp;01003 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
      -a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&amp;01003 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
      -a always,exit -F arch=b32 -S open -F a1&amp;01003 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
      -a always,exit -F arch=b64 -S open -F a1&amp;01003 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
      -a always,exit -F arch=b32 -S truncate,ftruncate -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
      -a always,exit -F arch=b64 -S truncate,ftruncate -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
      -a always,exit -F arch=b32 -S truncate,ftruncate -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
      -a always,exit -F arch=b64 -S truncate,ftruncate -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification

      ## Unsuccessful file access (any other opens) This has to go last.
      -a always,exit -F arch=b32 -S open,creat,truncate,ftruncate,openat,open_by_handle_at -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-access
      -a always,exit -F arch=b64 -S open,creat,truncate,ftruncate,openat,open_by_handle_at -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-access
      -a always,exit -F arch=b32 -S open,creat,truncate,ftruncate,openat,open_by_handle_at -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-access
      -a always,exit -F arch=b64 -S open,creat,truncate,ftruncate,openat,open_by_handle_at -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-access
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_openat_o_creat
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_unsuccessful_file_modification_openat_o_creat:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-audit_rules_unsuccessful_file_modification_openat_o_creat_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_successful_file_modification_fchmodat" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record Successful Permission Changes to Files - fchmodat</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">At a minimum, the audit system should collect file permission changes
for all users and root. If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured
to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following lines to a file with suffix
<html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>:

<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S fchmodat -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-perm-change</html:pre>

If the system is 64 bit then also add the following lines:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b64 -S fchmodat -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-perm-change</html:pre>

If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> file:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S fchmodat -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-perm-change</html:pre>

If the system is 64 bit then also add the following lines:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b64 -S fchmodat -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-perm-change</html:pre></description>
            <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.</warning>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">File permission changes could be an indicator of malicious activity on a system. Auditing
these events could serve as evidence of potential system compromise.</rationale>
            <platform idref="cpe:/a:machine"/>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-audit_rules_successful_file_modification_fchmodat_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_successful_file_modification_fsetxattr" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record Successful Permission Changes to Files - fsetxattr</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">At a minimum, the audit system should collect file permission changes
for all users and root. If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured
to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following lines to a file with suffix
<html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>:

<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S fsetxattr -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-perm-change</html:pre>

If the system is 64 bit then also add the following lines:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b64 -S fsetxattr -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-perm-change</html:pre>

If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> file:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S fsetxattr -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-perm-change</html:pre>

If the system is 64 bit then also add the following lines:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b64 -S fsetxattr -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-perm-change</html:pre></description>
            <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.</warning>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">File permission changes could be an indicator of malicious activity on a system. Auditing
these events could serve as evidence of potential system compromise.</rationale>
            <platform idref="cpe:/a:machine"/>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-audit_rules_successful_file_modification_fsetxattr_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_successful_file_modification_open_by_handle_at" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record Successful Access Attempts to Files - open_by_handle_at</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">At a minimum, the audit system should collect unauthorized file
accesses for all users and root. If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured
to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following lines to a file with suffix
<html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>:

<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S open_by_handle_at -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-access</html:pre>

If the system is 64 bit then also add the following lines:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b64 -S open_by_handle_at -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-access</html:pre>

If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> file:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S open_by_handle_at -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-access</html:pre>

If the system is 64 bit then also add the following lines:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b64 -S open_by_handle_at -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-access</html:pre></description>
            <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.</warning>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">File access attempts could be an indicator of malicious activity on a system. Auditing
these events could serve as evidence of potential system compromise.</rationale>
            <platform idref="cpe:/a:machine"/>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-audit_rules_successful_file_modification_open_by_handle_at_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_renameat" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record Unsuccessul Delete Attempts to Files - renameat</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The audit system should collect unsuccessful file deletion
attempts for all users and root. If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured
to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following lines to a file with suffix
<html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>.
If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> file.
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S renameat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-delete
-a always,exit -F arch=b32 -S renameat -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-delete</html:pre>
If the system is 64 bit then also add the following lines:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">
-a always,exit -F arch=b64 -S renameat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-delete
-a always,exit -F arch=b64 -S renameat -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-delete</html:pre></description>
            <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping system calls related
to the same event is more efficient. See the following example:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S unlink,unlinkat,rename,renameat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-delete</html:pre></warning>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</reference>
            <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</reference>
            <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.2.4</reference>
            <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.2.1</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000064-GPOS-00033</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000458-GPOS-00203</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000461-GPOS-00205</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000468-GPOS-00212</reference>
            <reference href="">SRG-OS-000458-VMM-001810</reference>
            <reference href="">SRG-OS-000461-VMM-001830</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.2.6.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO12.06</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI08.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS02.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS02.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS02.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.2.6</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.7.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.7</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.15.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.15.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.5</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.7</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.2.2</reference>
            <reference href="https://www.cisecurity.org/controls/">1</reference>
            <reference href="https://www.cisecurity.org/controls/">11</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">13</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">19</reference>
            <reference href="https://www.cisecurity.org/controls/">2</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">4</reference>
            <reference href="https://www.cisecurity.org/controls/">5</reference>
            <reference href="https://www.cisecurity.org/controls/">6</reference>
            <reference href="https://www.cisecurity.org/controls/">7</reference>
            <reference href="https://www.cisecurity.org/controls/">8</reference>
            <reference href="https://www.cisecurity.org/controls/">9</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Unsuccessful attempts to delete files could be an indicator of malicious activity on a system. Auditing
these events could serve as evidence of potential system compromise.</rationale>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_unsuccessful_file_modification_renameat" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then



# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	PATTERN="-a always,exit -F arch=$ARCH -S renameat -F exit=-EACCES.*"
	GROUP="access"
	FULL_RULE="-a always,exit -F arch=$ARCH -S renameat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=access"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_fix_audit_syscall_rule" use="legacy"/>
	fix_audit_syscall_rule "auditctl" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
	fix_audit_syscall_rule "augenrules" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
done

for ARCH in "${RULE_ARCHS[@]}"
do
        PATTERN="-a always,exit -F arch=$ARCH -S renameat -F exit=-EPERM.*"
        GROUP="access"
        FULL_RULE="-a always,exit -F arch=$ARCH -S renameat -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=access"
        # Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_fix_audit_syscall_rule" use="legacy"/>
        fix_audit_syscall_rule "auditctl" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
        fix_audit_syscall_rule "augenrules" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_unsuccessful_file_modification_renameat" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="low" strategy="restrict">- name: Set architecture for audit renameat tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_renameat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Search /etc/audit/rules.d for other DAC audit rules
  find:
    paths: /etc/audit/rules.d
    recurse: false
    contains: -F key=perm_mod$
    patterns: '*.rules'
  register: find_renameat
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_renameat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: If existing DAC ruleset not found, use /etc/audit/rules.d/access.rules as
    the recipient for the rule
  set_fact:
    all_files:
      - /etc/audit/rules.d/access.rules
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_renameat.matched is defined and find_renameat.matched == 0
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_renameat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
      - '{{ find_renameat.files | map(attribute=''path'') | list | first }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_renameat.matched is defined and find_renameat.matched &gt; 0
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_renameat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the renameat rule in rules.d when on x86
  lineinfile:
    path: '{{ all_files[0] }}'
    line: '{{ item }}'
    create: true
  with_items:
    - -a always,exit -F arch=b32 -S renameat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset
      -F key=access
    - -a always,exit -F arch=b32 -S renameat -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
      -F key=access
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_renameat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the renameat rule in rules.d when on x86_64
  lineinfile:
    path: '{{ all_files[0] }}'
    line: '{{ item }}'
    create: true
  with_items:
    - -a always,exit -F arch=b64 -S renameat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset
      -F key=access
    - -a always,exit -F arch=b64 -S renameat -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
      -F key=access
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - audit_arch is defined and audit_arch == 'b64'
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_renameat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the renameat rule in /etc/audit/audit.rules when on x86
  lineinfile:
    line: '{{ item }}'
    state: present
    dest: /etc/audit/audit.rules
    create: true
  with_items:
    - -a always,exit -F arch=b32 -S renameat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset
      -F key=access
    - -a always,exit -F arch=b32 -S renameat -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
      -F key=access
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_renameat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the renameat rule in audit.rules when on x86_64
  lineinfile:
    line: '{{ item }}'
    state: present
    dest: /etc/audit/audit.rules
    create: true
  with_items:
    - -a always,exit -F arch=b64 -S renameat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset
      -F key=access
    - -a always,exit -F arch=b64 -S renameat -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
      -F key=access
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - audit_arch is defined and audit_arch == 'b64'
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_renameat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_unsuccessful_file_modification_renameat:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-audit_rules_unsuccessful_file_modification_renameat_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_open_rule_order" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure auditd Rules For Unauthorized Attempts To open Are Ordered Correctly</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The audit system should collect detailed unauthorized file
accesses for all users and root.
To correctly identify unsuccessful creation, unsuccessful modification and unsuccessful access
of files via <html:code xmlns:html="http://www.w3.org/1999/xhtml">open</html:code> syscall the audit rules collecting these events need to be in certain order.
The more specific rules need to come before the less specific rules. The reason for that is that more
specific rules cover a subset of events covered in the less specific rules, thus, they need to come
before to not be overshadowed by less specific rules, which match a bigger set of events.
Make sure that rules for unsuccessful calls of <html:code xmlns:html="http://www.w3.org/1999/xhtml">open</html:code> syscall are in the order shown below.
If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code>
program to read audit rules during daemon startup (the default), check the order of
rules below in a file with suffix <html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the directory
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>.
If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, check the order of rules below in
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> file.
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">
-a always,exit -F arch=b32 -S open -F a1&amp;0100 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
-a always,exit -F arch=b32 -S open -F a1&amp;0100 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
-a always,exit -F arch=b32 -S open -F a1&amp;01003 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
-a always,exit -F arch=b32 -S open -F a1&amp;01003 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
-a always,exit -F arch=b32 -S open -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-access
-a always,exit -F arch=b32 -S open -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-access
</html:pre>
If the system is 64 bit then also add the following lines:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">
-a always,exit -F arch=b64 -S open -F a1&amp;0100 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
-a always,exit -F arch=b64 -S open -F a1&amp;0100 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
-a always,exit -F arch=b64 -S open -F a1&amp;01003 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
-a always,exit -F arch=b64 -S open -F a1&amp;01003 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
-a always,exit -F arch=b64 -S open -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-access
-a always,exit -F arch=b64 -S open -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-access
</html:pre></description>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</reference>
            <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</reference>
            <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.2.4</reference>
            <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.2.1</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000064-GPOS-00033</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000458-GPOS-00203</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000461-GPOS-00205</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</reference>
            <reference href="">SRG-OS-000458-VMM-001810</reference>
            <reference href="">SRG-OS-000461-VMM-001830</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.2.6.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO12.06</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI08.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS02.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS02.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS02.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.2.6</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.7.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.7</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.15.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.15.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.5</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.7</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.2.2</reference>
            <reference href="https://www.cisecurity.org/controls/">1</reference>
            <reference href="https://www.cisecurity.org/controls/">11</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">13</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">19</reference>
            <reference href="https://www.cisecurity.org/controls/">2</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">4</reference>
            <reference href="https://www.cisecurity.org/controls/">5</reference>
            <reference href="https://www.cisecurity.org/controls/">6</reference>
            <reference href="https://www.cisecurity.org/controls/">7</reference>
            <reference href="https://www.cisecurity.org/controls/">8</reference>
            <reference href="https://www.cisecurity.org/controls/">9</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The more specific rules cover a subset of events covered by the less specific rules.
By ordering them from more specific to less specific, it is assured that the less specific
rule will not catch events better recorded by the more specific rule.</rationale>
            <platform idref="cpe:/a:machine"/>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_unsuccessful_file_modification_open_rule_order:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-audit_rules_unsuccessful_file_modification_open_rule_order_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_openat" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record Unsuccessful Access Attempts to Files - openat</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">At a minimum, the audit system should collect unauthorized file
accesses for all users and root. If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured
to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following lines to a file with suffix
<html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S openat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b32 -S openat -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=access</html:pre>

If the system is 64 bit then also add the following lines:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">
-a always,exit -F arch=b64 -S openat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b64 -S openat -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=access</html:pre>

If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> file:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S openat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b32 -S openat -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=access</html:pre>

If the system is 64 bit then also add the following lines:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">
-a always,exit -F arch=b64 -S openat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b64 -S openat -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=access</html:pre></description>
            <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.</warning>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</reference>
            <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</reference>
            <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.2.4</reference>
            <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.2.1</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000064-GPOS-00033</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000458-GPOS-00203</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000461-GPOS-00205</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</reference>
            <reference href="">SRG-OS-000458-VMM-001810</reference>
            <reference href="">SRG-OS-000461-VMM-001830</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.2.6.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO12.06</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI08.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS02.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS02.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS02.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.2.6</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.7.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.7</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.15.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.15.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.5</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.7</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.2.2</reference>
            <reference href="https://www.cisecurity.org/controls/">1</reference>
            <reference href="https://www.cisecurity.org/controls/">11</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">13</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">19</reference>
            <reference href="https://www.cisecurity.org/controls/">2</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">4</reference>
            <reference href="https://www.cisecurity.org/controls/">5</reference>
            <reference href="https://www.cisecurity.org/controls/">6</reference>
            <reference href="https://www.cisecurity.org/controls/">7</reference>
            <reference href="https://www.cisecurity.org/controls/">8</reference>
            <reference href="https://www.cisecurity.org/controls/">9</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Unsuccessful attempts to access files could be an indicator of malicious activity on a system. Auditing
these events could serve as evidence of potential system compromise.</rationale>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_unsuccessful_file_modification_openat" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="low" strategy="restrict">- name: Set architecture for audit openat tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_openat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Search /etc/audit/rules.d for other DAC audit rules
  find:
    paths: /etc/audit/rules.d
    recurse: false
    contains: -F key=perm_mod$
    patterns: '*.rules'
  register: find_openat
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_openat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: If existing DAC ruleset not found, use /etc/audit/rules.d/access.rules as
    the recipient for the rule
  set_fact:
    all_files:
      - /etc/audit/rules.d/access.rules
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_openat.matched is defined and find_openat.matched == 0
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_openat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
      - '{{ find_openat.files | map(attribute=''path'') | list | first }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_openat.matched is defined and find_openat.matched &gt; 0
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_openat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the openat rule in rules.d when on x86
  lineinfile:
    path: '{{ all_files[0] }}'
    line: '{{ item }}'
    create: true
  with_items:
    - -a always,exit -F arch=b32 -S openat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset
      -F key=access
    - -a always,exit -F arch=b32 -S openat -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
      -F key=access
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_openat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the openat rule in rules.d when on x86_64
  lineinfile:
    path: '{{ all_files[0] }}'
    line: '{{ item }}'
    create: true
  with_items:
    - -a always,exit -F arch=b64 -S openat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset
      -F key=access
    - -a always,exit -F arch=b64 -S openat -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
      -F key=access
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - audit_arch is defined and audit_arch == 'b64'
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_openat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the openat rule in /etc/audit/audit.rules when on x86
  lineinfile:
    line: '{{ item }}'
    state: present
    dest: /etc/audit/audit.rules
    create: true
  with_items:
    - -a always,exit -F arch=b32 -S openat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset
      -F key=access
    - -a always,exit -F arch=b32 -S openat -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
      -F key=access
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_openat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the openat rule in audit.rules when on x86_64
  lineinfile:
    line: '{{ item }}'
    state: present
    dest: /etc/audit/audit.rules
    create: true
  with_items:
    - -a always,exit -F arch=b64 -S openat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset
      -F key=access
    - -a always,exit -F arch=b64 -S openat -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
      -F key=access
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - audit_arch is defined and audit_arch == 'b64'
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_openat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_unsuccessful_file_modification_openat:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-audit_rules_unsuccessful_file_modification_openat_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_open_o_creat" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record Unsuccessful Creation Attempts to Files - open O_CREAT</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The audit system should collect unauthorized file accesses for
all users and root. The <html:code xmlns:html="http://www.w3.org/1999/xhtml">open</html:code> syscall can be used to create new files
when O_CREAT flag is specified.

The following auidt rules will asure that unsuccessful attempts to create a
file via <html:code xmlns:html="http://www.w3.org/1999/xhtml">open</html:code> syscall are collected.

If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code>
program to read audit rules during daemon startup (the default), add the
rules below to a file with suffix <html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the directory
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>.

If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the rules below to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> file.
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">
-a always,exit -F arch=b32 -S open -F a1&amp;0100 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
-a always,exit -F arch=b32 -S open -F a1&amp;0100 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
</html:pre>

If the system is 64 bit then also add the following lines:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">
-a always,exit -F arch=b64 -S open -F a1&amp;0100 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
-a always,exit -F arch=b64 -S open -F a1&amp;0100 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
</html:pre></description>
            <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping system calls related
to the same event is more efficient. See the following example:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S open -F a1&amp;0100 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create</html:pre></warning>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</reference>
            <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</reference>
            <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.2.4</reference>
            <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.2.1</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000064-GPOS-00033</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000458-GPOS-00203</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000461-GPOS-00205</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</reference>
            <reference href="">SRG-OS-000458-VMM-001810</reference>
            <reference href="">SRG-OS-000461-VMM-001830</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.2.6.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO12.06</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI08.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS02.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS02.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS02.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.2.6</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.7.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.7</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.15.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.15.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.5</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.7</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.2.2</reference>
            <reference href="https://www.cisecurity.org/controls/">1</reference>
            <reference href="https://www.cisecurity.org/controls/">11</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">13</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">19</reference>
            <reference href="https://www.cisecurity.org/controls/">2</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">4</reference>
            <reference href="https://www.cisecurity.org/controls/">5</reference>
            <reference href="https://www.cisecurity.org/controls/">6</reference>
            <reference href="https://www.cisecurity.org/controls/">7</reference>
            <reference href="https://www.cisecurity.org/controls/">8</reference>
            <reference href="https://www.cisecurity.org/controls/">9</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Unsuccessful attempts to access files could be an indicator of malicious activity on a system. Auditing
these events could serve as evidence of potential system compromise.</rationale>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_unsuccessful_file_modification_open_o_creat" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Add unsuccessful file operations audit rules
  blockinfile:
    path: /etc/audit/rules.d/30-ospp-v42-remediation.rules
    create: true
    block: |-
      ## This content is a section of an Audit config snapshot recommended for Fedora systems that target OSPP compliance.
      ## The following content has been retreived on 2019-03-11 from: https://github.com/linux-audit/audit-userspace/blob/master/rules/30-ospp-v42.rules

      ## The purpose of these rules is to meet the requirements for Operating
      ## System Protection Profile (OSPP)v4.2. These rules depends on having
      ## 10-base-config.rules, 11-loginuid.rules, and 43-module-load.rules installed.

      ## Unsuccessful file creation (open with O_CREAT)
      -a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&amp;0100 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
      -a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&amp;0100 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
      -a always,exit -F arch=b32 -S open -F a1&amp;0100 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
      -a always,exit -F arch=b64 -S open -F a1&amp;0100 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
      -a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&amp;0100 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
      -a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&amp;0100 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
      -a always,exit -F arch=b32 -S open -F a1&amp;0100 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
      -a always,exit -F arch=b64 -S open -F a1&amp;0100 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
      -a always,exit -F arch=b32 -S creat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
      -a always,exit -F arch=b64 -S creat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
      -a always,exit -F arch=b32 -S creat -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
      -a always,exit -F arch=b64 -S creat -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create

      ## Unsuccessful file modifications (open for write or truncate)
      -a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&amp;01003 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
      -a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&amp;01003 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
      -a always,exit -F arch=b32 -S open -F a1&amp;01003 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
      -a always,exit -F arch=b64 -S open -F a1&amp;01003 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
      -a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&amp;01003 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
      -a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&amp;01003 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
      -a always,exit -F arch=b32 -S open -F a1&amp;01003 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
      -a always,exit -F arch=b64 -S open -F a1&amp;01003 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
      -a always,exit -F arch=b32 -S truncate,ftruncate -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
      -a always,exit -F arch=b64 -S truncate,ftruncate -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
      -a always,exit -F arch=b32 -S truncate,ftruncate -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
      -a always,exit -F arch=b64 -S truncate,ftruncate -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification

      ## Unsuccessful file access (any other opens) This has to go last.
      -a always,exit -F arch=b32 -S open,creat,truncate,ftruncate,openat,open_by_handle_at -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-access
      -a always,exit -F arch=b64 -S open,creat,truncate,ftruncate,openat,open_by_handle_at -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-access
      -a always,exit -F arch=b32 -S open,creat,truncate,ftruncate,openat,open_by_handle_at -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-access
      -a always,exit -F arch=b64 -S open,creat,truncate,ftruncate,openat,open_by_handle_at -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-access
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_open_o_creat
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_unsuccessful_file_modification_open_o_creat:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-audit_rules_unsuccessful_file_modification_open_o_creat_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_successful_file_modification_fchownat" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record Successful Ownership Changes to Files - fchownat</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">At a minimum, the audit system should collect file ownership changes
for all users and root. If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured
to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following lines to a file with suffix
<html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>:

<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S fchownat -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-perm-change</html:pre>

If the system is 64 bit then also add the following lines:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b64 -S fchownat -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-perm-change</html:pre>

If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> file:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S fchownat -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-perm-change</html:pre>

If the system is 64 bit then also add the following lines:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b64 -S fchownat -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-perm-change</html:pre></description>
            <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.</warning>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">File ownership attempts could be an indicator of malicious activity on a system. Auditing
these events could serve as evidence of potential system compromise.</rationale>
            <platform idref="cpe:/a:machine"/>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-audit_rules_successful_file_modification_fchownat_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_successful_file_modification_open_o_creat" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record Successful Creation Attempts to Files - open O_CREAT</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">open</html:code> syscall can be used to create new files
when O_CREAT flag is specified.

The following audit rules will assure that successful attempts to create a
file via <html:code xmlns:html="http://www.w3.org/1999/xhtml">open</html:code> syscall are collected.

If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code>
program to read audit rules during daemon startup (the default), add the
rules below to a file with suffix <html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the directory
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>.

If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the rules below to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> file.

<html:pre xmlns:html="http://www.w3.org/1999/xhtml">
-a always,exit -F arch=b32 -S open -F a2&amp;0100 -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-create
</html:pre>

If the system is 64 bit then also add the following lines:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">
-a always,exit -F arch=b64 -S open -F a2&amp;0100 -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-create
</html:pre></description>
            <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping system calls related
to the same event is more efficient. See the following example:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S open,open -F a2&amp;0100 -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-create</html:pre></warning>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Successful attempts to access files could be an indicator of malicious activity on a system. Auditing
these events could serve as evidence of potential system compromise.</rationale>
            <platform idref="cpe:/a:machine"/>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-audit_rules_successful_file_modification_open_o_creat_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_successful_file_modification_renameat" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record Successful Delete Attempts to Files - renameat</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">At a minimum, the audit system should collect file
deletion for all users and root. If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured
to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following lines to a file with suffix
<html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>:

<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S renameat -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-delete</html:pre>

If the system is 64 bit then also add the following lines:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b64 -S renameat -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-delete</html:pre>

If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> file:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S renameat -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-delete</html:pre>

If the system is 64 bit then also add the following lines:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b64 -S renameat -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-delete</html:pre></description>
            <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.</warning>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">File deletion attempts could be an indicator of malicious activity on a system. Auditing
these events could serve as evidence of potential system compromise.</rationale>
            <platform idref="cpe:/a:machine"/>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-audit_rules_successful_file_modification_renameat_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_fremovexattr" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record Unsuccessul Permission Changes to Files - fremovexattr</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The audit system should collect unsuccessful file permission change
attempts for all users and root.
If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured
to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following lines to a file with suffix
<html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>.
If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> file.
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S fremovexattr -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-perm-change
-a always,exit -F arch=b32 -S fremovexattr -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-perm-change</html:pre>
If the system is 64 bit then also add the following lines:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b64 -S fremovexattr -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-perm-change
-a always,exit -F arch=b64 -S fremovexattr -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-perm-change</html:pre></description>
            <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the audit rule checks a
system call independently of other system calls. Grouping system calls related
to the same event is more efficient. See the following example:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S chmod,fchmod,fchmodat,setxattr,lsetxattr,fsetxattr -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-perm-change</html:pre></warning>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="">SRG-OS-000458-VMM-001810</reference>
            <reference href="">SRG-OS-000461-VMM-001830</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Unsuccessful attempts to change permissions of files could be an indicator of malicious activity on a system. Auditing
these events could serve as evidence of potential system compromise.</rationale>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_unsuccessful_file_modification_fremovexattr" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then



# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	PATTERN="-a always,exit -F arch=$ARCH -S fremovexattr -F exit=-EACCES.*"
	GROUP="access"
	FULL_RULE="-a always,exit -F arch=$ARCH -S fremovexattr -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=access"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_fix_audit_syscall_rule" use="legacy"/>
	fix_audit_syscall_rule "auditctl" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
	fix_audit_syscall_rule "augenrules" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
done

for ARCH in "${RULE_ARCHS[@]}"
do
        PATTERN="-a always,exit -F arch=$ARCH -S fremovexattr -F exit=-EPERM.*"
        GROUP="access"
        FULL_RULE="-a always,exit -F arch=$ARCH -S fremovexattr -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=access"
        # Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_fix_audit_syscall_rule" use="legacy"/>
        fix_audit_syscall_rule "auditctl" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
        fix_audit_syscall_rule "augenrules" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_unsuccessful_file_modification_fremovexattr" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="low" strategy="restrict">- name: Set architecture for audit fremovexattr tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_fremovexattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Search /etc/audit/rules.d for other DAC audit rules
  find:
    paths: /etc/audit/rules.d
    recurse: false
    contains: -F key=perm_mod$
    patterns: '*.rules'
  register: find_fremovexattr
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_fremovexattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: If existing DAC ruleset not found, use /etc/audit/rules.d/access.rules as
    the recipient for the rule
  set_fact:
    all_files:
      - /etc/audit/rules.d/access.rules
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_fremovexattr.matched is defined and find_fremovexattr.matched == 0
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_fremovexattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
      - '{{ find_fremovexattr.files | map(attribute=''path'') | list | first }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_fremovexattr.matched is defined and find_fremovexattr.matched &gt; 0
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_fremovexattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the fremovexattr rule in rules.d when on x86
  lineinfile:
    path: '{{ all_files[0] }}'
    line: '{{ item }}'
    create: true
  with_items:
    - -a always,exit -F arch=b32 -S fremovexattr -F exit=-EACCES -F auid&gt;=1000 -F
      auid!=unset -F key=access
    - -a always,exit -F arch=b32 -S fremovexattr -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
      -F key=access
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_fremovexattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the fremovexattr rule in rules.d when on x86_64
  lineinfile:
    path: '{{ all_files[0] }}'
    line: '{{ item }}'
    create: true
  with_items:
    - -a always,exit -F arch=b64 -S fremovexattr -F exit=-EACCES -F auid&gt;=1000 -F
      auid!=unset -F key=access
    - -a always,exit -F arch=b64 -S fremovexattr -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
      -F key=access
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - audit_arch is defined and audit_arch == 'b64'
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_fremovexattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the fremovexattr rule in /etc/audit/audit.rules when on x86
  lineinfile:
    line: '{{ item }}'
    state: present
    dest: /etc/audit/audit.rules
    create: true
  with_items:
    - -a always,exit -F arch=b32 -S fremovexattr -F exit=-EACCES -F auid&gt;=1000 -F
      auid!=unset -F key=access
    - -a always,exit -F arch=b32 -S fremovexattr -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
      -F key=access
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_fremovexattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the fremovexattr rule in audit.rules when on x86_64
  lineinfile:
    line: '{{ item }}'
    state: present
    dest: /etc/audit/audit.rules
    create: true
  with_items:
    - -a always,exit -F arch=b64 -S fremovexattr -F exit=-EACCES -F auid&gt;=1000 -F
      auid!=unset -F key=access
    - -a always,exit -F arch=b64 -S fremovexattr -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
      -F key=access
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - audit_arch is defined and audit_arch == 'b64'
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_fremovexattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_unsuccessful_file_modification_fremovexattr:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-audit_rules_unsuccessful_file_modification_fremovexattr_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_fchown" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record Unsuccessul Ownership Changes to Files - fchown</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The audit system should collect unsuccessful file ownership change
attempts for all users and root.
If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured
to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following lines to a file with suffix
<html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>.
If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> file.
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S fchown -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-perm-change
-a always,exit -F arch=b32 -S fchown -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-perm-change</html:pre>
If the system is 64 bit then also add the following lines:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b64 -S fchown -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-perm-change
-a always,exit -F arch=b64 -S fchown -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-perm-change</html:pre></description>
            <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the audit rule checks a
system call independently of other system calls. Grouping system calls related
to the same event is more efficient. See the following example:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S lchown,fchown,chown,fchownat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-perm-change</html:pre></warning>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="">SRG-OS-000458-VMM-001810</reference>
            <reference href="">SRG-OS-000461-VMM-001830</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Unsuccessful attempts to change ownership of files could be an indicator of malicious activity on a system. Auditing
these events could serve as evidence of potential system compromise.</rationale>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_unsuccessful_file_modification_fchown" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then



# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	PATTERN="-a always,exit -F arch=$ARCH -S fchown -F exit=-EACCES.*"
	GROUP="access"
	FULL_RULE="-a always,exit -F arch=$ARCH -S fchown -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=access"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_fix_audit_syscall_rule" use="legacy"/>
	fix_audit_syscall_rule "auditctl" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
	fix_audit_syscall_rule "augenrules" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
done

for ARCH in "${RULE_ARCHS[@]}"
do
        PATTERN="-a always,exit -F arch=$ARCH -S fchown -F exit=-EPERM.*"
        GROUP="access"
        FULL_RULE="-a always,exit -F arch=$ARCH -S fchown -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=access"
        # Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_fix_audit_syscall_rule" use="legacy"/>
        fix_audit_syscall_rule "auditctl" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
        fix_audit_syscall_rule "augenrules" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_unsuccessful_file_modification_fchown" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="low" strategy="restrict">- name: Set architecture for audit fchown tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_fchown
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Search /etc/audit/rules.d for other DAC audit rules
  find:
    paths: /etc/audit/rules.d
    recurse: false
    contains: -F key=perm_mod$
    patterns: '*.rules'
  register: find_fchown
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_fchown
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: If existing DAC ruleset not found, use /etc/audit/rules.d/access.rules as
    the recipient for the rule
  set_fact:
    all_files:
      - /etc/audit/rules.d/access.rules
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_fchown.matched is defined and find_fchown.matched == 0
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_fchown
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
      - '{{ find_fchown.files | map(attribute=''path'') | list | first }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_fchown.matched is defined and find_fchown.matched &gt; 0
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_fchown
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the fchown rule in rules.d when on x86
  lineinfile:
    path: '{{ all_files[0] }}'
    line: '{{ item }}'
    create: true
  with_items:
    - -a always,exit -F arch=b32 -S fchown -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset
      -F key=access
    - -a always,exit -F arch=b32 -S fchown -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
      -F key=access
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_fchown
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the fchown rule in rules.d when on x86_64
  lineinfile:
    path: '{{ all_files[0] }}'
    line: '{{ item }}'
    create: true
  with_items:
    - -a always,exit -F arch=b64 -S fchown -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset
      -F key=access
    - -a always,exit -F arch=b64 -S fchown -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
      -F key=access
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - audit_arch is defined and audit_arch == 'b64'
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_fchown
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the fchown rule in /etc/audit/audit.rules when on x86
  lineinfile:
    line: '{{ item }}'
    state: present
    dest: /etc/audit/audit.rules
    create: true
  with_items:
    - -a always,exit -F arch=b32 -S fchown -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset
      -F key=access
    - -a always,exit -F arch=b32 -S fchown -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
      -F key=access
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_fchown
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the fchown rule in audit.rules when on x86_64
  lineinfile:
    line: '{{ item }}'
    state: present
    dest: /etc/audit/audit.rules
    create: true
  with_items:
    - -a always,exit -F arch=b64 -S fchown -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset
      -F key=access
    - -a always,exit -F arch=b64 -S fchown -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
      -F key=access
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - audit_arch is defined and audit_arch == 'b64'
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_fchown
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_unsuccessful_file_modification_fchown:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-audit_rules_unsuccessful_file_modification_fchown_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_order" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure auditd Unauthorized Access Attempts To open_by_handle_at Are Ordered Correctly</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The audit system should collect detailed unauthorized file
accesses for all users and root.
To correctly identify unsuccessful creation, unsuccessful modification and unsuccessful access
of files via <html:code xmlns:html="http://www.w3.org/1999/xhtml">open_by_handle_at</html:code> syscall the audit rules collecting these events need to be in certain order.
The more specific rules need to come before the less specific rules. The reason for that is that more
specific rules cover a subset of events covered in the less specific rules, thus, they need to come
before to not be overshadowed by less specific rules, which match a bigger set of events.
Make sure that rules for unsuccessful calls of <html:code xmlns:html="http://www.w3.org/1999/xhtml">open_by_handle_at</html:code> syscall are in the order shown below.
If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code>
program to read audit rules during daemon startup (the default), check the order of
rules below in a file with suffix <html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the directory
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>.
If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, check the order of rules below in
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> file.
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">
-a always,exit -F arch=b32 -S open_by_handle_at -F a2&amp;0100 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
-a always,exit -F arch=b32 -S open_by_handle_at -F a2&amp;0100 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
-a always,exit -F arch=b32 -S open_by_handle_at -F a2&amp;01003 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
-a always,exit -F arch=b32 -S open_by_handle_at -F a2&amp;01003 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
-a always,exit -F arch=b32 -S open_by_handle_at -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-access
-a always,exit -F arch=b32 -S open_by_handle_at -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-access
</html:pre>
If the system is 64 bit then also add the following lines:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">
-a always,exit -F arch=b64 -S open_by_handle_at -F a2&amp;0100 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
-a always,exit -F arch=b64 -S open_by_handle_at -F a2&amp;0100 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
-a always,exit -F arch=b64 -S open_by_handle_at -F a2&amp;01003 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
-a always,exit -F arch=b64 -S open_by_handle_at -F a2&amp;01003 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
-a always,exit -F arch=b64 -S open_by_handle_at -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-access
-a always,exit -F arch=b64 -S open_by_handle_at -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-access
</html:pre></description>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</reference>
            <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</reference>
            <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.2.4</reference>
            <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.2.1</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000064-GPOS-00033</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000458-GPOS-00203</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000461-GPOS-00205</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</reference>
            <reference href="">SRG-OS-000458-VMM-001810</reference>
            <reference href="">SRG-OS-000461-VMM-001830</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.2.6.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO12.06</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI08.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS02.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS02.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS02.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.2.6</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.7.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.7</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.15.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.15.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.5</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.7</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.2.2</reference>
            <reference href="https://www.cisecurity.org/controls/">1</reference>
            <reference href="https://www.cisecurity.org/controls/">11</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">13</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">19</reference>
            <reference href="https://www.cisecurity.org/controls/">2</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">4</reference>
            <reference href="https://www.cisecurity.org/controls/">5</reference>
            <reference href="https://www.cisecurity.org/controls/">6</reference>
            <reference href="https://www.cisecurity.org/controls/">7</reference>
            <reference href="https://www.cisecurity.org/controls/">8</reference>
            <reference href="https://www.cisecurity.org/controls/">9</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The more specific rules cover a subset of events covered by the less specific rules.
By ordering them from more specific to less specific, it is assured that the less specific
rule will not catch events better recorded by the more specific rule.</rationale>
            <platform idref="cpe:/a:machine"/>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_order:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_order_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_open_by_handle_at" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record Unsuccessful Access Attempts to Files - open_by_handle_at</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">At a minimum, the audit system should collect unauthorized file
accesses for all users and root. If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured
to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following lines to a file with suffix
<html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S open_by_handle_at -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b32 -S open_by_handle_at -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=access</html:pre>
If the system is 64 bit then also add the following lines:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">
-a always,exit -F arch=b64 -S open_by_handle_at -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b64 -S open_by_handle_at -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=access</html:pre>
If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> file:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S open_by_handle_at,truncate,ftruncate -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b32 -S open_by_handle_at,truncate,ftruncate -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=access</html:pre>
If the system is 64 bit then also add the following lines:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">
-a always,exit -F arch=b64 -S open_by_handle_at,truncate,ftruncate -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b64 -S open_by_handle_at,truncate,ftruncate -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=access</html:pre></description>
            <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.</warning>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</reference>
            <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</reference>
            <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.2.4</reference>
            <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.2.1</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000064-GPOS-00033</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000458-GPOS-00203</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000461-GPOS-00205</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</reference>
            <reference href="">SRG-OS-000458-VMM-001810</reference>
            <reference href="">SRG-OS-000461-VMM-001830</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.2.6.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO12.06</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI08.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS02.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS02.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS02.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.2.6</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.7.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.7</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.15.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.15.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.5</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.7</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.2.2</reference>
            <reference href="https://www.cisecurity.org/controls/">1</reference>
            <reference href="https://www.cisecurity.org/controls/">11</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">13</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">19</reference>
            <reference href="https://www.cisecurity.org/controls/">2</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">4</reference>
            <reference href="https://www.cisecurity.org/controls/">5</reference>
            <reference href="https://www.cisecurity.org/controls/">6</reference>
            <reference href="https://www.cisecurity.org/controls/">7</reference>
            <reference href="https://www.cisecurity.org/controls/">8</reference>
            <reference href="https://www.cisecurity.org/controls/">9</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Unsuccessful attempts to access files could be an indicator of malicious activity on a system. Auditing
these events could serve as evidence of potential system compromise.</rationale>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_unsuccessful_file_modification_open_by_handle_at" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="low" strategy="restrict">- name: Set architecture for audit open_by_handle_at tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_open_by_handle_at
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Search /etc/audit/rules.d for other DAC audit rules
  find:
    paths: /etc/audit/rules.d
    recurse: false
    contains: -F key=perm_mod$
    patterns: '*.rules'
  register: find_open_by_handle_at
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_open_by_handle_at
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: If existing DAC ruleset not found, use /etc/audit/rules.d/access.rules as
    the recipient for the rule
  set_fact:
    all_files:
      - /etc/audit/rules.d/access.rules
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_open_by_handle_at.matched is defined and find_open_by_handle_at.matched
      == 0
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_open_by_handle_at
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
      - '{{ find_open_by_handle_at.files | map(attribute=''path'') | list | first
        }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_open_by_handle_at.matched is defined and find_open_by_handle_at.matched
      &gt; 0
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_open_by_handle_at
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the open_by_handle_at rule in rules.d when on x86
  lineinfile:
    path: '{{ all_files[0] }}'
    line: '{{ item }}'
    create: true
  with_items:
    - -a always,exit -F arch=b32 -S open_by_handle_at -F exit=-EACCES -F auid&gt;=1000
      -F auid!=unset -F key=access
    - -a always,exit -F arch=b32 -S open_by_handle_at -F exit=-EPERM -F auid&gt;=1000
      -F auid!=unset -F key=access
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_open_by_handle_at
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the open_by_handle_at rule in rules.d when on x86_64
  lineinfile:
    path: '{{ all_files[0] }}'
    line: '{{ item }}'
    create: true
  with_items:
    - -a always,exit -F arch=b64 -S open_by_handle_at -F exit=-EACCES -F auid&gt;=1000
      -F auid!=unset -F key=access
    - -a always,exit -F arch=b64 -S open_by_handle_at -F exit=-EPERM -F auid&gt;=1000
      -F auid!=unset -F key=access
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - audit_arch is defined and audit_arch == 'b64'
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_open_by_handle_at
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the open_by_handle_at rule in /etc/audit/audit.rules when
    on x86
  lineinfile:
    line: '{{ item }}'
    state: present
    dest: /etc/audit/audit.rules
    create: true
  with_items:
    - -a always,exit -F arch=b32 -S open_by_handle_at -F exit=-EACCES -F auid&gt;=1000
      -F auid!=unset -F key=access
    - -a always,exit -F arch=b32 -S open_by_handle_at -F exit=-EPERM -F auid&gt;=1000
      -F auid!=unset -F key=access
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_open_by_handle_at
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the open_by_handle_at rule in audit.rules when on x86_64
  lineinfile:
    line: '{{ item }}'
    state: present
    dest: /etc/audit/audit.rules
    create: true
  with_items:
    - -a always,exit -F arch=b64 -S open_by_handle_at -F exit=-EACCES -F auid&gt;=1000
      -F auid!=unset -F key=access
    - -a always,exit -F arch=b64 -S open_by_handle_at -F exit=-EPERM -F auid&gt;=1000
      -F auid!=unset -F key=access
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - audit_arch is defined and audit_arch == 'b64'
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_open_by_handle_at
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_unsuccessful_file_modification_open_by_handle_at:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-audit_rules_unsuccessful_file_modification_open_by_handle_at_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_lremovexattr" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record Unsuccessul Permission Changes to Files - lremovexattr</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The audit system should collect unsuccessful file permission change
attempts for all users and root.
If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured
to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following lines to a file with suffix
<html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>.
If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> file.
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S lremovexattr -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-perm-change
-a always,exit -F arch=b32 -S lremovexattr -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-perm-change</html:pre>
If the system is 64 bit then also add the following lines:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b64 -S lremovexattr -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-perm-change
-a always,exit -F arch=b64 -S lremovexattr -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-perm-change</html:pre></description>
            <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the audit rule checks a
system call independently of other system calls. Grouping system calls related
to the same event is more efficient. See the following example:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S chmod,fchmod,fchmodat,setxattr,lsetxattr,fsetxattr -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-perm-change</html:pre></warning>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="">SRG-OS-000458-VMM-001810</reference>
            <reference href="">SRG-OS-000461-VMM-001830</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Unsuccessful attempts to change permissions of files could be an indicator of malicious activity on a system. Auditing
these events could serve as evidence of potential system compromise.</rationale>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_unsuccessful_file_modification_lremovexattr" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then



# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	PATTERN="-a always,exit -F arch=$ARCH -S lremovexattr -F exit=-EACCES.*"
	GROUP="access"
	FULL_RULE="-a always,exit -F arch=$ARCH -S lremovexattr -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=access"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_fix_audit_syscall_rule" use="legacy"/>
	fix_audit_syscall_rule "auditctl" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
	fix_audit_syscall_rule "augenrules" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
done

for ARCH in "${RULE_ARCHS[@]}"
do
        PATTERN="-a always,exit -F arch=$ARCH -S lremovexattr -F exit=-EPERM.*"
        GROUP="access"
        FULL_RULE="-a always,exit -F arch=$ARCH -S lremovexattr -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=access"
        # Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_fix_audit_syscall_rule" use="legacy"/>
        fix_audit_syscall_rule "auditctl" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
        fix_audit_syscall_rule "augenrules" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_unsuccessful_file_modification_lremovexattr" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="low" strategy="restrict">- name: Set architecture for audit lremovexattr tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_lremovexattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Search /etc/audit/rules.d for other DAC audit rules
  find:
    paths: /etc/audit/rules.d
    recurse: false
    contains: -F key=perm_mod$
    patterns: '*.rules'
  register: find_lremovexattr
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_lremovexattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: If existing DAC ruleset not found, use /etc/audit/rules.d/access.rules as
    the recipient for the rule
  set_fact:
    all_files:
      - /etc/audit/rules.d/access.rules
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_lremovexattr.matched is defined and find_lremovexattr.matched == 0
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_lremovexattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
      - '{{ find_lremovexattr.files | map(attribute=''path'') | list | first }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_lremovexattr.matched is defined and find_lremovexattr.matched &gt; 0
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_lremovexattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the lremovexattr rule in rules.d when on x86
  lineinfile:
    path: '{{ all_files[0] }}'
    line: '{{ item }}'
    create: true
  with_items:
    - -a always,exit -F arch=b32 -S lremovexattr -F exit=-EACCES -F auid&gt;=1000 -F
      auid!=unset -F key=access
    - -a always,exit -F arch=b32 -S lremovexattr -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
      -F key=access
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_lremovexattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the lremovexattr rule in rules.d when on x86_64
  lineinfile:
    path: '{{ all_files[0] }}'
    line: '{{ item }}'
    create: true
  with_items:
    - -a always,exit -F arch=b64 -S lremovexattr -F exit=-EACCES -F auid&gt;=1000 -F
      auid!=unset -F key=access
    - -a always,exit -F arch=b64 -S lremovexattr -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
      -F key=access
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - audit_arch is defined and audit_arch == 'b64'
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_lremovexattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the lremovexattr rule in /etc/audit/audit.rules when on x86
  lineinfile:
    line: '{{ item }}'
    state: present
    dest: /etc/audit/audit.rules
    create: true
  with_items:
    - -a always,exit -F arch=b32 -S lremovexattr -F exit=-EACCES -F auid&gt;=1000 -F
      auid!=unset -F key=access
    - -a always,exit -F arch=b32 -S lremovexattr -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
      -F key=access
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_lremovexattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the lremovexattr rule in audit.rules when on x86_64
  lineinfile:
    line: '{{ item }}'
    state: present
    dest: /etc/audit/audit.rules
    create: true
  with_items:
    - -a always,exit -F arch=b64 -S lremovexattr -F exit=-EACCES -F auid&gt;=1000 -F
      auid!=unset -F key=access
    - -a always,exit -F arch=b64 -S lremovexattr -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
      -F key=access
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - audit_arch is defined and audit_arch == 'b64'
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_lremovexattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_unsuccessful_file_modification_lremovexattr:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-audit_rules_unsuccessful_file_modification_lremovexattr_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_successful_file_modification_chmod" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record Successful Permission Changes to Files - chmod</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">At a minimum, the audit system should collect file permission changes
for all users and root. If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured
to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following lines to a file with suffix
<html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>:

<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S chmod -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-perm-change</html:pre>

If the system is 64 bit then also add the following lines:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b64 -S chmod -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-perm-change</html:pre>

If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> file:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S chmod -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-perm-change</html:pre>

If the system is 64 bit then also add the following lines:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b64 -S chmod -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-perm-change</html:pre></description>
            <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.</warning>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">File permission changes could be an indicator of malicious activity on a system. Auditing
these events could serve as evidence of potential system compromise.</rationale>
            <platform idref="cpe:/a:machine"/>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-audit_rules_successful_file_modification_chmod_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_successful_file_modification_removexattr" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record Successful Permission Changes to Files - removexattr</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">At a minimum, the audit system should collect file permission changes
for all users and root. If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured
to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following lines to a file with suffix
<html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>:

<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S removexattr -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-perm-change</html:pre>

If the system is 64 bit then also add the following lines:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b64 -S removexattr -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-perm-change</html:pre>

If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> file:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S removexattr -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-perm-change</html:pre>

If the system is 64 bit then also add the following lines:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b64 -S removexattr -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-perm-change</html:pre></description>
            <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.</warning>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">File permission changes could be an indicator of malicious activity on a system. Auditing
these events could serve as evidence of potential system compromise.</rationale>
            <platform idref="cpe:/a:machine"/>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-audit_rules_successful_file_modification_removexattr_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_fsetxattr" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record Unsuccessul Permission Changes to Files - fsetxattr</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The audit system should collect unsuccessful file permission change
attempts for all users and root.
If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured
to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following lines to a file with suffix
<html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>.
If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> file.
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S fsetxattr -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-perm-change
-a always,exit -F arch=b32 -S fsetxattr -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-perm-change</html:pre>
If the system is 64 bit then also add the following lines:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b64 -S fsetxattr -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-perm-change
-a always,exit -F arch=b64 -S fsetxattr -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-perm-change</html:pre></description>
            <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the audit rule checks a
system call independently of other system calls. Grouping system calls related
to the same event is more efficient. See the following example:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S chmod,fchmod,fchmodat,setxattr,lsetxattr,fsetxattr -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-perm-change</html:pre></warning>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="">SRG-OS-000458-VMM-001810</reference>
            <reference href="">SRG-OS-000461-VMM-001830</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Unsuccessful attempts to change permissions of files could be an indicator of malicious activity on a system. Auditing
these events could serve as evidence of potential system compromise.</rationale>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_unsuccessful_file_modification_fsetxattr" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then



# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	PATTERN="-a always,exit -F arch=$ARCH -S fsetxattr -F exit=-EACCES.*"
	GROUP="access"
	FULL_RULE="-a always,exit -F arch=$ARCH -S fsetxattr -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=access"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_fix_audit_syscall_rule" use="legacy"/>
	fix_audit_syscall_rule "auditctl" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
	fix_audit_syscall_rule "augenrules" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
done

for ARCH in "${RULE_ARCHS[@]}"
do
        PATTERN="-a always,exit -F arch=$ARCH -S fsetxattr -F exit=-EPERM.*"
        GROUP="access"
        FULL_RULE="-a always,exit -F arch=$ARCH -S fsetxattr -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=access"
        # Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_fix_audit_syscall_rule" use="legacy"/>
        fix_audit_syscall_rule "auditctl" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
        fix_audit_syscall_rule "augenrules" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_unsuccessful_file_modification_fsetxattr" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="low" strategy="restrict">- name: Set architecture for audit fsetxattr tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_fsetxattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Search /etc/audit/rules.d for other DAC audit rules
  find:
    paths: /etc/audit/rules.d
    recurse: false
    contains: -F key=perm_mod$
    patterns: '*.rules'
  register: find_fsetxattr
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_fsetxattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: If existing DAC ruleset not found, use /etc/audit/rules.d/access.rules as
    the recipient for the rule
  set_fact:
    all_files:
      - /etc/audit/rules.d/access.rules
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_fsetxattr.matched is defined and find_fsetxattr.matched == 0
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_fsetxattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
      - '{{ find_fsetxattr.files | map(attribute=''path'') | list | first }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_fsetxattr.matched is defined and find_fsetxattr.matched &gt; 0
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_fsetxattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the fsetxattr rule in rules.d when on x86
  lineinfile:
    path: '{{ all_files[0] }}'
    line: '{{ item }}'
    create: true
  with_items:
    - -a always,exit -F arch=b32 -S fsetxattr -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset
      -F key=access
    - -a always,exit -F arch=b32 -S fsetxattr -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
      -F key=access
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_fsetxattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the fsetxattr rule in rules.d when on x86_64
  lineinfile:
    path: '{{ all_files[0] }}'
    line: '{{ item }}'
    create: true
  with_items:
    - -a always,exit -F arch=b64 -S fsetxattr -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset
      -F key=access
    - -a always,exit -F arch=b64 -S fsetxattr -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
      -F key=access
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - audit_arch is defined and audit_arch == 'b64'
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_fsetxattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the fsetxattr rule in /etc/audit/audit.rules when on x86
  lineinfile:
    line: '{{ item }}'
    state: present
    dest: /etc/audit/audit.rules
    create: true
  with_items:
    - -a always,exit -F arch=b32 -S fsetxattr -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset
      -F key=access
    - -a always,exit -F arch=b32 -S fsetxattr -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
      -F key=access
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_fsetxattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the fsetxattr rule in audit.rules when on x86_64
  lineinfile:
    line: '{{ item }}'
    state: present
    dest: /etc/audit/audit.rules
    create: true
  with_items:
    - -a always,exit -F arch=b64 -S fsetxattr -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset
      -F key=access
    - -a always,exit -F arch=b64 -S fsetxattr -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
      -F key=access
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - audit_arch is defined and audit_arch == 'b64'
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_fsetxattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_unsuccessful_file_modification_fsetxattr:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-audit_rules_unsuccessful_file_modification_fsetxattr_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_creat" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record Unsuccessful Access Attempts to Files - creat</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">At a minimum, the audit system should collect unauthorized file
accesses for all users and root. If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured
to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following lines to a file with suffix
<html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S creat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b32 -S creat -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=access</html:pre>
If the system is 64 bit then also add the following lines:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">
-a always,exit -F arch=b64 -S creat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b64 -S creat -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=access</html:pre>
If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> file:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S creat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b32 -S creat -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=access</html:pre>
If the system is 64 bit then also add the following lines:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">
-a always,exit -F arch=b64 -S creat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b64 -S creat -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=access</html:pre></description>
            <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.</warning>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</reference>
            <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</reference>
            <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.2.4</reference>
            <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.2.1</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000064-GPOS-00033</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000458-GPOS-00203</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000461-GPOS-00205</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</reference>
            <reference href="">SRG-OS-000458-VMM-001810</reference>
            <reference href="">SRG-OS-000461-VMM-001830</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.2.6.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO12.06</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI08.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS02.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS02.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS02.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.2.6</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.7.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.7</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.15.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.15.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.5</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.7</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.2.2</reference>
            <reference href="https://www.cisecurity.org/controls/">1</reference>
            <reference href="https://www.cisecurity.org/controls/">11</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">13</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">19</reference>
            <reference href="https://www.cisecurity.org/controls/">2</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">4</reference>
            <reference href="https://www.cisecurity.org/controls/">5</reference>
            <reference href="https://www.cisecurity.org/controls/">6</reference>
            <reference href="https://www.cisecurity.org/controls/">7</reference>
            <reference href="https://www.cisecurity.org/controls/">8</reference>
            <reference href="https://www.cisecurity.org/controls/">9</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Unsuccessful attempts to access files could be an indicator of malicious activity on a system. Auditing
these events could serve as evidence of potential system compromise.</rationale>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_unsuccessful_file_modification_creat" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then



# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	PATTERN="-a always,exit -F arch=$ARCH -S creat -F exit=-EACCES.*"
	GROUP="access"
	FULL_RULE="-a always,exit -F arch=$ARCH -S creat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=access"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_fix_audit_syscall_rule" use="legacy"/>
	fix_audit_syscall_rule "auditctl" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
	fix_audit_syscall_rule "augenrules" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
done

for ARCH in "${RULE_ARCHS[@]}"
do
        PATTERN="-a always,exit -F arch=$ARCH -S creat -F exit=-EPERM.*"
        GROUP="access"
        FULL_RULE="-a always,exit -F arch=$ARCH -S creat -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=access"
        # Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_fix_audit_syscall_rule" use="legacy"/>
        fix_audit_syscall_rule "auditctl" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
        fix_audit_syscall_rule "augenrules" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_unsuccessful_file_modification_creat" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="low" strategy="restrict">- name: Set architecture for audit creat tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_creat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Search /etc/audit/rules.d for other DAC audit rules
  find:
    paths: /etc/audit/rules.d
    recurse: false
    contains: -F key=perm_mod$
    patterns: '*.rules'
  register: find_creat
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_creat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: If existing DAC ruleset not found, use /etc/audit/rules.d/access.rules as
    the recipient for the rule
  set_fact:
    all_files:
      - /etc/audit/rules.d/access.rules
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_creat.matched is defined and find_creat.matched == 0
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_creat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
      - '{{ find_creat.files | map(attribute=''path'') | list | first }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_creat.matched is defined and find_creat.matched &gt; 0
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_creat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the creat rule in rules.d when on x86
  lineinfile:
    path: '{{ all_files[0] }}'
    line: '{{ item }}'
    create: true
  with_items:
    - -a always,exit -F arch=b32 -S creat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset
      -F key=access
    - -a always,exit -F arch=b32 -S creat -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
      -F key=access
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_creat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the creat rule in rules.d when on x86_64
  lineinfile:
    path: '{{ all_files[0] }}'
    line: '{{ item }}'
    create: true
  with_items:
    - -a always,exit -F arch=b64 -S creat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset
      -F key=access
    - -a always,exit -F arch=b64 -S creat -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
      -F key=access
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - audit_arch is defined and audit_arch == 'b64'
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_creat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the creat rule in /etc/audit/audit.rules when on x86
  lineinfile:
    line: '{{ item }}'
    state: present
    dest: /etc/audit/audit.rules
    create: true
  with_items:
    - -a always,exit -F arch=b32 -S creat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset
      -F key=access
    - -a always,exit -F arch=b32 -S creat -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
      -F key=access
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_creat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the creat rule in audit.rules when on x86_64
  lineinfile:
    line: '{{ item }}'
    state: present
    dest: /etc/audit/audit.rules
    create: true
  with_items:
    - -a always,exit -F arch=b64 -S creat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset
      -F key=access
    - -a always,exit -F arch=b64 -S creat -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
      -F key=access
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - audit_arch is defined and audit_arch == 'b64'
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_creat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_unsuccessful_file_modification_creat:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-audit_rules_unsuccessful_file_modification_creat_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_successful_file_modification_fchown" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record Successful Ownership Changes to Files - fchown</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">At a minimum, the audit system should collect file ownership changes
for all users and root. If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured
to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following lines to a file with suffix
<html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>:

<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S fchown -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-perm-change</html:pre>

If the system is 64 bit then also add the following lines:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b64 -S fchown -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-perm-change</html:pre>

If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> file:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S fchown -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-perm-change</html:pre>

If the system is 64 bit then also add the following lines:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b64 -S fchown -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-perm-change</html:pre></description>
            <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.</warning>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">File ownership attempts could be an indicator of malicious activity on a system. Auditing
these events could serve as evidence of potential system compromise.</rationale>
            <platform idref="cpe:/a:machine"/>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-audit_rules_successful_file_modification_fchown_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_fchmodat" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record Unsuccessul Permission Changes to Files - fchmodat</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The audit system should collect unsuccessful file permission change
attempts for all users and root.
If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured
to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following lines to a file with suffix
<html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>.
If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> file.
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S fchmodat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-perm-change
-a always,exit -F arch=b32 -S fchmodat -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-perm-change</html:pre>
If the system is 64 bit then also add the following lines:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b64 -S fchmodat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-perm-change
-a always,exit -F arch=b64 -S fchmodat -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-perm-change</html:pre></description>
            <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the audit rule checks a
system call independently of other system calls. Grouping system calls related
to the same event is more efficient. See the following example:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S chmod,fchmod,fchmodat,setxattr,lsetxattr,fsetxattr -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-perm-change</html:pre></warning>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="">SRG-OS-000458-VMM-001810</reference>
            <reference href="">SRG-OS-000461-VMM-001830</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Unsuccessful attempts to change permissions of files could be an indicator of malicious activity on a system. Auditing
these events could serve as evidence of potential system compromise.</rationale>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_unsuccessful_file_modification_fchmodat" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then



# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	PATTERN="-a always,exit -F arch=$ARCH -S fchmodat -F exit=-EACCES.*"
	GROUP="access"
	FULL_RULE="-a always,exit -F arch=$ARCH -S fchmodat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=access"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_fix_audit_syscall_rule" use="legacy"/>
	fix_audit_syscall_rule "auditctl" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
	fix_audit_syscall_rule "augenrules" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
done

for ARCH in "${RULE_ARCHS[@]}"
do
        PATTERN="-a always,exit -F arch=$ARCH -S fchmodat -F exit=-EPERM.*"
        GROUP="access"
        FULL_RULE="-a always,exit -F arch=$ARCH -S fchmodat -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=access"
        # Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_fix_audit_syscall_rule" use="legacy"/>
        fix_audit_syscall_rule "auditctl" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
        fix_audit_syscall_rule "augenrules" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_unsuccessful_file_modification_fchmodat" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="low" strategy="restrict">- name: Set architecture for audit fchmodat tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_fchmodat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Search /etc/audit/rules.d for other DAC audit rules
  find:
    paths: /etc/audit/rules.d
    recurse: false
    contains: -F key=perm_mod$
    patterns: '*.rules'
  register: find_fchmodat
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_fchmodat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: If existing DAC ruleset not found, use /etc/audit/rules.d/access.rules as
    the recipient for the rule
  set_fact:
    all_files:
      - /etc/audit/rules.d/access.rules
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_fchmodat.matched is defined and find_fchmodat.matched == 0
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_fchmodat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
      - '{{ find_fchmodat.files | map(attribute=''path'') | list | first }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_fchmodat.matched is defined and find_fchmodat.matched &gt; 0
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_fchmodat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the fchmodat rule in rules.d when on x86
  lineinfile:
    path: '{{ all_files[0] }}'
    line: '{{ item }}'
    create: true
  with_items:
    - -a always,exit -F arch=b32 -S fchmodat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset
      -F key=access
    - -a always,exit -F arch=b32 -S fchmodat -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
      -F key=access
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_fchmodat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the fchmodat rule in rules.d when on x86_64
  lineinfile:
    path: '{{ all_files[0] }}'
    line: '{{ item }}'
    create: true
  with_items:
    - -a always,exit -F arch=b64 -S fchmodat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset
      -F key=access
    - -a always,exit -F arch=b64 -S fchmodat -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
      -F key=access
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - audit_arch is defined and audit_arch == 'b64'
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_fchmodat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the fchmodat rule in /etc/audit/audit.rules when on x86
  lineinfile:
    line: '{{ item }}'
    state: present
    dest: /etc/audit/audit.rules
    create: true
  with_items:
    - -a always,exit -F arch=b32 -S fchmodat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset
      -F key=access
    - -a always,exit -F arch=b32 -S fchmodat -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
      -F key=access
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_fchmodat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the fchmodat rule in audit.rules when on x86_64
  lineinfile:
    line: '{{ item }}'
    state: present
    dest: /etc/audit/audit.rules
    create: true
  with_items:
    - -a always,exit -F arch=b64 -S fchmodat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset
      -F key=access
    - -a always,exit -F arch=b64 -S fchmodat -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
      -F key=access
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - audit_arch is defined and audit_arch == 'b64'
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_fchmodat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_unsuccessful_file_modification_fchmodat:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-audit_rules_unsuccessful_file_modification_fchmodat_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">At a minimum the audit system should collect unauthorized file
accesses for all users and root. If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured
to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following lines to a file with suffix
<html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S creat,open,openat,open_by_handle_at,truncate,ftruncate -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b32 -S creat,open,openat,open_by_handle_at,truncate,ftruncate -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=access</html:pre>
If the system is 64 bit then also add the following lines:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">
-a always,exit -F arch=b64 -S creat,open,openat,open_by_handle_at,truncate,ftruncate -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b64 -S creat,open,openat,open_by_handle_at,truncate,ftruncate -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=access</html:pre>
If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> file:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S creat,open,openat,open_by_handle_at,truncate,ftruncate -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b32 -S creat,open,openat,open_by_handle_at,truncate,ftruncate -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=access</html:pre>
If the system is 64 bit then also add the following lines:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">
-a always,exit -F arch=b64 -S creat,open,openat,open_by_handle_at,truncate,ftruncate -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b64 -S creat,open,openat,open_by_handle_at,truncate,ftruncate -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=access</html:pre></description>
            <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">This rule checks for multiple syscalls related to unsuccessful file modification;
it was written with DISA STIG in mind. Other policies should use a
separate rule for each syscall that needs to be checked. For example:
<html:ul xmlns:html="http://www.w3.org/1999/xhtml"><html:li><html:code>audit_rules_unsuccessful_file_modification_open</html:code></html:li><html:li><html:code>audit_rules_unsuccessful_file_modification_ftruncate</html:code></html:li><html:li><html:code>audit_rules_unsuccessful_file_modification_creat</html:code></html:li></html:ul></warning>
            <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</reference>
            <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.2.4</reference>
            <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.2.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.2.6.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO12.06</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI08.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS02.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS02.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS02.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.2.6</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.7.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.7</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.15.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.15.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.5</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.7</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.2.2</reference>
            <reference href="https://www.cisecurity.org/controls/">1</reference>
            <reference href="https://www.cisecurity.org/controls/">11</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">13</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">19</reference>
            <reference href="https://www.cisecurity.org/controls/">2</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">4</reference>
            <reference href="https://www.cisecurity.org/controls/">5</reference>
            <reference href="https://www.cisecurity.org/controls/">6</reference>
            <reference href="https://www.cisecurity.org/controls/">7</reference>
            <reference href="https://www.cisecurity.org/controls/">8</reference>
            <reference href="https://www.cisecurity.org/controls/">9</reference>
            <reference href="">0582</reference>
            <reference href="">0584</reference>
            <reference href="">05885</reference>
            <reference href="">0586</reference>
            <reference href="">0846</reference>
            <reference href="">0957</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Unsuccessful attempts to access files could be an indicator of malicious activity on a system. Auditing
these events could serve as evidence of potential system compromise.</rationale>
            <platform idref="cpe:/a:machine"/>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_unsuccessful_file_modification:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-audit_rules_unsuccessful_file_modification_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_successful_file_modification_lremovexattr" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record Successful Permission Changes to Files - lremovexattr</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">At a minimum, the audit system should collect file permission changes
for all users and root. If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured
to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following lines to a file with suffix
<html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>:

<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S lremovexattr -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-perm-change</html:pre>

If the system is 64 bit then also add the following lines:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b64 -S lremovexattr -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-perm-change</html:pre>

If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> file:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S lremovexattr -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-perm-change</html:pre>

If the system is 64 bit then also add the following lines:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b64 -S lremovexattr -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-perm-change</html:pre></description>
            <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.</warning>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">File permission changes could be an indicator of malicious activity on a system. Auditing
these events could serve as evidence of potential system compromise.</rationale>
            <platform idref="cpe:/a:machine"/>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-audit_rules_successful_file_modification_lremovexattr_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_rename" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record Unsuccessul Delete Attempts to Files - rename</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The audit system should collect unsuccessful file deletion
attempts for all users and root. If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured
to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following lines to a file with suffix
<html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>.
If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> file.
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S rename -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-delete
-a always,exit -F arch=b32 -S rename -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-delete</html:pre>
If the system is 64 bit then also add the following lines:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">
-a always,exit -F arch=b64 -S rename -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-delete
-a always,exit -F arch=b64 -S rename -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-delete</html:pre></description>
            <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping system calls related
to the same event is more efficient. See the following example:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S unlink,unlinkat,rename,renameat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-delete</html:pre></warning>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</reference>
            <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</reference>
            <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.2.4</reference>
            <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.2.1</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000064-GPOS-00033</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000458-GPOS-00203</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000461-GPOS-00205</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000468-GPOS-00212</reference>
            <reference href="">SRG-OS-000458-VMM-001810</reference>
            <reference href="">SRG-OS-000461-VMM-001830</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.2.6.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO12.06</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI08.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS02.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS02.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS02.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.2.6</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.7.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.7</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.15.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.15.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.5</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.7</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.2.2</reference>
            <reference href="https://www.cisecurity.org/controls/">1</reference>
            <reference href="https://www.cisecurity.org/controls/">11</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">13</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">19</reference>
            <reference href="https://www.cisecurity.org/controls/">2</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">4</reference>
            <reference href="https://www.cisecurity.org/controls/">5</reference>
            <reference href="https://www.cisecurity.org/controls/">6</reference>
            <reference href="https://www.cisecurity.org/controls/">7</reference>
            <reference href="https://www.cisecurity.org/controls/">8</reference>
            <reference href="https://www.cisecurity.org/controls/">9</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Unsuccessful attempts to delete files could be an indicator of malicious activity on a system. Auditing
these events could serve as evidence of potential system compromise.</rationale>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_unsuccessful_file_modification_rename" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then



# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	PATTERN="-a always,exit -F arch=$ARCH -S rename -F exit=-EACCES.*"
	GROUP="access"
	FULL_RULE="-a always,exit -F arch=$ARCH -S rename -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=access"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_fix_audit_syscall_rule" use="legacy"/>
	fix_audit_syscall_rule "auditctl" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
	fix_audit_syscall_rule "augenrules" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
done

for ARCH in "${RULE_ARCHS[@]}"
do
        PATTERN="-a always,exit -F arch=$ARCH -S rename -F exit=-EPERM.*"
        GROUP="access"
        FULL_RULE="-a always,exit -F arch=$ARCH -S rename -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=access"
        # Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_fix_audit_syscall_rule" use="legacy"/>
        fix_audit_syscall_rule "auditctl" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
        fix_audit_syscall_rule "augenrules" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_unsuccessful_file_modification_rename" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="low" strategy="restrict">- name: Set architecture for audit rename tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_rename
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Search /etc/audit/rules.d for other DAC audit rules
  find:
    paths: /etc/audit/rules.d
    recurse: false
    contains: -F key=perm_mod$
    patterns: '*.rules'
  register: find_rename
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_rename
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: If existing DAC ruleset not found, use /etc/audit/rules.d/access.rules as
    the recipient for the rule
  set_fact:
    all_files:
      - /etc/audit/rules.d/access.rules
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_rename.matched is defined and find_rename.matched == 0
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_rename
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
      - '{{ find_rename.files | map(attribute=''path'') | list | first }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_rename.matched is defined and find_rename.matched &gt; 0
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_rename
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the rename rule in rules.d when on x86
  lineinfile:
    path: '{{ all_files[0] }}'
    line: '{{ item }}'
    create: true
  with_items:
    - -a always,exit -F arch=b32 -S rename -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset
      -F key=access
    - -a always,exit -F arch=b32 -S rename -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
      -F key=access
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_rename
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the rename rule in rules.d when on x86_64
  lineinfile:
    path: '{{ all_files[0] }}'
    line: '{{ item }}'
    create: true
  with_items:
    - -a always,exit -F arch=b64 -S rename -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset
      -F key=access
    - -a always,exit -F arch=b64 -S rename -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
      -F key=access
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - audit_arch is defined and audit_arch == 'b64'
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_rename
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the rename rule in /etc/audit/audit.rules when on x86
  lineinfile:
    line: '{{ item }}'
    state: present
    dest: /etc/audit/audit.rules
    create: true
  with_items:
    - -a always,exit -F arch=b32 -S rename -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset
      -F key=access
    - -a always,exit -F arch=b32 -S rename -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
      -F key=access
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_rename
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the rename rule in audit.rules when on x86_64
  lineinfile:
    line: '{{ item }}'
    state: present
    dest: /etc/audit/audit.rules
    create: true
  with_items:
    - -a always,exit -F arch=b64 -S rename -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset
      -F key=access
    - -a always,exit -F arch=b64 -S rename -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
      -F key=access
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - audit_arch is defined and audit_arch == 'b64'
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_rename
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_unsuccessful_file_modification_rename:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-audit_rules_unsuccessful_file_modification_rename_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_unlinkat" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record Unsuccessul Delete Attempts to Files - unlinkat</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The audit system should collect unsuccessful file deletion
attempts for all users and root. If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured
to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following lines to a file with suffix
<html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>.

If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> file.
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S unlinkat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-delete
-a always,exit -F arch=b32 -S unlinkat -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-delete</html:pre>

If the system is 64 bit then also add the following lines:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">
-a always,exit -F arch=b64 -S unlinkat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-delete
-a always,exit -F arch=b64 -S unlinkat -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-delete</html:pre></description>
            <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping system calls related
to the same event is more efficient. See the following example:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S unlink,unlinkat,rename,renameat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-delete</html:pre></warning>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</reference>
            <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</reference>
            <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.2.4</reference>
            <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.2.1</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000064-GPOS-00033</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000458-GPOS-00203</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000461-GPOS-00205</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000468-GPOS-00212</reference>
            <reference href="">SRG-OS-000458-VMM-001810</reference>
            <reference href="">SRG-OS-000461-VMM-001830</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.2.6.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO12.06</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI08.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS02.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS02.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS02.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.2.6</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.7.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.7</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.15.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.15.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.5</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.7</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.2.2</reference>
            <reference href="https://www.cisecurity.org/controls/">1</reference>
            <reference href="https://www.cisecurity.org/controls/">11</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">13</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">19</reference>
            <reference href="https://www.cisecurity.org/controls/">2</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">4</reference>
            <reference href="https://www.cisecurity.org/controls/">5</reference>
            <reference href="https://www.cisecurity.org/controls/">6</reference>
            <reference href="https://www.cisecurity.org/controls/">7</reference>
            <reference href="https://www.cisecurity.org/controls/">8</reference>
            <reference href="https://www.cisecurity.org/controls/">9</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Unsuccessful attempts to delete files could be an indicator of malicious activity on a system. Auditing
these events could serve as evidence of potential system compromise.</rationale>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_unsuccessful_file_modification_unlinkat" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then



# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	PATTERN="-a always,exit -F arch=$ARCH -S unlinkat -F exit=-EACCES.*"
	GROUP="access"
	FULL_RULE="-a always,exit -F arch=$ARCH -S unlinkat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=access"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_fix_audit_syscall_rule" use="legacy"/>
	fix_audit_syscall_rule "auditctl" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
	fix_audit_syscall_rule "augenrules" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
done

for ARCH in "${RULE_ARCHS[@]}"
do
        PATTERN="-a always,exit -F arch=$ARCH -S unlinkat -F exit=-EPERM.*"
        GROUP="access"
        FULL_RULE="-a always,exit -F arch=$ARCH -S unlinkat -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=access"
        # Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_fix_audit_syscall_rule" use="legacy"/>
        fix_audit_syscall_rule "auditctl" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
        fix_audit_syscall_rule "augenrules" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_unsuccessful_file_modification_unlinkat" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="low" strategy="restrict">- name: Set architecture for audit unlinkat tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_unlinkat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Search /etc/audit/rules.d for other DAC audit rules
  find:
    paths: /etc/audit/rules.d
    recurse: false
    contains: -F key=perm_mod$
    patterns: '*.rules'
  register: find_unlinkat
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_unlinkat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: If existing DAC ruleset not found, use /etc/audit/rules.d/access.rules as
    the recipient for the rule
  set_fact:
    all_files:
      - /etc/audit/rules.d/access.rules
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_unlinkat.matched is defined and find_unlinkat.matched == 0
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_unlinkat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
      - '{{ find_unlinkat.files | map(attribute=''path'') | list | first }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_unlinkat.matched is defined and find_unlinkat.matched &gt; 0
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_unlinkat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the unlinkat rule in rules.d when on x86
  lineinfile:
    path: '{{ all_files[0] }}'
    line: '{{ item }}'
    create: true
  with_items:
    - -a always,exit -F arch=b32 -S unlinkat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset
      -F key=access
    - -a always,exit -F arch=b32 -S unlinkat -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
      -F key=access
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_unlinkat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the unlinkat rule in rules.d when on x86_64
  lineinfile:
    path: '{{ all_files[0] }}'
    line: '{{ item }}'
    create: true
  with_items:
    - -a always,exit -F arch=b64 -S unlinkat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset
      -F key=access
    - -a always,exit -F arch=b64 -S unlinkat -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
      -F key=access
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - audit_arch is defined and audit_arch == 'b64'
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_unlinkat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the unlinkat rule in /etc/audit/audit.rules when on x86
  lineinfile:
    line: '{{ item }}'
    state: present
    dest: /etc/audit/audit.rules
    create: true
  with_items:
    - -a always,exit -F arch=b32 -S unlinkat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset
      -F key=access
    - -a always,exit -F arch=b32 -S unlinkat -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
      -F key=access
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_unlinkat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the unlinkat rule in audit.rules when on x86_64
  lineinfile:
    line: '{{ item }}'
    state: present
    dest: /etc/audit/audit.rules
    create: true
  with_items:
    - -a always,exit -F arch=b64 -S unlinkat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset
      -F key=access
    - -a always,exit -F arch=b64 -S unlinkat -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
      -F key=access
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - audit_arch is defined and audit_arch == 'b64'
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_unlinkat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_unsuccessful_file_modification_unlinkat:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-audit_rules_unsuccessful_file_modification_unlinkat_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
        </Group>
        <Group id="xccdf_org.ssgproject.content_group_audit_file_deletion_events">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record File Deletion Events by User</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">At a minimum, the audit system should collect file deletion events
for all users and root. If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the
<html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program to read audit rules during daemon startup (the
default), add the following line to a file with suffix <html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the
directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>, setting ARCH to either b32 or b64 as
appropriate for your system:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=ARCH -S rmdir,unlink,unlinkat,rename,renameat -F auid&gt;=1000 -F auid!=unset -F key=delete</html:pre>
If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the following line to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> file, setting ARCH to either b32 or b64 as
appropriate for your system:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=ARCH -S rmdir,unlink,unlinkat,rename,renameat -F auid&gt;=1000 -F auid!=unset -F key=delete</html:pre></description>
          <platform idref="cpe:/a:machine"/>
          <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_file_deletion_events" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure auditd Collects File Deletion Events by User</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">At a minimum the audit system should collect file deletion events
for all users and root. If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the
<html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program to read audit rules during daemon startup (the
default), add the following line to a file with suffix <html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the
directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>, setting ARCH to either b32 or b64 as
appropriate for your system:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=ARCH -S rmdir,unlink,unlinkat,rename,renameat -F auid&gt;=1000 -F auid!=unset -F key=delete</html:pre>
If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the following line to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> file, setting ARCH to either b32 or b64 as
appropriate for your system:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=ARCH -S rmdir,unlink,unlinkat,rename -S renameat -F auid&gt;=1000 -F auid!=unset -F key=delete</html:pre></description>
            <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">This rule checks for multiple syscalls related to file deletion;
it was written with DISA STIG in mind. Other policies should use a
separate rule for each syscall that needs to be checked. For example:
<html:ul xmlns:html="http://www.w3.org/1999/xhtml"><html:li><html:code>audit_rules_file_deletion_events_rmdir</html:code></html:li><html:li><html:code>audit_rules_file_deletion_events_unlink</html:code></html:li><html:li><html:code>audit_rules_file_deletion_events_unlinkat</html:code></html:li></html:ul></warning>
            <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</reference>
            <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</reference>
            <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.2.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.2.6.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO12.06</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI08.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS02.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS02.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS02.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.2.6</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.7.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.7</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.15.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.15.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.5</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.7</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.2.2</reference>
            <reference href="https://www.cisecurity.org/controls/">1</reference>
            <reference href="https://www.cisecurity.org/controls/">11</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">13</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">19</reference>
            <reference href="https://www.cisecurity.org/controls/">2</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">4</reference>
            <reference href="https://www.cisecurity.org/controls/">5</reference>
            <reference href="https://www.cisecurity.org/controls/">6</reference>
            <reference href="https://www.cisecurity.org/controls/">7</reference>
            <reference href="https://www.cisecurity.org/controls/">8</reference>
            <reference href="https://www.cisecurity.org/controls/">9</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Auditing file deletions will create an audit trail for files that are removed
from the system. The audit trail could aid in system troubleshooting, as well as, detecting
malicious processes that attempt to delete log files to conceal their presence.</rationale>
            <platform idref="cpe:/a:machine"/>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_file_deletion_events:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-audit_rules_file_deletion_events_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_file_deletion_events_rmdir" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure auditd Collects File Deletion Events by User - rmdir</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">At a minimum, the audit system should collect file deletion events
for all users and root. If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the
<html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program to read audit rules during daemon startup (the
default), add the following line to a file with suffix <html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the
directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>, setting ARCH to either b32 or b64 as
appropriate for your system:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=ARCH -S rmdir -F auid&gt;=1000 -F auid!=unset -F key=delete</html:pre>
If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the following line to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> file, setting ARCH to either b32 or b64 as
appropriate for your system:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=ARCH -S rmdir -F auid&gt;=1000 -F auid!=unset -F key=delete</html:pre></description>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.MA-2</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</reference>
            <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</reference>
            <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.2.7</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000466-GPOS-00210</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000467-GPOS-00211</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000468-GPOS-00212</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</reference>
            <reference href="">SRG-OS-000466-VMM-001870</reference>
            <reference href="">SRG-OS-000468-VMM-001890</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.2.6.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO12.06</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI08.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS02.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS02.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS02.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.2.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.2.6</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.7.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.7</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.15.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.15.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.15.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.5</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.7</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.2.2</reference>
            <reference href="https://www.cisecurity.org/controls/">1</reference>
            <reference href="https://www.cisecurity.org/controls/">11</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">13</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">19</reference>
            <reference href="https://www.cisecurity.org/controls/">2</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">4</reference>
            <reference href="https://www.cisecurity.org/controls/">5</reference>
            <reference href="https://www.cisecurity.org/controls/">6</reference>
            <reference href="https://www.cisecurity.org/controls/">7</reference>
            <reference href="https://www.cisecurity.org/controls/">8</reference>
            <reference href="https://www.cisecurity.org/controls/">9</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Auditing file deletions will create an audit trail for files that are removed
from the system. The audit trail could aid in system troubleshooting, as well as, detecting
malicious processes that attempt to delete log files to conceal their presence.</rationale>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_file_deletion_events_rmdir" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then



# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	PATTERN="-a always,exit -F arch=$ARCH -S rmdir.*"
	GROUP="delete"
	FULL_RULE="-a always,exit -F arch=$ARCH -S rmdir -F auid&gt;=1000 -F auid!=unset -F key=delete"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_fix_audit_syscall_rule" use="legacy"/>
	fix_audit_syscall_rule "auditctl" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
	fix_audit_syscall_rule "augenrules" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_file_deletion_events_rmdir" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="low" strategy="restrict">- name: Set architecture for audit rmdir tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.7
    - audit_rules_file_deletion_events_rmdir
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Search /etc/audit/rules.d for other DAC audit rules
  find:
    paths: /etc/audit/rules.d
    recurse: false
    contains: -F key=delete$
    patterns: '*.rules'
  register: find_rmdir
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.7
    - audit_rules_file_deletion_events_rmdir
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: If existing DAC ruleset not found, use /etc/audit/rules.d/delete.rules as
    the recipient for the rule
  set_fact:
    all_files:
      - /etc/audit/rules.d/delete.rules
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_rmdir.matched is defined and find_rmdir.matched == 0
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.7
    - audit_rules_file_deletion_events_rmdir
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
      - '{{ find_rmdir.files | map(attribute=''path'') | list | first }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_rmdir.matched is defined and find_rmdir.matched &gt; 0
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.7
    - audit_rules_file_deletion_events_rmdir
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the rmdir rule in rules.d when on x86
  lineinfile:
    path: '{{ all_files[0] }}'
    line: -a always,exit -F arch=b32 -S rmdir -F auid&gt;=1000 -F auid!=unset -F key=delete
    create: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.7
    - audit_rules_file_deletion_events_rmdir
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the rmdir rule in rules.d when on x86_64
  lineinfile:
    path: '{{ all_files[0] }}'
    line: -a always,exit -F arch=b64 -S rmdir -F auid&gt;=1000 -F auid!=unset -F key=delete
    create: true
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - audit_arch is defined and audit_arch == 'b64'
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.7
    - audit_rules_file_deletion_events_rmdir
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the rmdir rule in /etc/audit/audit.rules when on x86
  lineinfile:
    line: -a always,exit -F arch=b32 -S rmdir -F auid&gt;=1000 -F auid!=unset -F key=delete
    state: present
    dest: /etc/audit/audit.rules
    create: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.7
    - audit_rules_file_deletion_events_rmdir
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the rmdir rule in audit.rules when on x86_64
  lineinfile:
    line: -a always,exit -F arch=b64 -S rmdir -F auid&gt;=1000 -F auid!=unset -F key=delete
    state: present
    dest: /etc/audit/audit.rules
    create: true
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - audit_arch is defined and audit_arch == 'b64'
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.7
    - audit_rules_file_deletion_events_rmdir
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_file_deletion_events_rmdir:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-audit_rules_file_deletion_events_rmdir_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_file_deletion_events_unlink" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure auditd Collects File Deletion Events by User - unlink</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">At a minimum, the audit system should collect file deletion events
for all users and root. If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the
<html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program to read audit rules during daemon startup (the
default), add the following line to a file with suffix <html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the
directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>, setting ARCH to either b32 or b64 as
appropriate for your system:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=ARCH -S unlink -F auid&gt;=1000 -F auid!=unset -F key=delete</html:pre>
If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the following line to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> file, setting ARCH to either b32 or b64 as
appropriate for your system:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=ARCH -S unlink -F auid&gt;=1000 -F auid!=unset -F key=delete</html:pre></description>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.MA-2</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</reference>
            <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</reference>
            <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.2.7</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000466-GPOS-00210</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000467-GPOS-00211</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000468-GPOS-00212</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</reference>
            <reference href="">SRG-OS-000466-VMM-001870</reference>
            <reference href="">SRG-OS-000468-VMM-001890</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.2.6.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO12.06</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI08.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS02.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS02.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS02.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.2.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.2.6</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.7.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.7</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.15.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.15.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.15.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.5</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.7</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.2.2</reference>
            <reference href="https://www.cisecurity.org/controls/">1</reference>
            <reference href="https://www.cisecurity.org/controls/">11</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">13</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">19</reference>
            <reference href="https://www.cisecurity.org/controls/">2</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">4</reference>
            <reference href="https://www.cisecurity.org/controls/">5</reference>
            <reference href="https://www.cisecurity.org/controls/">6</reference>
            <reference href="https://www.cisecurity.org/controls/">7</reference>
            <reference href="https://www.cisecurity.org/controls/">8</reference>
            <reference href="https://www.cisecurity.org/controls/">9</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Auditing file deletions will create an audit trail for files that are removed
from the system. The audit trail could aid in system troubleshooting, as well as, detecting
malicious processes that attempt to delete log files to conceal their presence.</rationale>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_file_deletion_events_unlink" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then



# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	PATTERN="-a always,exit -F arch=$ARCH -S unlink.*"
	GROUP="delete"
	FULL_RULE="-a always,exit -F arch=$ARCH -S unlink -F auid&gt;=1000 -F auid!=unset -F key=delete"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_fix_audit_syscall_rule" use="legacy"/>
	fix_audit_syscall_rule "auditctl" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
	fix_audit_syscall_rule "augenrules" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_file_deletion_events_unlink" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="low" strategy="restrict">- name: Set architecture for audit unlink tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.7
    - audit_rules_file_deletion_events_unlink
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Search /etc/audit/rules.d for other DAC audit rules
  find:
    paths: /etc/audit/rules.d
    recurse: false
    contains: -F key=delete$
    patterns: '*.rules'
  register: find_unlink
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.7
    - audit_rules_file_deletion_events_unlink
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: If existing DAC ruleset not found, use /etc/audit/rules.d/delete.rules as
    the recipient for the rule
  set_fact:
    all_files:
      - /etc/audit/rules.d/delete.rules
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_unlink.matched is defined and find_unlink.matched == 0
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.7
    - audit_rules_file_deletion_events_unlink
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
      - '{{ find_unlink.files | map(attribute=''path'') | list | first }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_unlink.matched is defined and find_unlink.matched &gt; 0
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.7
    - audit_rules_file_deletion_events_unlink
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the unlink rule in rules.d when on x86
  lineinfile:
    path: '{{ all_files[0] }}'
    line: -a always,exit -F arch=b32 -S unlink -F auid&gt;=1000 -F auid!=unset -F key=delete
    create: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.7
    - audit_rules_file_deletion_events_unlink
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the unlink rule in rules.d when on x86_64
  lineinfile:
    path: '{{ all_files[0] }}'
    line: -a always,exit -F arch=b64 -S unlink -F auid&gt;=1000 -F auid!=unset -F key=delete
    create: true
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - audit_arch is defined and audit_arch == 'b64'
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.7
    - audit_rules_file_deletion_events_unlink
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the unlink rule in /etc/audit/audit.rules when on x86
  lineinfile:
    line: -a always,exit -F arch=b32 -S unlink -F auid&gt;=1000 -F auid!=unset -F key=delete
    state: present
    dest: /etc/audit/audit.rules
    create: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.7
    - audit_rules_file_deletion_events_unlink
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the unlink rule in audit.rules when on x86_64
  lineinfile:
    line: -a always,exit -F arch=b64 -S unlink -F auid&gt;=1000 -F auid!=unset -F key=delete
    state: present
    dest: /etc/audit/audit.rules
    create: true
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - audit_arch is defined and audit_arch == 'b64'
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.7
    - audit_rules_file_deletion_events_unlink
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_file_deletion_events_unlink:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-audit_rules_file_deletion_events_unlink_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_file_deletion_events_renameat" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure auditd Collects File Deletion Events by User - renameat</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">At a minimum, the audit system should collect file deletion events
for all users and root. If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the
<html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program to read audit rules during daemon startup (the
default), add the following line to a file with suffix <html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the
directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>, setting ARCH to either b32 or b64 as
appropriate for your system:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=ARCH -S renameat -F auid&gt;=1000 -F auid!=unset -F key=delete</html:pre>
If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the following line to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> file, setting ARCH to either b32 or b64 as
appropriate for your system:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=ARCH -S renameat -F auid&gt;=1000 -F auid!=unset -F key=delete</html:pre></description>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.MA-2</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</reference>
            <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</reference>
            <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.2.7</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000466-GPOS-00210</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000467-GPOS-00211</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000468-GPOS-00212</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</reference>
            <reference href="">SRG-OS-000466-VMM-001870</reference>
            <reference href="">SRG-OS-000468-VMM-001890</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.2.6.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO12.06</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI08.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS02.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS02.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS02.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.2.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.2.6</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.7.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.7</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.15.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.15.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.15.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.5</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.7</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.2.2</reference>
            <reference href="https://www.cisecurity.org/controls/">1</reference>
            <reference href="https://www.cisecurity.org/controls/">11</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">13</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">19</reference>
            <reference href="https://www.cisecurity.org/controls/">2</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">4</reference>
            <reference href="https://www.cisecurity.org/controls/">5</reference>
            <reference href="https://www.cisecurity.org/controls/">6</reference>
            <reference href="https://www.cisecurity.org/controls/">7</reference>
            <reference href="https://www.cisecurity.org/controls/">8</reference>
            <reference href="https://www.cisecurity.org/controls/">9</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Auditing file deletions will create an audit trail for files that are removed
from the system. The audit trail could aid in system troubleshooting, as well as, detecting
malicious processes that attempt to delete log files to conceal their presence.</rationale>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_file_deletion_events_renameat" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then



# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	PATTERN="-a always,exit -F arch=$ARCH -S renameat.*"
	GROUP="delete"
	FULL_RULE="-a always,exit -F arch=$ARCH -S renameat -F auid&gt;=1000 -F auid!=unset -F key=delete"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_fix_audit_syscall_rule" use="legacy"/>
	fix_audit_syscall_rule "auditctl" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
	fix_audit_syscall_rule "augenrules" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_file_deletion_events_renameat" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="low" strategy="restrict">- name: Set architecture for audit renameat tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.7
    - audit_rules_file_deletion_events_renameat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Search /etc/audit/rules.d for other DAC audit rules
  find:
    paths: /etc/audit/rules.d
    recurse: false
    contains: -F key=delete$
    patterns: '*.rules'
  register: find_renameat
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.7
    - audit_rules_file_deletion_events_renameat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: If existing DAC ruleset not found, use /etc/audit/rules.d/delete.rules as
    the recipient for the rule
  set_fact:
    all_files:
      - /etc/audit/rules.d/delete.rules
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_renameat.matched is defined and find_renameat.matched == 0
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.7
    - audit_rules_file_deletion_events_renameat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
      - '{{ find_renameat.files | map(attribute=''path'') | list | first }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_renameat.matched is defined and find_renameat.matched &gt; 0
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.7
    - audit_rules_file_deletion_events_renameat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the renameat rule in rules.d when on x86
  lineinfile:
    path: '{{ all_files[0] }}'
    line: -a always,exit -F arch=b32 -S renameat -F auid&gt;=1000 -F auid!=unset -F key=delete
    create: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.7
    - audit_rules_file_deletion_events_renameat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the renameat rule in rules.d when on x86_64
  lineinfile:
    path: '{{ all_files[0] }}'
    line: -a always,exit -F arch=b64 -S renameat -F auid&gt;=1000 -F auid!=unset -F key=delete
    create: true
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - audit_arch is defined and audit_arch == 'b64'
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.7
    - audit_rules_file_deletion_events_renameat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the renameat rule in /etc/audit/audit.rules when on x86
  lineinfile:
    line: -a always,exit -F arch=b32 -S renameat -F auid&gt;=1000 -F auid!=unset -F key=delete
    state: present
    dest: /etc/audit/audit.rules
    create: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.7
    - audit_rules_file_deletion_events_renameat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the renameat rule in audit.rules when on x86_64
  lineinfile:
    line: -a always,exit -F arch=b64 -S renameat -F auid&gt;=1000 -F auid!=unset -F key=delete
    state: present
    dest: /etc/audit/audit.rules
    create: true
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - audit_arch is defined and audit_arch == 'b64'
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.7
    - audit_rules_file_deletion_events_renameat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_file_deletion_events_renameat:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-audit_rules_file_deletion_events_renameat_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_file_deletion_events_rename" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure auditd Collects File Deletion Events by User - rename</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">At a minimum, the audit system should collect file deletion events
for all users and root. If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the
<html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program to read audit rules during daemon startup (the
default), add the following line to a file with suffix <html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the
directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>, setting ARCH to either b32 or b64 as
appropriate for your system:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=ARCH -S rename -F auid&gt;=1000 -F auid!=unset -F key=delete</html:pre>
If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the following line to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> file, setting ARCH to either b32 or b64 as
appropriate for your system:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=ARCH -S rename -F auid&gt;=1000 -F auid!=unset -F key=delete</html:pre></description>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.MA-2</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</reference>
            <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</reference>
            <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.2.7</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000466-GPOS-00210</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000467-GPOS-00211</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000468-GPOS-00212</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</reference>
            <reference href="">SRG-OS-000466-VMM-001870</reference>
            <reference href="">SRG-OS-000468-VMM-001890</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.2.6.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO12.06</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI08.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS02.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS02.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS02.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.2.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.2.6</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.7.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.7</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.15.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.15.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.15.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.5</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.7</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.2.2</reference>
            <reference href="https://www.cisecurity.org/controls/">1</reference>
            <reference href="https://www.cisecurity.org/controls/">11</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">13</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">19</reference>
            <reference href="https://www.cisecurity.org/controls/">2</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">4</reference>
            <reference href="https://www.cisecurity.org/controls/">5</reference>
            <reference href="https://www.cisecurity.org/controls/">6</reference>
            <reference href="https://www.cisecurity.org/controls/">7</reference>
            <reference href="https://www.cisecurity.org/controls/">8</reference>
            <reference href="https://www.cisecurity.org/controls/">9</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Auditing file deletions will create an audit trail for files that are removed
from the system. The audit trail could aid in system troubleshooting, as well as, detecting
malicious processes that attempt to delete log files to conceal their presence.</rationale>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_file_deletion_events_rename" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then



# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	PATTERN="-a always,exit -F arch=$ARCH -S rename.*"
	GROUP="delete"
	FULL_RULE="-a always,exit -F arch=$ARCH -S rename -F auid&gt;=1000 -F auid!=unset -F key=delete"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_fix_audit_syscall_rule" use="legacy"/>
	fix_audit_syscall_rule "auditctl" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
	fix_audit_syscall_rule "augenrules" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_file_deletion_events_rename" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="low" strategy="restrict">- name: Set architecture for audit rename tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.7
    - audit_rules_file_deletion_events_rename
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Search /etc/audit/rules.d for other DAC audit rules
  find:
    paths: /etc/audit/rules.d
    recurse: false
    contains: -F key=delete$
    patterns: '*.rules'
  register: find_rename
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.7
    - audit_rules_file_deletion_events_rename
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: If existing DAC ruleset not found, use /etc/audit/rules.d/delete.rules as
    the recipient for the rule
  set_fact:
    all_files:
      - /etc/audit/rules.d/delete.rules
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_rename.matched is defined and find_rename.matched == 0
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.7
    - audit_rules_file_deletion_events_rename
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
      - '{{ find_rename.files | map(attribute=''path'') | list | first }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_rename.matched is defined and find_rename.matched &gt; 0
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.7
    - audit_rules_file_deletion_events_rename
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the rename rule in rules.d when on x86
  lineinfile:
    path: '{{ all_files[0] }}'
    line: -a always,exit -F arch=b32 -S rename -F auid&gt;=1000 -F auid!=unset -F key=delete
    create: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.7
    - audit_rules_file_deletion_events_rename
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the rename rule in rules.d when on x86_64
  lineinfile:
    path: '{{ all_files[0] }}'
    line: -a always,exit -F arch=b64 -S rename -F auid&gt;=1000 -F auid!=unset -F key=delete
    create: true
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - audit_arch is defined and audit_arch == 'b64'
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.7
    - audit_rules_file_deletion_events_rename
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the rename rule in /etc/audit/audit.rules when on x86
  lineinfile:
    line: -a always,exit -F arch=b32 -S rename -F auid&gt;=1000 -F auid!=unset -F key=delete
    state: present
    dest: /etc/audit/audit.rules
    create: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.7
    - audit_rules_file_deletion_events_rename
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the rename rule in audit.rules when on x86_64
  lineinfile:
    line: -a always,exit -F arch=b64 -S rename -F auid&gt;=1000 -F auid!=unset -F key=delete
    state: present
    dest: /etc/audit/audit.rules
    create: true
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - audit_arch is defined and audit_arch == 'b64'
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.7
    - audit_rules_file_deletion_events_rename
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_file_deletion_events_rename:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-audit_rules_file_deletion_events_rename_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_file_deletion_events_unlinkat" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure auditd Collects File Deletion Events by User - unlinkat</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">At a minimum, the audit system should collect file deletion events
for all users and root. If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the
<html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program to read audit rules during daemon startup (the
default), add the following line to a file with suffix <html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the
directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>, setting ARCH to either b32 or b64 as
appropriate for your system:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=ARCH -S unlinkat -F auid&gt;=1000 -F auid!=unset -F key=delete</html:pre>
If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the following line to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> file, setting ARCH to either b32 or b64 as
appropriate for your system:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=ARCH -S unlinkat -F auid&gt;=1000 -F auid!=unset -F key=delete</html:pre></description>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.MA-2</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</reference>
            <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</reference>
            <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.2.7</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000466-GPOS-00210</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000467-GPOS-00211</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000468-GPOS-00212</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</reference>
            <reference href="">SRG-OS-000466-VMM-001870</reference>
            <reference href="">SRG-OS-000468-VMM-001890</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.2.6.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO12.06</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI08.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS02.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS02.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS02.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.2.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.2.6</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.7.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.7</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.15.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.15.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.15.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.5</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.7</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.2.2</reference>
            <reference href="https://www.cisecurity.org/controls/">1</reference>
            <reference href="https://www.cisecurity.org/controls/">11</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">13</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">19</reference>
            <reference href="https://www.cisecurity.org/controls/">2</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">4</reference>
            <reference href="https://www.cisecurity.org/controls/">5</reference>
            <reference href="https://www.cisecurity.org/controls/">6</reference>
            <reference href="https://www.cisecurity.org/controls/">7</reference>
            <reference href="https://www.cisecurity.org/controls/">8</reference>
            <reference href="https://www.cisecurity.org/controls/">9</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Auditing file deletions will create an audit trail for files that are removed
from the system. The audit trail could aid in system troubleshooting, as well as, detecting
malicious processes that attempt to delete log files to conceal their presence.</rationale>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_file_deletion_events_unlinkat" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then



# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	PATTERN="-a always,exit -F arch=$ARCH -S unlinkat.*"
	GROUP="delete"
	FULL_RULE="-a always,exit -F arch=$ARCH -S unlinkat -F auid&gt;=1000 -F auid!=unset -F key=delete"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_fix_audit_syscall_rule" use="legacy"/>
	fix_audit_syscall_rule "auditctl" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
	fix_audit_syscall_rule "augenrules" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_file_deletion_events_unlinkat" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="low" strategy="restrict">- name: Set architecture for audit unlinkat tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.7
    - audit_rules_file_deletion_events_unlinkat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Search /etc/audit/rules.d for other DAC audit rules
  find:
    paths: /etc/audit/rules.d
    recurse: false
    contains: -F key=delete$
    patterns: '*.rules'
  register: find_unlinkat
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.7
    - audit_rules_file_deletion_events_unlinkat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: If existing DAC ruleset not found, use /etc/audit/rules.d/delete.rules as
    the recipient for the rule
  set_fact:
    all_files:
      - /etc/audit/rules.d/delete.rules
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_unlinkat.matched is defined and find_unlinkat.matched == 0
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.7
    - audit_rules_file_deletion_events_unlinkat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
      - '{{ find_unlinkat.files | map(attribute=''path'') | list | first }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_unlinkat.matched is defined and find_unlinkat.matched &gt; 0
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.7
    - audit_rules_file_deletion_events_unlinkat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the unlinkat rule in rules.d when on x86
  lineinfile:
    path: '{{ all_files[0] }}'
    line: -a always,exit -F arch=b32 -S unlinkat -F auid&gt;=1000 -F auid!=unset -F key=delete
    create: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.7
    - audit_rules_file_deletion_events_unlinkat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the unlinkat rule in rules.d when on x86_64
  lineinfile:
    path: '{{ all_files[0] }}'
    line: -a always,exit -F arch=b64 -S unlinkat -F auid&gt;=1000 -F auid!=unset -F key=delete
    create: true
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - audit_arch is defined and audit_arch == 'b64'
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.7
    - audit_rules_file_deletion_events_unlinkat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the unlinkat rule in /etc/audit/audit.rules when on x86
  lineinfile:
    line: -a always,exit -F arch=b32 -S unlinkat -F auid&gt;=1000 -F auid!=unset -F key=delete
    state: present
    dest: /etc/audit/audit.rules
    create: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.7
    - audit_rules_file_deletion_events_unlinkat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the unlinkat rule in audit.rules when on x86_64
  lineinfile:
    line: -a always,exit -F arch=b64 -S unlinkat -F auid&gt;=1000 -F auid!=unset -F key=delete
    state: present
    dest: /etc/audit/audit.rules
    create: true
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - audit_arch is defined and audit_arch == 'b64'
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.7
    - audit_rules_file_deletion_events_unlinkat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_file_deletion_events_unlinkat:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-audit_rules_file_deletion_events_unlinkat_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
        </Group>
        <Group id="xccdf_org.ssgproject.content_group_audit_login_events">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record Attempts to Alter Logon and Logout Events</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The audit system already collects login information for all users
and root. If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the
<html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program to read audit rules during daemon startup (the
default), add the following lines to a file with suffix <html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the
directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code> in order to watch for attempted manual
edits of files involved in storing logon events:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-w /var/log/tallylog -p wa -k logins
-w /var/run/faillock/ -p wa -k logins
-w /var/log/lastlog -p wa -k logins</html:pre>
If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> file in order to watch for unattempted manual
edits of files involved in storing logon events:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-w /var/log/tallylog -p wa -k logins
-w /var/run/faillock/ -p wa -k logins
-w /var/log/lastlog -p wa -k logins</html:pre></description>
          <platform idref="cpe:/a:machine"/>
          <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_login_events_faillock" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record Attempts to Alter Logon and Logout Events - faillock</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The audit system already collects login information for all users
and root. If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the
<html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program to read audit rules during daemon startup (the
default), add the following lines to a file with suffix <html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the
directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code> in order to watch for attempted manual
edits of files involved in storing logon events:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-w /var/run/faillock -p wa -k logins</html:pre>
If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> file in order to watch for unattempted manual
edits of files involved in storing logon events:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-w /var/run/faillock -p wa -k logins</html:pre></description>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000126</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</reference>
            <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</reference>
            <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.2.3</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000470-GPOS-00214</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000473-GPOS-00218</reference>
            <reference href="">SRG-OS-000473-VMM-001930</reference>
            <reference href="">SRG-OS-000470-VMM-001900</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.2.6.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO12.06</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI08.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS02.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS02.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS02.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.2.6</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.7.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.7</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.15.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.15.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.5</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.7</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.2.2</reference>
            <reference href="https://www.cisecurity.org/controls/">1</reference>
            <reference href="https://www.cisecurity.org/controls/">11</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">13</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">19</reference>
            <reference href="https://www.cisecurity.org/controls/">2</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">4</reference>
            <reference href="https://www.cisecurity.org/controls/">5</reference>
            <reference href="https://www.cisecurity.org/controls/">6</reference>
            <reference href="https://www.cisecurity.org/controls/">7</reference>
            <reference href="https://www.cisecurity.org/controls/">8</reference>
            <reference href="https://www.cisecurity.org/controls/">9</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Manual editing of these files may indicate nefarious activity, such
as an attacker attempting to remove evidence of an intrusion.</rationale>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_login_events_faillock" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then



# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_fix_audit_watch_rule" use="legacy"/>
fix_audit_watch_rule "auditctl" "/var/run/faillock" "wa" "logins"
fix_audit_watch_rule "augenrules" "/var/run/faillock" "wa" "logins"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_login_events_faillock" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="low" strategy="restrict">- name: Search /etc/audit/rules.d for other user/group modification audit rules
  find:
    paths: /etc/audit/rules.d
    recurse: false
    contains: -k logins$
    patterns: '*.rules'
  register: find_faillock
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.3
    - audit_rules_login_events_faillock
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: If existing user/group modification ruleset not found, use /etc/audit/rules.d/logins.rules
    as the recipient for the rule
  set_fact:
    all_files:
      - /etc/audit/rules.d/logins.rules
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_faillock.matched is defined and find_faillock.matched == 0
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.3
    - audit_rules_login_events_faillock
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
      - '{{ find_faillock.files | map(attribute=''path'') | list | first }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_faillock.matched is defined and find_faillock.matched &gt; 0
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.3
    - audit_rules_login_events_faillock
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the faillock rule in rules.d when on x86
  lineinfile:
    path: '{{ all_files[0] }}'
    line: -w /var/run/faillock -p wa -k logins
    create: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.3
    - audit_rules_login_events_faillock
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the faillock rule in /etc/audit/audit.rules
  lineinfile:
    line: -w /var/run/faillock -p wa -k logins
    state: present
    dest: /etc/audit/audit.rules
    create: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.3
    - audit_rules_login_events_faillock
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_login_events_faillock:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-audit_rules_login_events_faillock_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_login_events" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record Attempts to Alter Logon and Logout Events</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The audit system already collects login information for all users
and root. If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the
<html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program to read audit rules during daemon startup (the
default), add the following lines to a file with suffix <html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the
directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code> in order to watch for attempted manual
edits of files involved in storing logon events:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-w /var/log/tallylog -p wa -k logins
-w /var/run/faillock -p wa -k logins
-w /var/log/lastlog -p wa -k logins</html:pre>
If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> file in order to watch for unattempted manual
edits of files involved in storing logon events:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-w /var/log/tallylog -p wa -k logins
-w /var/run/faillock -p wa -k logins
-w /var/log/lastlog -p wa -k logins</html:pre></description>
            <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">This rule checks for multiple syscalls related to login events;
it was written with DISA STIG in mind. Other policies should use a
separate rule for each syscall that needs to be checked. For example:
<html:ul xmlns:html="http://www.w3.org/1999/xhtml"><html:li><html:code>audit_rules_login_events_tallylog</html:code></html:li><html:li><html:code>audit_rules_login_events_faillock</html:code></html:li><html:li><html:code>audit_rules_login_events_lastlog</html:code></html:li></html:ul></warning>
            <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</reference>
            <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.2.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.2.6.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO12.06</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI08.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS02.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS02.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS02.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.2.6</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.7.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.7</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.15.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.15.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.5</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.7</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.2.2</reference>
            <reference href="https://www.cisecurity.org/controls/">1</reference>
            <reference href="https://www.cisecurity.org/controls/">11</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">13</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">19</reference>
            <reference href="https://www.cisecurity.org/controls/">2</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">4</reference>
            <reference href="https://www.cisecurity.org/controls/">5</reference>
            <reference href="https://www.cisecurity.org/controls/">6</reference>
            <reference href="https://www.cisecurity.org/controls/">7</reference>
            <reference href="https://www.cisecurity.org/controls/">8</reference>
            <reference href="https://www.cisecurity.org/controls/">9</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Manual editing of these files may indicate nefarious activity, such
as an attacker attempting to remove evidence of an intrusion.</rationale>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_login_events" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then



# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_fix_audit_watch_rule" use="legacy"/>
fix_audit_watch_rule "auditctl" "/var/log/tallylog" "wa" "logins"
fix_audit_watch_rule "augenrules" "/var/log/tallylog" "wa" "logins"
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_fix_audit_watch_rule" use="legacy"/>
fix_audit_watch_rule "auditctl" "/var/run/faillock" "wa" "logins"
fix_audit_watch_rule "augenrules" "/var/run/faillock" "wa" "logins"
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_fix_audit_watch_rule" use="legacy"/>
fix_audit_watch_rule "auditctl" "/var/log/lastlog" "wa" "logins"
fix_audit_watch_rule "augenrules" "/var/log/lastlog" "wa" "logins"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_login_events:def:1" href="ssg-fedora-oval.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_login_events_tallylog" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record Attempts to Alter Logon and Logout Events - tallylog</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The audit system already collects login information for all users
and root. If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the
<html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program to read audit rules during daemon startup (the
default), add the following lines to a file with suffix <html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the
directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code> in order to watch for attempted manual
edits of files involved in storing logon events:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-w /var/log/tallylog -p wa -k logins</html:pre>
If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> file in order to watch for unattempted manual
edits of files involved in storing logon events:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-w /var/log/tallylog -p wa -k logins</html:pre></description>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000126</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</reference>
            <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</reference>
            <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.2.3</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000470-GPOS-00214</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000473-GPOS-00218</reference>
            <reference href="">SRG-OS-000473-VMM-001930</reference>
            <reference href="">SRG-OS-000470-VMM-001900</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.2.6.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO12.06</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI08.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS02.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS02.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS02.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.2.6</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.7.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.7</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.15.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.15.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.5</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.7</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.2.2</reference>
            <reference href="https://www.cisecurity.org/controls/">1</reference>
            <reference href="https://www.cisecurity.org/controls/">11</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">13</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">19</reference>
            <reference href="https://www.cisecurity.org/controls/">2</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">4</reference>
            <reference href="https://www.cisecurity.org/controls/">5</reference>
            <reference href="https://www.cisecurity.org/controls/">6</reference>
            <reference href="https://www.cisecurity.org/controls/">7</reference>
            <reference href="https://www.cisecurity.org/controls/">8</reference>
            <reference href="https://www.cisecurity.org/controls/">9</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Manual editing of these files may indicate nefarious activity, such
as an attacker attempting to remove evidence of an intrusion.</rationale>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_login_events_tallylog" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then



# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_fix_audit_watch_rule" use="legacy"/>
fix_audit_watch_rule "auditctl" "/var/log/tallylog" "wa" "logins"
fix_audit_watch_rule "augenrules" "/var/log/tallylog" "wa" "logins"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_login_events_tallylog" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="low" strategy="restrict">- name: Search /etc/audit/rules.d for other user/group modification audit rules
  find:
    paths: /etc/audit/rules.d
    recurse: false
    contains: -k logins$
    patterns: '*.rules'
  register: find_tallylog
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.3
    - audit_rules_login_events_tallylog
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: If existing user/group modification ruleset not found, use /etc/audit/rules.d/logins.rules
    as the recipient for the rule
  set_fact:
    all_files:
      - /etc/audit/rules.d/logins.rules
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_tallylog.matched is defined and find_tallylog.matched == 0
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.3
    - audit_rules_login_events_tallylog
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
      - '{{ find_tallylog.files | map(attribute=''path'') | list | first }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_tallylog.matched is defined and find_tallylog.matched &gt; 0
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.3
    - audit_rules_login_events_tallylog
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the tallylog rule in rules.d when on x86
  lineinfile:
    path: '{{ all_files[0] }}'
    line: -w /var/log/tallylog -p wa -k logins
    create: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.3
    - audit_rules_login_events_tallylog
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the tallylog rule in /etc/audit/audit.rules
  lineinfile:
    line: -w /var/log/tallylog -p wa -k logins
    state: present
    dest: /etc/audit/audit.rules
    create: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.3
    - audit_rules_login_events_tallylog
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_login_events_tallylog:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-audit_rules_login_events_tallylog_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_login_events_lastlog" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record Attempts to Alter Logon and Logout Events - lastlog</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The audit system already collects login information for all users
and root. If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the
<html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program to read audit rules during daemon startup (the
default), add the following lines to a file with suffix <html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the
directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code> in order to watch for attempted manual
edits of files involved in storing logon events:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-w /var/log/lastlog -p wa -k logins</html:pre>
If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> file in order to watch for unattempted manual
edits of files involved in storing logon events:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-w /var/log/lastlog -p wa -k logins</html:pre></description>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000126</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</reference>
            <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</reference>
            <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.2.3</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000470-GPOS-00214</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000473-GPOS-00218</reference>
            <reference href="">SRG-OS-000473-VMM-001930</reference>
            <reference href="">SRG-OS-000470-VMM-001900</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.2.6.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO12.06</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI08.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS02.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS02.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS02.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.2.6</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.7.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.7</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.15.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.15.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.5</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.7</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.2.2</reference>
            <reference href="https://www.cisecurity.org/controls/">1</reference>
            <reference href="https://www.cisecurity.org/controls/">11</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">13</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">19</reference>
            <reference href="https://www.cisecurity.org/controls/">2</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">4</reference>
            <reference href="https://www.cisecurity.org/controls/">5</reference>
            <reference href="https://www.cisecurity.org/controls/">6</reference>
            <reference href="https://www.cisecurity.org/controls/">7</reference>
            <reference href="https://www.cisecurity.org/controls/">8</reference>
            <reference href="https://www.cisecurity.org/controls/">9</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Manual editing of these files may indicate nefarious activity, such
as an attacker attempting to remove evidence of an intrusion.</rationale>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_login_events_lastlog" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then



# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_fix_audit_watch_rule" use="legacy"/>
fix_audit_watch_rule "auditctl" "/var/log/lastlog" "wa" "logins"
fix_audit_watch_rule "augenrules" "/var/log/lastlog" "wa" "logins"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_login_events_lastlog" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="low" strategy="restrict">- name: Search /etc/audit/rules.d for other user/group modification audit rules
  find:
    paths: /etc/audit/rules.d
    recurse: false
    contains: -k logins$
    patterns: '*.rules'
  register: find_lastlog
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.3
    - audit_rules_login_events_lastlog
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: If existing user/group modification ruleset not found, use /etc/audit/rules.d/logins.rules
    as the recipient for the rule
  set_fact:
    all_files:
      - /etc/audit/rules.d/logins.rules
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_lastlog.matched is defined and find_lastlog.matched == 0
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.3
    - audit_rules_login_events_lastlog
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
      - '{{ find_lastlog.files | map(attribute=''path'') | list | first }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_lastlog.matched is defined and find_lastlog.matched &gt; 0
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.3
    - audit_rules_login_events_lastlog
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the lastlog rule in rules.d when on x86
  lineinfile:
    path: '{{ all_files[0] }}'
    line: -w /var/log/lastlog -p wa -k logins
    create: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.3
    - audit_rules_login_events_lastlog
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the lastlog rule in /etc/audit/audit.rules
  lineinfile:
    line: -w /var/log/lastlog -p wa -k logins
    state: present
    dest: /etc/audit/audit.rules
    create: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.3
    - audit_rules_login_events_lastlog
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_login_events_lastlog:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-audit_rules_login_events_lastlog_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
        </Group>
        <Group id="xccdf_org.ssgproject.content_group_audit_time_rules">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Records Events that Modify Date and Time Information</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Arbitrary changes to the system time can be used to obfuscate
nefarious activities in log files, as well as to confuse network services that
are highly dependent upon an accurate system time. All changes to the system
time should be audited.</description>
          <platform idref="cpe:/a:machine"/>
          <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_time_stime" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record Attempts to Alter Time Through stime</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the
<html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program to read audit rules during daemon startup (the
default), add the following line to a file with suffix <html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the
directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code> for both 32 bit and 64 bit systems:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S stime -F key=audit_time_rules</html:pre>
Since the 64 bit version of the "stime" system call is not defined in the audit
lookup table, the corresponding "-F arch=b64" form of this rule is not expected
to be defined on 64 bit systems (the aforementioned "-F arch=b32" stime rule
form itself is sufficient for both 32 bit and 64 bit systems). If the
<html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code> utility to
read audit rules during daemon startup, add the following line to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> file for both 32 bit and 64 bit systems:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S stime -F key=audit_time_rules</html:pre>
Since the 64 bit version of the "stime" system call is not defined in the audit
lookup table, the corresponding "-F arch=b64" form of this rule is not expected
to be defined on 64 bit systems (the aforementioned "-F arch=b32" stime rule
form itself is sufficient for both 32 bit and 64 bit systems). The -k option
allows for the specification of a key in string form that can be used for
better reporting capability through ausearch and aureport. Multiple system
calls can be defined on the same line to save space if desired, but is not
required. See an example of multiple combined system calls:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b64 -S adjtimex,settimeofday -F key=audit_time_rules</html:pre></description>
            <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-001487</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</reference>
            <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.4.2.b</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.2.6.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO12.06</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI08.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS02.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS02.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS02.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.2.6</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.7.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.7</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.15.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.15.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.5</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.7</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.2.2</reference>
            <reference href="https://www.cisecurity.org/controls/">1</reference>
            <reference href="https://www.cisecurity.org/controls/">11</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">13</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">19</reference>
            <reference href="https://www.cisecurity.org/controls/">2</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">4</reference>
            <reference href="https://www.cisecurity.org/controls/">5</reference>
            <reference href="https://www.cisecurity.org/controls/">6</reference>
            <reference href="https://www.cisecurity.org/controls/">7</reference>
            <reference href="https://www.cisecurity.org/controls/">8</reference>
            <reference href="https://www.cisecurity.org/controls/">9</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Arbitrary changes to the system time can be used to obfuscate
nefarious activities in log files, as well as to confuse network services that
are highly dependent upon an accurate system time (such as sshd). All changes
to the system time should be audited.</rationale>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_time_stime" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_perform_audit_adjtimex_settimeofday_stime_remediation" use="legacy"/>
perform_audit_adjtimex_settimeofday_stime_remediation

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_time_stime" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Perform remediation of Audit rules for stime syscall for x86 platform
  block:

    - name: Declare list of syscals
      set_fact:
        syscalls:
          - stime

    - name: Declare number of syscalls
      set_fact: audit_syscalls_number_of_syscalls="{{ syscalls|length|int }}"

    - name: Check existence of syscalls for architecture b32 in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+{{
          item }}[\s]+|([\s]+|[,]){{ item }}([\s]+|[,]))).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$
        patterns: '*.rules'
      register: audit_syscalls_found_b32_rules_d
      loop: '{{ syscalls }}'

    - name: Get number of matched syscalls for architecture b32 in /etc/audit/rules.d/
      set_fact: audit_syscalls_matched_b32_rules_d="{{ audit_syscalls_found_b32_rules_d.results|sum(attribute='matched')|int
        }}"

    - name: Search /etc/audit/rules.d for other rules with the key audit_time_rules
      find:
        paths: /etc/audit/rules.d
        contains: ^.*(?:-F key=|-k\s+)audit_time_rules$
        patterns: '*.rules'
      register: find_syscalls_files

    - name: Use /etc/audit/rules.d/audit_time_rules.rules as the recipient for the
        rule
      set_fact:
        all_files:
          - /etc/audit/rules.d/audit_time_rules.rules
      when: find_syscalls_files.matched is defined and find_syscalls_files.matched
        == 0

    - name: Use matched file as the recipient for the rule
      set_fact:
        all_files:
          - '{{ find_syscalls_files.files | map(attribute=''path'') | list | first
            }}'
      when: find_syscalls_files.matched is defined and find_syscalls_files.matched
        &gt; 0

    - name: Insert the syscall rule in {{ all_files[0] }}
      block:

        - name: 'Construct rule: add rule list, action and arch'
          set_fact: tmpline="-a always,exit -F arch=b32"

        - name: 'Construct rule: add syscalls'
          set_fact: tmpline="{{ tmpline + ' -S ' + item.item }}"
          loop: '{{ audit_syscalls_found_b32_rules_d.results }}'
          when: item.matched is defined and item.matched == 0

        - name: 'Construct rule: add fields and key'
          set_fact: tmpline="{{ tmpline + ' -k audit_time_rules' }}"

        - name: Insert the line in {{ all_files[0] }}
          lineinfile:
            path: '{{ all_files[0] }}'
            line: '{{ tmpline }}'
            create: true
            state: present
      when: audit_syscalls_matched_b32_rules_d &lt; audit_syscalls_number_of_syscalls

    - name: Declare list of syscals
      set_fact:
        syscalls:
          - stime

    - name: Declare number of syscalls
      set_fact: audit_syscalls_number_of_syscalls="{{ syscalls|length|int }}"

    - name: Check existence of syscalls for architecture b32 in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+{{
          item }}[\s]+|([\s]+|[,]){{ item }}([\s]+|[,]))).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$
        patterns: audit.rules
      register: audit_syscalls_found_b32_audit_rules
      loop: '{{ syscalls }}'

    - name: Get number of matched syscalls for architecture b32 in /etc/audit/audit.rules
      set_fact: audit_syscalls_matched_b32_audit_rules="{{ audit_syscalls_found_b32_audit_rules.results|sum(attribute='matched')|int
        }}"

    - name: Insert the syscall rule in /etc/audit/audit.rules
      block:

        - name: 'Construct rule: add rule list, action and arch'
          set_fact: tmpline="-a always,exit -F arch=b32"

        - name: 'Construct rule: add syscalls'
          set_fact: tmpline="{{ tmpline + ' -S ' + item.item }}"
          loop: '{{ audit_syscalls_found_b32_audit_rules.results }}'
          when: item.matched is defined and item.matched == 0

        - name: 'Construct rule: add fields and key'
          set_fact: tmpline="{{ tmpline + ' -k audit_time_rules' }}"

        - name: Insert the line in /etc/audit/audit.rules
          lineinfile:
            path: /etc/audit/audit.rules
            line: '{{ tmpline }}'
            create: true
            state: present
      when: audit_syscalls_matched_b32_audit_rules &lt; audit_syscalls_number_of_syscalls
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.4.2.b
    - audit_rules_time_stime
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_time_stime" system="urn:xccdf:fix:script:kubernetes" reboot="true" complexity="low" disruption="low" strategy="restrict">apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20stime%20-k%20audit_time_rules%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20stime%20-k%20audit_time_rules%0A
        mode: 0600
        path: /etc/audit/rules.d/75-syscall-stime.rules
        overwrite: true
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_time_stime:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-audit_rules_time_stime_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_time_clock_settime" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record Attempts to Alter Time Through clock_settime</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the
<html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program to read audit rules during daemon startup (the
default), add the following line to a file with suffix <html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the
directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S clock_settime -F a0=0x0 -F key=time-change</html:pre>
If the system is 64 bit then also add the following line:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b64 -S clock_settime -F a0=0x0 -F key=time-change</html:pre>
If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the following line to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> file:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S clock_settime -F a0=0x0 -F key=time-change</html:pre>
If the system is 64 bit then also add the following line:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b64 -S clock_settime -F a0=0x0 -F key=time-change</html:pre>
The -k option allows for the specification of a key in string form that can
be used for better reporting capability through ausearch and aureport.
Multiple system calls can be defined on the same line to save space if
desired, but is not required. See an example of multiple combined syscalls:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b64 -S adjtimex,settimeofday -F key=audit_time_rules</html:pre></description>
            <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-001487</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</reference>
            <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.4.2.b</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.2.6.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO12.06</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI08.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS02.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS02.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS02.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.2.6</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.7.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.7</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.15.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.15.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.5</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.7</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.2.2</reference>
            <reference href="https://www.cisecurity.org/controls/">1</reference>
            <reference href="https://www.cisecurity.org/controls/">11</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">13</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">19</reference>
            <reference href="https://www.cisecurity.org/controls/">2</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">4</reference>
            <reference href="https://www.cisecurity.org/controls/">5</reference>
            <reference href="https://www.cisecurity.org/controls/">6</reference>
            <reference href="https://www.cisecurity.org/controls/">7</reference>
            <reference href="https://www.cisecurity.org/controls/">8</reference>
            <reference href="https://www.cisecurity.org/controls/">9</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Arbitrary changes to the system time can be used to obfuscate
nefarious activities in log files, as well as to confuse network services that
are highly dependent upon an accurate system time (such as sshd). All changes
to the system time should be audited.</rationale>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_time_clock_settime" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then



# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	PATTERN="-a always,exit -F arch=$ARCH -S clock_settime -F a0=.* \(-F key=\|-k \).*"
	GROUP="clock_settime"
	FULL_RULE="-a always,exit -F arch=$ARCH -S clock_settime -F a0=0x0 -k time-change"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_fix_audit_syscall_rule" use="legacy"/>
	fix_audit_syscall_rule "auditctl" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
	fix_audit_syscall_rule "augenrules" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_time_clock_settime" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Set architecture for audit tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.4.2.b
    - audit_rules_time_clock_settime
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Perform remediation of Audit rules for clock_settime for x86 platform
  block:

    - name: Declare list of syscals
      set_fact:
        syscalls:
          - clock_settime

    - name: Declare number of syscalls
      set_fact: audit_syscalls_number_of_syscalls="{{ syscalls|length|int }}"

    - name: Check existence of syscalls for architecture b32 in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+{{
          item }}[\s]+|([\s]+|[,]){{ item }}([\s]+|[,]))).*(?:-F[\s]+a0=0x0[\s]+)(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$
        patterns: '*.rules'
      register: audit_syscalls_found_b32_rules_d
      loop: '{{ syscalls }}'

    - name: Get number of matched syscalls for architecture b32 in /etc/audit/rules.d/
      set_fact: audit_syscalls_matched_b32_rules_d="{{ audit_syscalls_found_b32_rules_d.results|sum(attribute='matched')|int
        }}"

    - name: Search /etc/audit/rules.d for other rules with the key time-change
      find:
        paths: /etc/audit/rules.d
        contains: ^.*(?:-F key=|-k\s+)time-change$
        patterns: '*.rules'
      register: find_syscalls_files

    - name: Use /etc/audit/rules.d/time-change.rules as the recipient for the rule
      set_fact:
        all_files:
          - /etc/audit/rules.d/time-change.rules
      when: find_syscalls_files.matched is defined and find_syscalls_files.matched
        == 0

    - name: Use matched file as the recipient for the rule
      set_fact:
        all_files:
          - '{{ find_syscalls_files.files | map(attribute=''path'') | list | first
            }}'
      when: find_syscalls_files.matched is defined and find_syscalls_files.matched
        &gt; 0

    - name: Insert the syscall rule in {{ all_files[0] }}
      block:

        - name: 'Construct rule: add rule list, action and arch'
          set_fact: tmpline="-a always,exit -F arch=b32"

        - name: 'Construct rule: add syscalls'
          set_fact: tmpline="{{ tmpline + ' -S ' + item.item }}"
          loop: '{{ audit_syscalls_found_b32_rules_d.results }}'
          when: item.matched is defined and item.matched == 0

        - name: 'Construct rule: add fields and key'
          set_fact: tmpline="{{ tmpline + ' -F a0=0x0 -k time-change' }}"

        - name: Insert the line in {{ all_files[0] }}
          lineinfile:
            path: '{{ all_files[0] }}'
            line: '{{ tmpline }}'
            create: true
            state: present
      when: audit_syscalls_matched_b32_rules_d &lt; audit_syscalls_number_of_syscalls

    - name: Declare list of syscals
      set_fact:
        syscalls:
          - clock_settime

    - name: Declare number of syscalls
      set_fact: audit_syscalls_number_of_syscalls="{{ syscalls|length|int }}"

    - name: Check existence of syscalls for architecture b32 in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+{{
          item }}[\s]+|([\s]+|[,]){{ item }}([\s]+|[,]))).*(?:-F[\s]+a0=0x0[\s]+)(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$
        patterns: audit.rules
      register: audit_syscalls_found_b32_audit_rules
      loop: '{{ syscalls }}'

    - name: Get number of matched syscalls for architecture b32 in /etc/audit/audit.rules
      set_fact: audit_syscalls_matched_b32_audit_rules="{{ audit_syscalls_found_b32_audit_rules.results|sum(attribute='matched')|int
        }}"

    - name: Insert the syscall rule in /etc/audit/audit.rules
      block:

        - name: 'Construct rule: add rule list, action and arch'
          set_fact: tmpline="-a always,exit -F arch=b32"

        - name: 'Construct rule: add syscalls'
          set_fact: tmpline="{{ tmpline + ' -S ' + item.item }}"
          loop: '{{ audit_syscalls_found_b32_audit_rules.results }}'
          when: item.matched is defined and item.matched == 0

        - name: 'Construct rule: add fields and key'
          set_fact: tmpline="{{ tmpline + ' -F a0=0x0 -k time-change' }}"

        - name: Insert the line in /etc/audit/audit.rules
          lineinfile:
            path: /etc/audit/audit.rules
            line: '{{ tmpline }}'
            create: true
            state: present
      when: audit_syscalls_matched_b32_audit_rules &lt; audit_syscalls_number_of_syscalls
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.4.2.b
    - audit_rules_time_clock_settime
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Perform remediation of Audit rules for clock_settime for x86_64 platform
  block:

    - name: Declare list of syscals
      set_fact:
        syscalls:
          - clock_settime

    - name: Declare number of syscalls
      set_fact: audit_syscalls_number_of_syscalls="{{ syscalls|length|int }}"

    - name: Check existence of syscalls for architecture b64 in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+{{
          item }}[\s]+|([\s]+|[,]){{ item }}([\s]+|[,]))).*(?:-F[\s]+a0=0x0[\s]+)(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$
        patterns: '*.rules'
      register: audit_syscalls_found_b64_rules_d
      loop: '{{ syscalls }}'

    - name: Get number of matched syscalls for architecture b64 in /etc/audit/rules.d/
      set_fact: audit_syscalls_matched_b64_rules_d="{{ audit_syscalls_found_b64_rules_d.results|sum(attribute='matched')|int
        }}"

    - name: Search /etc/audit/rules.d for other rules with the key time-change
      find:
        paths: /etc/audit/rules.d
        contains: ^.*(?:-F key=|-k\s+)time-change$
        patterns: '*.rules'
      register: find_syscalls_files

    - name: Use /etc/audit/rules.d/time-change.rules as the recipient for the rule
      set_fact:
        all_files:
          - /etc/audit/rules.d/time-change.rules
      when: find_syscalls_files.matched is defined and find_syscalls_files.matched
        == 0

    - name: Use matched file as the recipient for the rule
      set_fact:
        all_files:
          - '{{ find_syscalls_files.files | map(attribute=''path'') | list | first
            }}'
      when: find_syscalls_files.matched is defined and find_syscalls_files.matched
        &gt; 0

    - name: Insert the syscall rule in {{ all_files[0] }}
      block:

        - name: 'Construct rule: add rule list, action and arch'
          set_fact: tmpline="-a always,exit -F arch=b64"

        - name: 'Construct rule: add syscalls'
          set_fact: tmpline="{{ tmpline + ' -S ' + item.item }}"
          loop: '{{ audit_syscalls_found_b64_rules_d.results }}'
          when: item.matched is defined and item.matched == 0

        - name: 'Construct rule: add fields and key'
          set_fact: tmpline="{{ tmpline + ' -F a0=0x0 -k time-change' }}"

        - name: Insert the line in {{ all_files[0] }}
          lineinfile:
            path: '{{ all_files[0] }}'
            line: '{{ tmpline }}'
            create: true
            state: present
      when: audit_syscalls_matched_b64_rules_d &lt; audit_syscalls_number_of_syscalls

    - name: Declare list of syscals
      set_fact:
        syscalls:
          - clock_settime

    - name: Declare number of syscalls
      set_fact: audit_syscalls_number_of_syscalls="{{ syscalls|length|int }}"

    - name: Check existence of syscalls for architecture b64 in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+{{
          item }}[\s]+|([\s]+|[,]){{ item }}([\s]+|[,]))).*(?:-F[\s]+a0=0x0[\s]+)(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$
        patterns: audit.rules
      register: audit_syscalls_found_b64_audit_rules
      loop: '{{ syscalls }}'

    - name: Get number of matched syscalls for architecture b64 in /etc/audit/audit.rules
      set_fact: audit_syscalls_matched_b64_audit_rules="{{ audit_syscalls_found_b64_audit_rules.results|sum(attribute='matched')|int
        }}"

    - name: Insert the syscall rule in /etc/audit/audit.rules
      block:

        - name: 'Construct rule: add rule list, action and arch'
          set_fact: tmpline="-a always,exit -F arch=b64"

        - name: 'Construct rule: add syscalls'
          set_fact: tmpline="{{ tmpline + ' -S ' + item.item }}"
          loop: '{{ audit_syscalls_found_b64_audit_rules.results }}'
          when: item.matched is defined and item.matched == 0

        - name: 'Construct rule: add fields and key'
          set_fact: tmpline="{{ tmpline + ' -F a0=0x0 -k time-change' }}"

        - name: Insert the line in /etc/audit/audit.rules
          lineinfile:
            path: /etc/audit/audit.rules
            line: '{{ tmpline }}'
            create: true
            state: present
      when: audit_syscalls_matched_b64_audit_rules &lt; audit_syscalls_number_of_syscalls
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - audit_arch == "b64"
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.4.2.b
    - audit_rules_time_clock_settime
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_time_clock_settime" system="urn:xccdf:fix:script:kubernetes" reboot="true" complexity="low" disruption="low" strategy="restrict">apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20clock_settime%20-F%20a0%3D0x0%20-k%20time-change%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20clock_settime%20-F%20a0%3D0x0%20-k%20time-change%0A
        mode: 0600
        path: /etc/audit/rules.d/75-syscall-clock-settime.rules
        overwrite: true
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_time_clock_settime:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-audit_rules_time_clock_settime_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_time_watch_localtime" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record Attempts to Alter the localtime File</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the
<html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program to read audit rules during daemon startup (the default),
add the following line to a file with suffix <html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the directory
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-w /etc/localtime -p wa -k audit_time_rules</html:pre>
If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the following line to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> file:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-w /etc/localtime -p wa -k audit_time_rules</html:pre>
The -k option allows for the specification of a key in string form that can
be used for better reporting capability through ausearch and aureport and
should always be used.</description>
            <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-001487</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</reference>
            <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.4.2.b</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.2.6.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO12.06</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI08.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS02.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS02.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS02.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.2.6</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.7.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.7</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.15.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.15.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.5</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.7</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.2.2</reference>
            <reference href="https://www.cisecurity.org/controls/">1</reference>
            <reference href="https://www.cisecurity.org/controls/">11</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">13</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">19</reference>
            <reference href="https://www.cisecurity.org/controls/">2</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">4</reference>
            <reference href="https://www.cisecurity.org/controls/">5</reference>
            <reference href="https://www.cisecurity.org/controls/">6</reference>
            <reference href="https://www.cisecurity.org/controls/">7</reference>
            <reference href="https://www.cisecurity.org/controls/">8</reference>
            <reference href="https://www.cisecurity.org/controls/">9</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Arbitrary changes to the system time can be used to obfuscate
nefarious activities in log files, as well as to confuse network services that
are highly dependent upon an accurate system time (such as sshd). All changes
to the system time should be audited.</rationale>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_time_watch_localtime" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then



# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_fix_audit_watch_rule" use="legacy"/>
fix_audit_watch_rule "auditctl" "/etc/localtime" "wa" "audit_time_rules"
fix_audit_watch_rule "augenrules" "/etc/localtime" "wa" "audit_time_rules"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_time_watch_localtime" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Check if watch rule for /etc/localtime already exists in /etc/audit/rules.d/
  find:
    paths: /etc/audit/rules.d
    contains: ^\s*-w\s+/etc/localtime\s+-p\s+wa(\s|$)+
    patterns: '*.rules'
  register: find_existing_watch_rules_d
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.4.2.b
    - audit_rules_time_watch_localtime
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Search /etc/audit/rules.d for other rules with specified key audit_time_rules
  find:
    paths: /etc/audit/rules.d
    contains: ^.*(?:-F key=|-k\s+)audit_time_rules$
    patterns: '*.rules'
  register: find_watch_key
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
      == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.4.2.b
    - audit_rules_time_watch_localtime
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Use /etc/audit/rules.d/audit_time_rules.rules as the recipient for the rule
  set_fact:
    all_files:
      - /etc/audit/rules.d/audit_time_rules.rules
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_watch_key.matched is defined and find_watch_key.matched == 0 and find_existing_watch_rules_d.matched
      is defined and find_existing_watch_rules_d.matched == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.4.2.b
    - audit_rules_time_watch_localtime
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
      - '{{ find_watch_key.files | map(attribute=''path'') | list | first }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_watch_key.matched is defined and find_watch_key.matched &gt; 0 and find_existing_watch_rules_d.matched
      is defined and find_existing_watch_rules_d.matched == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.4.2.b
    - audit_rules_time_watch_localtime
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Add watch rule for /etc/localtime in /etc/audit/rules.d/
  lineinfile:
    path: '{{ all_files[0] }}'
    line: -w /etc/localtime -p wa -k audit_time_rules
    create: true
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
      == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.4.2.b
    - audit_rules_time_watch_localtime
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Check if watch rule for /etc/localtime already exists in /etc/audit/audit.rules
  find:
    paths: /etc/audit/
    contains: ^\s*-w\s+/etc/localtime\s+-p\s+wa(\s|$)+
    patterns: audit.rules
  register: find_existing_watch_audit_rules
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.4.2.b
    - audit_rules_time_watch_localtime
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Add watch rule for /etc/localtime in /etc/audit/audit.rules
  lineinfile:
    line: -w /etc/localtime -p wa -k audit_time_rules
    state: present
    dest: /etc/audit/audit.rules
    create: true
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_existing_watch_audit_rules.matched is defined and find_existing_watch_audit_rules.matched
      == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.4.2.b
    - audit_rules_time_watch_localtime
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_time_watch_localtime" system="urn:xccdf:fix:script:kubernetes" reboot="true" complexity="low" disruption="low" strategy="restrict">apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,-w%20/etc/localtime%20-p%20wa%20-k%20audit_time_rules%0A
        mode: 0600
        path: /etc/audit/rules.d/75-etclocaltime-wa-audit_time_rules.rules
        overwrite: true
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_time_watch_localtime:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-audit_rules_time_watch_localtime_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_time_adjtimex" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record attempts to alter time through adjtimex</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the
<html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program to read audit rules during daemon startup (the
default), add the following line to a file with suffix <html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the
directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S adjtimex -F key=audit_time_rules</html:pre>
If the system is 64 bit then also add the following line:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b64 -S adjtimex -F key=audit_time_rules</html:pre>
If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the following line to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> file:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S adjtimex -F key=audit_time_rules</html:pre>
If the system is 64 bit then also add the following line:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b64 -S adjtimex -F key=audit_time_rules</html:pre>
The -k option allows for the specification of a key in string form that can be
used for better reporting capability through ausearch and aureport. Multiple
system calls can be defined on the same line to save space if desired, but is
not required. See an example of multiple combined syscalls:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b64 -S adjtimex,settimeofday -F key=audit_time_rules</html:pre></description>
            <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-001487</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</reference>
            <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.4.2.b</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.2.6.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO12.06</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI08.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS02.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS02.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS02.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.2.6</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.7.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.7</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.15.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.15.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.5</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.7</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.2.2</reference>
            <reference href="https://www.cisecurity.org/controls/">1</reference>
            <reference href="https://www.cisecurity.org/controls/">11</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">13</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">19</reference>
            <reference href="https://www.cisecurity.org/controls/">2</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">4</reference>
            <reference href="https://www.cisecurity.org/controls/">5</reference>
            <reference href="https://www.cisecurity.org/controls/">6</reference>
            <reference href="https://www.cisecurity.org/controls/">7</reference>
            <reference href="https://www.cisecurity.org/controls/">8</reference>
            <reference href="https://www.cisecurity.org/controls/">9</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Arbitrary changes to the system time can be used to obfuscate
nefarious activities in log files, as well as to confuse network services that
are highly dependent upon an accurate system time (such as sshd). All changes
to the system time should be audited.</rationale>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_time_adjtimex" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_perform_audit_adjtimex_settimeofday_stime_remediation" use="legacy"/>
perform_audit_adjtimex_settimeofday_stime_remediation

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_time_adjtimex" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Set architecture for audit tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.4.2.b
    - audit_rules_time_adjtimex
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Perform remediation of Audit rules for adjtimex for x86 platform
  block:

    - name: Declare list of syscals
      set_fact:
        syscalls:
          - adjtimex

    - name: Declare number of syscalls
      set_fact: audit_syscalls_number_of_syscalls="{{ syscalls|length|int }}"

    - name: Check existence of syscalls for architecture b32 in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+{{
          item }}[\s]+|([\s]+|[,]){{ item }}([\s]+|[,]))).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$
        patterns: '*.rules'
      register: audit_syscalls_found_b32_rules_d
      loop: '{{ syscalls }}'

    - name: Get number of matched syscalls for architecture b32 in /etc/audit/rules.d/
      set_fact: audit_syscalls_matched_b32_rules_d="{{ audit_syscalls_found_b32_rules_d.results|sum(attribute='matched')|int
        }}"

    - name: Search /etc/audit/rules.d for other rules with the key audit_time_rules
      find:
        paths: /etc/audit/rules.d
        contains: ^.*(?:-F key=|-k\s+)audit_time_rules$
        patterns: '*.rules'
      register: find_syscalls_files

    - name: Use /etc/audit/rules.d/audit_time_rules.rules as the recipient for the
        rule
      set_fact:
        all_files:
          - /etc/audit/rules.d/audit_time_rules.rules
      when: find_syscalls_files.matched is defined and find_syscalls_files.matched
        == 0

    - name: Use matched file as the recipient for the rule
      set_fact:
        all_files:
          - '{{ find_syscalls_files.files | map(attribute=''path'') | list | first
            }}'
      when: find_syscalls_files.matched is defined and find_syscalls_files.matched
        &gt; 0

    - name: Insert the syscall rule in {{ all_files[0] }}
      block:

        - name: 'Construct rule: add rule list, action and arch'
          set_fact: tmpline="-a always,exit -F arch=b32"

        - name: 'Construct rule: add syscalls'
          set_fact: tmpline="{{ tmpline + ' -S ' + item.item }}"
          loop: '{{ audit_syscalls_found_b32_rules_d.results }}'
          when: item.matched is defined and item.matched == 0

        - name: 'Construct rule: add fields and key'
          set_fact: tmpline="{{ tmpline + ' -k audit_time_rules' }}"

        - name: Insert the line in {{ all_files[0] }}
          lineinfile:
            path: '{{ all_files[0] }}'
            line: '{{ tmpline }}'
            create: true
            state: present
      when: audit_syscalls_matched_b32_rules_d &lt; audit_syscalls_number_of_syscalls

    - name: Declare list of syscals
      set_fact:
        syscalls:
          - adjtimex

    - name: Declare number of syscalls
      set_fact: audit_syscalls_number_of_syscalls="{{ syscalls|length|int }}"

    - name: Check existence of syscalls for architecture b32 in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+{{
          item }}[\s]+|([\s]+|[,]){{ item }}([\s]+|[,]))).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$
        patterns: audit.rules
      register: audit_syscalls_found_b32_audit_rules
      loop: '{{ syscalls }}'

    - name: Get number of matched syscalls for architecture b32 in /etc/audit/audit.rules
      set_fact: audit_syscalls_matched_b32_audit_rules="{{ audit_syscalls_found_b32_audit_rules.results|sum(attribute='matched')|int
        }}"

    - name: Insert the syscall rule in /etc/audit/audit.rules
      block:

        - name: 'Construct rule: add rule list, action and arch'
          set_fact: tmpline="-a always,exit -F arch=b32"

        - name: 'Construct rule: add syscalls'
          set_fact: tmpline="{{ tmpline + ' -S ' + item.item }}"
          loop: '{{ audit_syscalls_found_b32_audit_rules.results }}'
          when: item.matched is defined and item.matched == 0

        - name: 'Construct rule: add fields and key'
          set_fact: tmpline="{{ tmpline + ' -k audit_time_rules' }}"

        - name: Insert the line in /etc/audit/audit.rules
          lineinfile:
            path: /etc/audit/audit.rules
            line: '{{ tmpline }}'
            create: true
            state: present
      when: audit_syscalls_matched_b32_audit_rules &lt; audit_syscalls_number_of_syscalls
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.4.2.b
    - audit_rules_time_adjtimex
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Perform remediation of Audit rules for adjtimex for x86_64 platform
  block:

    - name: Declare list of syscals
      set_fact:
        syscalls:
          - adjtimex

    - name: Declare number of syscalls
      set_fact: audit_syscalls_number_of_syscalls="{{ syscalls|length|int }}"

    - name: Check existence of syscalls for architecture b64 in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+{{
          item }}[\s]+|([\s]+|[,]){{ item }}([\s]+|[,]))).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$
        patterns: '*.rules'
      register: audit_syscalls_found_b64_rules_d
      loop: '{{ syscalls }}'

    - name: Get number of matched syscalls for architecture b64 in /etc/audit/rules.d/
      set_fact: audit_syscalls_matched_b64_rules_d="{{ audit_syscalls_found_b64_rules_d.results|sum(attribute='matched')|int
        }}"

    - name: Search /etc/audit/rules.d for other rules with the key audit_time_rules
      find:
        paths: /etc/audit/rules.d
        contains: ^.*(?:-F key=|-k\s+)audit_time_rules$
        patterns: '*.rules'
      register: find_syscalls_files

    - name: Use /etc/audit/rules.d/audit_time_rules.rules as the recipient for the
        rule
      set_fact:
        all_files:
          - /etc/audit/rules.d/audit_time_rules.rules
      when: find_syscalls_files.matched is defined and find_syscalls_files.matched
        == 0

    - name: Use matched file as the recipient for the rule
      set_fact:
        all_files:
          - '{{ find_syscalls_files.files | map(attribute=''path'') | list | first
            }}'
      when: find_syscalls_files.matched is defined and find_syscalls_files.matched
        &gt; 0

    - name: Insert the syscall rule in {{ all_files[0] }}
      block:

        - name: 'Construct rule: add rule list, action and arch'
          set_fact: tmpline="-a always,exit -F arch=b64"

        - name: 'Construct rule: add syscalls'
          set_fact: tmpline="{{ tmpline + ' -S ' + item.item }}"
          loop: '{{ audit_syscalls_found_b64_rules_d.results }}'
          when: item.matched is defined and item.matched == 0

        - name: 'Construct rule: add fields and key'
          set_fact: tmpline="{{ tmpline + ' -k audit_time_rules' }}"

        - name: Insert the line in {{ all_files[0] }}
          lineinfile:
            path: '{{ all_files[0] }}'
            line: '{{ tmpline }}'
            create: true
            state: present
      when: audit_syscalls_matched_b64_rules_d &lt; audit_syscalls_number_of_syscalls

    - name: Declare list of syscals
      set_fact:
        syscalls:
          - adjtimex

    - name: Declare number of syscalls
      set_fact: audit_syscalls_number_of_syscalls="{{ syscalls|length|int }}"

    - name: Check existence of syscalls for architecture b64 in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+{{
          item }}[\s]+|([\s]+|[,]){{ item }}([\s]+|[,]))).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$
        patterns: audit.rules
      register: audit_syscalls_found_b64_audit_rules
      loop: '{{ syscalls }}'

    - name: Get number of matched syscalls for architecture b64 in /etc/audit/audit.rules
      set_fact: audit_syscalls_matched_b64_audit_rules="{{ audit_syscalls_found_b64_audit_rules.results|sum(attribute='matched')|int
        }}"

    - name: Insert the syscall rule in /etc/audit/audit.rules
      block:

        - name: 'Construct rule: add rule list, action and arch'
          set_fact: tmpline="-a always,exit -F arch=b64"

        - name: 'Construct rule: add syscalls'
          set_fact: tmpline="{{ tmpline + ' -S ' + item.item }}"
          loop: '{{ audit_syscalls_found_b64_audit_rules.results }}'
          when: item.matched is defined and item.matched == 0

        - name: 'Construct rule: add fields and key'
          set_fact: tmpline="{{ tmpline + ' -k audit_time_rules' }}"

        - name: Insert the line in /etc/audit/audit.rules
          lineinfile:
            path: /etc/audit/audit.rules
            line: '{{ tmpline }}'
            create: true
            state: present
      when: audit_syscalls_matched_b64_audit_rules &lt; audit_syscalls_number_of_syscalls
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - audit_arch == "b64"
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.4.2.b
    - audit_rules_time_adjtimex
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_time_adjtimex" system="urn:xccdf:fix:script:kubernetes" reboot="true" complexity="low" disruption="low" strategy="restrict">apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20adjtimex%20-k%20audit_time_rules%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20adjtimex%20-k%20audit_time_rules%0A
        mode: 0600
        path: /etc/audit/rules.d/75-syscall-adjtimex.rules
        overwrite: true
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_time_adjtimex:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-audit_rules_time_adjtimex_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_time_settimeofday" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record attempts to alter time through settimeofday</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the
<html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program to read audit rules during daemon startup (the
default), add the following line to a file with suffix <html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the
directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S settimeofday -F key=audit_time_rules</html:pre>
If the system is 64 bit then also add the following line:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b64 -S settimeofday -F key=audit_time_rules</html:pre>
If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the following line to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> file:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S settimeofday -F key=audit_time_rules</html:pre>
If the system is 64 bit then also add the following line:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b64 -S settimeofday -F key=audit_time_rules</html:pre>
The -k option allows for the specification of a key in string form that can be
used for better reporting capability through ausearch and aureport. Multiple
system calls can be defined on the same line to save space if desired, but is
not required. See an example of multiple combined syscalls:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b64 -S adjtimex,settimeofday -F key=audit_time_rules</html:pre></description>
            <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-001487</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</reference>
            <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.4.2.b</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.2.6.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO12.06</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI08.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS02.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS02.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS02.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.2.6</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.7.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.7</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.15.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.15.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.5</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.7</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.2.2</reference>
            <reference href="https://www.cisecurity.org/controls/">1</reference>
            <reference href="https://www.cisecurity.org/controls/">11</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">13</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">19</reference>
            <reference href="https://www.cisecurity.org/controls/">2</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">4</reference>
            <reference href="https://www.cisecurity.org/controls/">5</reference>
            <reference href="https://www.cisecurity.org/controls/">6</reference>
            <reference href="https://www.cisecurity.org/controls/">7</reference>
            <reference href="https://www.cisecurity.org/controls/">8</reference>
            <reference href="https://www.cisecurity.org/controls/">9</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Arbitrary changes to the system time can be used to obfuscate
nefarious activities in log files, as well as to confuse network services that
are highly dependent upon an accurate system time (such as sshd). All changes
to the system time should be audited.</rationale>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_time_settimeofday" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_perform_audit_adjtimex_settimeofday_stime_remediation" use="legacy"/>
perform_audit_adjtimex_settimeofday_stime_remediation

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_time_settimeofday" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Set architecture for audit tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.4.2.b
    - audit_rules_time_settimeofday
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Perform remediation of Audit rules for settimeofday for x86 platform
  block:

    - name: Declare list of syscals
      set_fact:
        syscalls:
          - settimeofday

    - name: Declare number of syscalls
      set_fact: audit_syscalls_number_of_syscalls="{{ syscalls|length|int }}"

    - name: Check existence of syscalls for architecture b32 in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+{{
          item }}[\s]+|([\s]+|[,]){{ item }}([\s]+|[,]))).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$
        patterns: '*.rules'
      register: audit_syscalls_found_b32_rules_d
      loop: '{{ syscalls }}'

    - name: Get number of matched syscalls for architecture b32 in /etc/audit/rules.d/
      set_fact: audit_syscalls_matched_b32_rules_d="{{ audit_syscalls_found_b32_rules_d.results|sum(attribute='matched')|int
        }}"

    - name: Search /etc/audit/rules.d for other rules with the key audit_time_rules
      find:
        paths: /etc/audit/rules.d
        contains: ^.*(?:-F key=|-k\s+)audit_time_rules$
        patterns: '*.rules'
      register: find_syscalls_files

    - name: Use /etc/audit/rules.d/audit_time_rules.rules as the recipient for the
        rule
      set_fact:
        all_files:
          - /etc/audit/rules.d/audit_time_rules.rules
      when: find_syscalls_files.matched is defined and find_syscalls_files.matched
        == 0

    - name: Use matched file as the recipient for the rule
      set_fact:
        all_files:
          - '{{ find_syscalls_files.files | map(attribute=''path'') | list | first
            }}'
      when: find_syscalls_files.matched is defined and find_syscalls_files.matched
        &gt; 0

    - name: Insert the syscall rule in {{ all_files[0] }}
      block:

        - name: 'Construct rule: add rule list, action and arch'
          set_fact: tmpline="-a always,exit -F arch=b32"

        - name: 'Construct rule: add syscalls'
          set_fact: tmpline="{{ tmpline + ' -S ' + item.item }}"
          loop: '{{ audit_syscalls_found_b32_rules_d.results }}'
          when: item.matched is defined and item.matched == 0

        - name: 'Construct rule: add fields and key'
          set_fact: tmpline="{{ tmpline + ' -k audit_time_rules' }}"

        - name: Insert the line in {{ all_files[0] }}
          lineinfile:
            path: '{{ all_files[0] }}'
            line: '{{ tmpline }}'
            create: true
            state: present
      when: audit_syscalls_matched_b32_rules_d &lt; audit_syscalls_number_of_syscalls

    - name: Declare list of syscals
      set_fact:
        syscalls:
          - settimeofday

    - name: Declare number of syscalls
      set_fact: audit_syscalls_number_of_syscalls="{{ syscalls|length|int }}"

    - name: Check existence of syscalls for architecture b32 in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+{{
          item }}[\s]+|([\s]+|[,]){{ item }}([\s]+|[,]))).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$
        patterns: audit.rules
      register: audit_syscalls_found_b32_audit_rules
      loop: '{{ syscalls }}'

    - name: Get number of matched syscalls for architecture b32 in /etc/audit/audit.rules
      set_fact: audit_syscalls_matched_b32_audit_rules="{{ audit_syscalls_found_b32_audit_rules.results|sum(attribute='matched')|int
        }}"

    - name: Insert the syscall rule in /etc/audit/audit.rules
      block:

        - name: 'Construct rule: add rule list, action and arch'
          set_fact: tmpline="-a always,exit -F arch=b32"

        - name: 'Construct rule: add syscalls'
          set_fact: tmpline="{{ tmpline + ' -S ' + item.item }}"
          loop: '{{ audit_syscalls_found_b32_audit_rules.results }}'
          when: item.matched is defined and item.matched == 0

        - name: 'Construct rule: add fields and key'
          set_fact: tmpline="{{ tmpline + ' -k audit_time_rules' }}"

        - name: Insert the line in /etc/audit/audit.rules
          lineinfile:
            path: /etc/audit/audit.rules
            line: '{{ tmpline }}'
            create: true
            state: present
      when: audit_syscalls_matched_b32_audit_rules &lt; audit_syscalls_number_of_syscalls
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.4.2.b
    - audit_rules_time_settimeofday
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Perform remediation of Audit rules for settimeofday for x86_64 platform
  block:

    - name: Declare list of syscals
      set_fact:
        syscalls:
          - settimeofday

    - name: Declare number of syscalls
      set_fact: audit_syscalls_number_of_syscalls="{{ syscalls|length|int }}"

    - name: Check existence of syscalls for architecture b64 in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+{{
          item }}[\s]+|([\s]+|[,]){{ item }}([\s]+|[,]))).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$
        patterns: '*.rules'
      register: audit_syscalls_found_b64_rules_d
      loop: '{{ syscalls }}'

    - name: Get number of matched syscalls for architecture b64 in /etc/audit/rules.d/
      set_fact: audit_syscalls_matched_b64_rules_d="{{ audit_syscalls_found_b64_rules_d.results|sum(attribute='matched')|int
        }}"

    - name: Search /etc/audit/rules.d for other rules with the key audit_time_rules
      find:
        paths: /etc/audit/rules.d
        contains: ^.*(?:-F key=|-k\s+)audit_time_rules$
        patterns: '*.rules'
      register: find_syscalls_files

    - name: Use /etc/audit/rules.d/audit_time_rules.rules as the recipient for the
        rule
      set_fact:
        all_files:
          - /etc/audit/rules.d/audit_time_rules.rules
      when: find_syscalls_files.matched is defined and find_syscalls_files.matched
        == 0

    - name: Use matched file as the recipient for the rule
      set_fact:
        all_files:
          - '{{ find_syscalls_files.files | map(attribute=''path'') | list | first
            }}'
      when: find_syscalls_files.matched is defined and find_syscalls_files.matched
        &gt; 0

    - name: Insert the syscall rule in {{ all_files[0] }}
      block:

        - name: 'Construct rule: add rule list, action and arch'
          set_fact: tmpline="-a always,exit -F arch=b64"

        - name: 'Construct rule: add syscalls'
          set_fact: tmpline="{{ tmpline + ' -S ' + item.item }}"
          loop: '{{ audit_syscalls_found_b64_rules_d.results }}'
          when: item.matched is defined and item.matched == 0

        - name: 'Construct rule: add fields and key'
          set_fact: tmpline="{{ tmpline + ' -k audit_time_rules' }}"

        - name: Insert the line in {{ all_files[0] }}
          lineinfile:
            path: '{{ all_files[0] }}'
            line: '{{ tmpline }}'
            create: true
            state: present
      when: audit_syscalls_matched_b64_rules_d &lt; audit_syscalls_number_of_syscalls

    - name: Declare list of syscals
      set_fact:
        syscalls:
          - settimeofday

    - name: Declare number of syscalls
      set_fact: audit_syscalls_number_of_syscalls="{{ syscalls|length|int }}"

    - name: Check existence of syscalls for architecture b64 in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+{{
          item }}[\s]+|([\s]+|[,]){{ item }}([\s]+|[,]))).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$
        patterns: audit.rules
      register: audit_syscalls_found_b64_audit_rules
      loop: '{{ syscalls }}'

    - name: Get number of matched syscalls for architecture b64 in /etc/audit/audit.rules
      set_fact: audit_syscalls_matched_b64_audit_rules="{{ audit_syscalls_found_b64_audit_rules.results|sum(attribute='matched')|int
        }}"

    - name: Insert the syscall rule in /etc/audit/audit.rules
      block:

        - name: 'Construct rule: add rule list, action and arch'
          set_fact: tmpline="-a always,exit -F arch=b64"

        - name: 'Construct rule: add syscalls'
          set_fact: tmpline="{{ tmpline + ' -S ' + item.item }}"
          loop: '{{ audit_syscalls_found_b64_audit_rules.results }}'
          when: item.matched is defined and item.matched == 0

        - name: 'Construct rule: add fields and key'
          set_fact: tmpline="{{ tmpline + ' -k audit_time_rules' }}"

        - name: Insert the line in /etc/audit/audit.rules
          lineinfile:
            path: /etc/audit/audit.rules
            line: '{{ tmpline }}'
            create: true
            state: present
      when: audit_syscalls_matched_b64_audit_rules &lt; audit_syscalls_number_of_syscalls
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - audit_arch == "b64"
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.4.2.b
    - audit_rules_time_settimeofday
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_time_settimeofday" system="urn:xccdf:fix:script:kubernetes" reboot="true" complexity="low" disruption="low" strategy="restrict">apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20settimeofday%20-k%20audit_time_rules%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20settimeofday%20-k%20audit_time_rules%0A
        mode: 0600
        path: /etc/audit/rules.d/75-syscall-settimeofday.rules
        overwrite: true
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_time_settimeofday:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-audit_rules_time_settimeofday_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
        </Group>
        <Group id="xccdf_org.ssgproject.content_group_audit_privileged_commands">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record Information on the Use of Privileged Commands</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">At a minimum, the audit system should collect the execution of
privileged commands for all users and root.</description>
          <platform idref="cpe:/a:machine"/>
          <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_sudoedit" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure auditd Collects Information on the Use of Privileged Commands - sudoedit</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">At a minimum, the audit system should collect the execution of
privileged commands for all users and root. If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is
configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program to read audit rules during
daemon startup (the default), add a line of the following form to a file with
suffix <html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F path=/usr/bin/sudoedit -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre>
If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add a line of the following
form to <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F path=/usr/bin/sudoedit -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre></description>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000135</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
            <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</reference>
            <reference href="">SRG-OS-000471-VMM-001910</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.2.6.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.7.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.7</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.15.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.15.2.2</reference>
            <reference href="https://www.cisecurity.org/controls/">1</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">13</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">2</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">5</reference>
            <reference href="https://www.cisecurity.org/controls/">6</reference>
            <reference href="https://www.cisecurity.org/controls/">7</reference>
            <reference href="https://www.cisecurity.org/controls/">8</reference>
            <reference href="https://www.cisecurity.org/controls/">9</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Misuse of privileged functions, either intentionally or unintentionally by
authorized users, or by unauthorized external entities that have compromised system accounts,
is a serious and ongoing concern and can have significant adverse impacts on organizations.
Auditing the use of privileged functions is one way to detect such misuse and identify
the risk from insider and advanced persistent threats.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Privileged programs are subject to escalation-of-privilege attacks,
which attempt to subvert their normal role of providing some necessary but
limited capability. As such, motivation exists to monitor these programs for
unusual activity.</rationale>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_privileged_commands_sudoedit" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then



PATTERN="-a always,exit -F path=/usr/bin/sudoedit\\s\\+.*"
GROUP="privileged"
# Although the fix doesn't use ARCH, we reset it because it could have been set by some other remediation
ARCH=""
FULL_RULE="-a always,exit -F path=/usr/bin/sudoedit -F auid&gt;=1000 -F auid!=unset -F key=privileged"
# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_fix_audit_syscall_rule" use="legacy"/>
fix_audit_syscall_rule "auditctl" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
fix_audit_syscall_rule "augenrules" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_privileged_commands_sudoedit" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Search /etc/audit/rules.d for audit rule entries
  find:
    paths: /etc/audit/rules.d
    recurse: false
    contains: ^.*path=/usr/bin/sudoedit.*$
    patterns: '*.rules'
  register: find_sudoedit
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_sudoedit
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Use /etc/audit/rules.d/privileged.rules as the recipient for the rule
  set_fact:
    all_files:
      - /etc/audit/rules.d/privileged.rules
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_sudoedit.matched is defined and find_sudoedit.matched == 0
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_sudoedit
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
      - '{{ find_sudoedit.files | map(attribute=''path'') | list | first }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_sudoedit.matched is defined and find_sudoedit.matched &gt; 0
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_sudoedit
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Inserts/replaces the sudoedit rule in rules.d
  lineinfile:
    path: '{{ all_files[0] }}'
    line: -a always,exit -F path=/usr/bin/sudoedit -F auid&gt;=1000 -F auid!=unset -F
      key=privileged
    create: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_sudoedit
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Inserts/replaces the sudoedit rule in audit.rules
  lineinfile:
    path: /etc/audit/audit.rules
    line: -a always,exit -F path=/usr/bin/sudoedit -F auid&gt;=1000 -F auid!=unset -F
      key=privileged
    create: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_sudoedit
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_privileged_commands_sudoedit:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-audit_rules_privileged_commands_sudoedit_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_crontab" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure auditd Collects Information on the Use of Privileged Commands - crontab</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">At a minimum, the audit system should collect the execution of
privileged commands for all users and root. If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is
configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program to read audit rules during
daemon startup (the default), add a line of the following form to a file with
suffix <html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F path=/usr/bin/crontab -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre>
If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add a line of the following
form to <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F path=/usr/bin/crontab -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre></description>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000135</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</reference>
            <reference href="">SRG-OS-000471-VMM-001910</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.2.6.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.7.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.7</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.15.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.15.2.2</reference>
            <reference href="https://www.cisecurity.org/controls/">1</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">13</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">2</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">5</reference>
            <reference href="https://www.cisecurity.org/controls/">6</reference>
            <reference href="https://www.cisecurity.org/controls/">7</reference>
            <reference href="https://www.cisecurity.org/controls/">8</reference>
            <reference href="https://www.cisecurity.org/controls/">9</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Misuse of privileged functions, either intentionally or unintentionally by
authorized users, or by unauthorized external entities that have compromised system accounts,
is a serious and ongoing concern and can have significant adverse impacts on organizations.
Auditing the use of privileged functions is one way to detect such misuse and identify
the risk from insider and advanced persistent threats.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Privileged programs are subject to escalation-of-privilege attacks,
which attempt to subvert their normal role of providing some necessary but
limited capability. As such, motivation exists to monitor these programs for
unusual activity.</rationale>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_privileged_commands_crontab" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then



PATTERN="-a always,exit -F path=/usr/bin/crontab\\s\\+.*"
GROUP="privileged"
# Although the fix doesn't use ARCH, we reset it because it could have been set by some other remediation
ARCH=""
FULL_RULE="-a always,exit -F path=/usr/bin/crontab -F auid&gt;=1000 -F auid!=unset -F key=privileged"
# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_fix_audit_syscall_rule" use="legacy"/>
fix_audit_syscall_rule "auditctl" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
fix_audit_syscall_rule "augenrules" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_privileged_commands_crontab" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Search /etc/audit/rules.d for audit rule entries
  find:
    paths: /etc/audit/rules.d
    recurse: false
    contains: ^.*path=/usr/bin/crontab.*$
    patterns: '*.rules'
  register: find_crontab
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_crontab
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Use /etc/audit/rules.d/privileged.rules as the recipient for the rule
  set_fact:
    all_files:
      - /etc/audit/rules.d/privileged.rules
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_crontab.matched is defined and find_crontab.matched == 0
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_crontab
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
      - '{{ find_crontab.files | map(attribute=''path'') | list | first }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_crontab.matched is defined and find_crontab.matched &gt; 0
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_crontab
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Inserts/replaces the crontab rule in rules.d
  lineinfile:
    path: '{{ all_files[0] }}'
    line: -a always,exit -F path=/usr/bin/crontab -F auid&gt;=1000 -F auid!=unset -F
      key=privileged
    create: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_crontab
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Inserts/replaces the crontab rule in audit.rules
  lineinfile:
    path: /etc/audit/audit.rules
    line: -a always,exit -F path=/usr/bin/crontab -F auid&gt;=1000 -F auid!=unset -F
      key=privileged
    create: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_crontab
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_privileged_commands_crontab:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-audit_rules_privileged_commands_crontab_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_newgidmap" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure auditd Collects Information on the Use of Privileged Commands - newgidmap</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">At a minimum, the audit system should collect the execution of
privileged commands for all users and root. If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is
configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program to read audit rules during
daemon startup (the default), add a line of the following form to a file with
suffix <html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F path=/usr/bin/newgidmap -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre>
If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add a line of the following
form to <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F path=/usr/bin/newgidmap -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre></description>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-2(4)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</reference>
            <reference href="">SRG-OS-000471-VMM-001910</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Misuse of privileged functions, either intentionally or unintentionally by
authorized users, or by unauthorized external entities that have compromised system accounts,
is a serious and ongoing concern and can have significant adverse impacts on organizations.
Auditing the use of privileged functions is one way to detect such misuse and identify
the risk from insider and advanced persistent threats.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Privileged programs are subject to escalation-of-privilege attacks,
which attempt to subvert their normal role of providing some necessary but
limited capability. As such, motivation exists to monitor these programs for
unusual activity.</rationale>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_privileged_commands_newgidmap" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then



PATTERN="-a always,exit -F path=/usr/bin/newgidmap\\s\\+.*"
GROUP="privileged"
# Although the fix doesn't use ARCH, we reset it because it could have been set by some other remediation
ARCH=""
FULL_RULE="-a always,exit -F path=/usr/bin/newgidmap -F auid&gt;=1000 -F auid!=unset -F key=privileged"
# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_fix_audit_syscall_rule" use="legacy"/>
fix_audit_syscall_rule "auditctl" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
fix_audit_syscall_rule "augenrules" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_privileged_commands_newgidmap" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Search /etc/audit/rules.d for audit rule entries
  find:
    paths: /etc/audit/rules.d
    recurse: false
    contains: ^.*path=/usr/bin/newgidmap.*$
    patterns: '*.rules'
  register: find_newgidmap
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_newgidmap
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Use /etc/audit/rules.d/privileged.rules as the recipient for the rule
  set_fact:
    all_files:
      - /etc/audit/rules.d/privileged.rules
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_newgidmap.matched is defined and find_newgidmap.matched == 0
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_newgidmap
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
      - '{{ find_newgidmap.files | map(attribute=''path'') | list | first }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_newgidmap.matched is defined and find_newgidmap.matched &gt; 0
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_newgidmap
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Inserts/replaces the newgidmap rule in rules.d
  lineinfile:
    path: '{{ all_files[0] }}'
    line: -a always,exit -F path=/usr/bin/newgidmap -F auid&gt;=1000 -F auid!=unset -F
      key=privileged
    create: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_newgidmap
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Inserts/replaces the newgidmap rule in audit.rules
  lineinfile:
    path: /etc/audit/audit.rules
    line: -a always,exit -F path=/usr/bin/newgidmap -F auid&gt;=1000 -F auid!=unset -F
      key=privileged
    create: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_newgidmap
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_privileged_commands_newgidmap:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-audit_rules_privileged_commands_newgidmap_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_ssh_keysign" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure auditd Collects Information on the Use of Privileged Commands - ssh-keysign</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">At a minimum, the audit system should collect the execution of
privileged commands for all users and root. If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is
configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program to read audit rules during
daemon startup (the default), add a line of the following form to a file with
suffix <html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F path=/usr/libexec/openssh/ssh-keysign -F auid&gt;=1000 
-F auid!=unset -F key=privileged</html:pre>
If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add a line of the following
form to <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F path=/usr/libexec/openssh/ssh-keysign
-F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre></description>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000135</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
            <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</reference>
            <reference href="">SRG-OS-000471-VMM-001910</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.2.6.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.7.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.7</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.15.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.15.2.2</reference>
            <reference href="https://www.cisecurity.org/controls/">1</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">13</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">2</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">5</reference>
            <reference href="https://www.cisecurity.org/controls/">6</reference>
            <reference href="https://www.cisecurity.org/controls/">7</reference>
            <reference href="https://www.cisecurity.org/controls/">8</reference>
            <reference href="https://www.cisecurity.org/controls/">9</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Misuse of privileged functions, either intentionally or unintentionally by
authorized users, or by unauthorized external entities that have compromised system accounts,
is a serious and ongoing concern and can have significant adverse impacts on organizations.
Auditing the use of privileged functions is one way to detect such misuse and identify
the risk from insider and advanced persistent threats.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Privileged programs are subject to escalation-of-privilege attacks,
which attempt to subvert their normal role of providing some necessary but
limited capability. As such, motivation exists to monitor these programs for
unusual activity.</rationale>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_privileged_commands_ssh_keysign" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then



PATTERN="-a always,exit -F path=/usr/libexec/openssh/ssh-keysign\\s\\+.*"
GROUP="privileged"
# Although the fix doesn't use ARCH, we reset it because it could have been set by some other remediation
ARCH=""
FULL_RULE="-a always,exit -F path=/usr/libexec/openssh/ssh-keysign -F auid&gt;=1000 -F auid!=unset -F key=privileged"
# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_fix_audit_syscall_rule" use="legacy"/>
fix_audit_syscall_rule "auditctl" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
fix_audit_syscall_rule "augenrules" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_privileged_commands_ssh_keysign" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Search /etc/audit/rules.d for audit rule entries
  find:
    paths: /etc/audit/rules.d
    recurse: false
    contains: ^.*path=/usr/libexec/openssh/ssh-keysign.*$
    patterns: '*.rules'
  register: find_ssh_keysign
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_ssh_keysign
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Use /etc/audit/rules.d/privileged.rules as the recipient for the rule
  set_fact:
    all_files:
      - /etc/audit/rules.d/privileged.rules
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_ssh_keysign.matched is defined and find_ssh_keysign.matched == 0
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_ssh_keysign
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
      - '{{ find_ssh_keysign.files | map(attribute=''path'') | list | first }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_ssh_keysign.matched is defined and find_ssh_keysign.matched &gt; 0
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_ssh_keysign
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Inserts/replaces the ssh_keysign rule in rules.d
  lineinfile:
    path: '{{ all_files[0] }}'
    line: -a always,exit -F path=/usr/libexec/openssh/ssh-keysign -F auid&gt;=1000 -F
      auid!=unset -F key=privileged
    create: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_ssh_keysign
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Inserts/replaces the ssh_keysign rule in audit.rules
  lineinfile:
    path: /etc/audit/audit.rules
    line: -a always,exit -F path=/usr/libexec/openssh/ssh-keysign -F auid&gt;=1000 -F
      auid!=unset -F key=privileged
    create: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_ssh_keysign
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_privileged_commands_ssh_keysign:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-audit_rules_privileged_commands_ssh_keysign_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_umount" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure auditd Collects Information on the Use of Privileged Commands - umount</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">At a minimum, the audit system should collect the execution of
privileged commands for all users and root. If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is
configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program to read audit rules during
daemon startup (the default), add a line of the following form to a file with
suffix <html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F path=/usr/bin/umount -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre>
If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add a line of the following
form to <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F path=/usr/bin/umount -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre></description>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000135</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</reference>
            <reference href="">SRG-OS-000471-VMM-001910</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.2.6.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.7.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.7</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.15.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.15.2.2</reference>
            <reference href="https://www.cisecurity.org/controls/">1</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">13</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">2</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">5</reference>
            <reference href="https://www.cisecurity.org/controls/">6</reference>
            <reference href="https://www.cisecurity.org/controls/">7</reference>
            <reference href="https://www.cisecurity.org/controls/">8</reference>
            <reference href="https://www.cisecurity.org/controls/">9</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Misuse of privileged functions, either intentionally or unintentionally by
authorized users, or by unauthorized external entities that have compromised system accounts,
is a serious and ongoing concern and can have significant adverse impacts on organizations.
Auditing the use of privileged functions is one way to detect such misuse and identify
the risk from insider and advanced persistent threats.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Privileged programs are subject to escalation-of-privilege attacks,
which attempt to subvert their normal role of providing some necessary but
limited capability. As such, motivation exists to monitor these programs for
unusual activity.</rationale>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_privileged_commands_umount" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then



PATTERN="-a always,exit -F path=/usr/bin/umount\\s\\+.*"
GROUP="privileged"
# Although the fix doesn't use ARCH, we reset it because it could have been set by some other remediation
ARCH=""
FULL_RULE="-a always,exit -F path=/usr/bin/umount -F auid&gt;=1000 -F auid!=unset -F key=privileged"
# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_fix_audit_syscall_rule" use="legacy"/>
fix_audit_syscall_rule "auditctl" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
fix_audit_syscall_rule "augenrules" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_privileged_commands_umount" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Search /etc/audit/rules.d for audit rule entries
  find:
    paths: /etc/audit/rules.d
    recurse: false
    contains: ^.*path=/usr/bin/umount.*$
    patterns: '*.rules'
  register: find_umount
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_umount
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Use /etc/audit/rules.d/privileged.rules as the recipient for the rule
  set_fact:
    all_files:
      - /etc/audit/rules.d/privileged.rules
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_umount.matched is defined and find_umount.matched == 0
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_umount
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
      - '{{ find_umount.files | map(attribute=''path'') | list | first }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_umount.matched is defined and find_umount.matched &gt; 0
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_umount
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Inserts/replaces the umount rule in rules.d
  lineinfile:
    path: '{{ all_files[0] }}'
    line: -a always,exit -F path=/usr/bin/umount -F auid&gt;=1000 -F auid!=unset -F key=privileged
    create: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_umount
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Inserts/replaces the umount rule in audit.rules
  lineinfile:
    path: /etc/audit/audit.rules
    line: -a always,exit -F path=/usr/bin/umount -F auid&gt;=1000 -F auid!=unset -F key=privileged
    create: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_umount
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_privileged_commands_umount:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-audit_rules_privileged_commands_umount_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_newgrp" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure auditd Collects Information on the Use of Privileged Commands - newgrp</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">At a minimum, the audit system should collect the execution of
privileged commands for all users and root. If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is
configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program to read audit rules during
daemon startup (the default), add a line of the following form to a file with
suffix <html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F path=/usr/bin/newgrp -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre>
If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add a line of the following
form to <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F path=/usr/bin/newgrp -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre></description>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000135</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-2(4)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
            <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</reference>
            <reference href="">SRG-OS-000471-VMM-001910</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.2.6.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.7.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.7</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.15.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.15.2.2</reference>
            <reference href="https://www.cisecurity.org/controls/">1</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">13</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">2</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">5</reference>
            <reference href="https://www.cisecurity.org/controls/">6</reference>
            <reference href="https://www.cisecurity.org/controls/">7</reference>
            <reference href="https://www.cisecurity.org/controls/">8</reference>
            <reference href="https://www.cisecurity.org/controls/">9</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Misuse of privileged functions, either intentionally or unintentionally by
authorized users, or by unauthorized external entities that have compromised system accounts,
is a serious and ongoing concern and can have significant adverse impacts on organizations.
Auditing the use of privileged functions is one way to detect such misuse and identify
the risk from insider and advanced persistent threats.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Privileged programs are subject to escalation-of-privilege attacks,
which attempt to subvert their normal role of providing some necessary but
limited capability. As such, motivation exists to monitor these programs for
unusual activity.</rationale>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_privileged_commands_newgrp" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then



PATTERN="-a always,exit -F path=/usr/bin/newgrp\\s\\+.*"
GROUP="privileged"
# Although the fix doesn't use ARCH, we reset it because it could have been set by some other remediation
ARCH=""
FULL_RULE="-a always,exit -F path=/usr/bin/newgrp -F auid&gt;=1000 -F auid!=unset -F key=privileged"
# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_fix_audit_syscall_rule" use="legacy"/>
fix_audit_syscall_rule "auditctl" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
fix_audit_syscall_rule "augenrules" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_privileged_commands_newgrp" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Search /etc/audit/rules.d for audit rule entries
  find:
    paths: /etc/audit/rules.d
    recurse: false
    contains: ^.*path=/usr/bin/newgrp.*$
    patterns: '*.rules'
  register: find_newgrp
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_newgrp
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Use /etc/audit/rules.d/privileged.rules as the recipient for the rule
  set_fact:
    all_files:
      - /etc/audit/rules.d/privileged.rules
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_newgrp.matched is defined and find_newgrp.matched == 0
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_newgrp
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
      - '{{ find_newgrp.files | map(attribute=''path'') | list | first }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_newgrp.matched is defined and find_newgrp.matched &gt; 0
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_newgrp
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Inserts/replaces the newgrp rule in rules.d
  lineinfile:
    path: '{{ all_files[0] }}'
    line: -a always,exit -F path=/usr/bin/newgrp -F auid&gt;=1000 -F auid!=unset -F key=privileged
    create: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_newgrp
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Inserts/replaces the newgrp rule in audit.rules
  lineinfile:
    path: /etc/audit/audit.rules
    line: -a always,exit -F path=/usr/bin/newgrp -F auid&gt;=1000 -F auid!=unset -F key=privileged
    create: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_newgrp
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_privileged_commands_newgrp:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-audit_rules_privileged_commands_newgrp_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_chage" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure auditd Collects Information on the Use of Privileged Commands - chage</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">At a minimum, the audit system should collect the execution of
privileged commands for all users and root. If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is
configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program to read audit rules during
daemon startup (the default), add a line of the following form to a file with
suffix <html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F path=/usr/bin/chage -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre>
If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add a line of the following
form to <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F path=/usr/bin/chage -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre></description>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000135</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-2(4)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</reference>
            <reference href="">SRG-OS-000471-VMM-001910</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.2.6.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.7.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.7</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.15.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.15.2.2</reference>
            <reference href="https://www.cisecurity.org/controls/">1</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">13</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">2</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">5</reference>
            <reference href="https://www.cisecurity.org/controls/">6</reference>
            <reference href="https://www.cisecurity.org/controls/">7</reference>
            <reference href="https://www.cisecurity.org/controls/">8</reference>
            <reference href="https://www.cisecurity.org/controls/">9</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Misuse of privileged functions, either intentionally or unintentionally by
authorized users, or by unauthorized external entities that have compromised system accounts,
is a serious and ongoing concern and can have significant adverse impacts on organizations.
Auditing the use of privileged functions is one way to detect such misuse and identify
the risk from insider and advanced persistent threats.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Privileged programs are subject to escalation-of-privilege attacks,
which attempt to subvert their normal role of providing some necessary but
limited capability. As such, motivation exists to monitor these programs for
unusual activity.</rationale>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_privileged_commands_chage" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then



PATTERN="-a always,exit -F path=/usr/bin/chage\\s\\+.*"
GROUP="privileged"
# Although the fix doesn't use ARCH, we reset it because it could have been set by some other remediation
ARCH=""
FULL_RULE="-a always,exit -F path=/usr/bin/chage -F auid&gt;=1000 -F auid!=unset -F key=privileged"
# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_fix_audit_syscall_rule" use="legacy"/>
fix_audit_syscall_rule "auditctl" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
fix_audit_syscall_rule "augenrules" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_privileged_commands_chage" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Search /etc/audit/rules.d for audit rule entries
  find:
    paths: /etc/audit/rules.d
    recurse: false
    contains: ^.*path=/usr/bin/chage.*$
    patterns: '*.rules'
  register: find_chage
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_chage
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Use /etc/audit/rules.d/privileged.rules as the recipient for the rule
  set_fact:
    all_files:
      - /etc/audit/rules.d/privileged.rules
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_chage.matched is defined and find_chage.matched == 0
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_chage
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
      - '{{ find_chage.files | map(attribute=''path'') | list | first }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_chage.matched is defined and find_chage.matched &gt; 0
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_chage
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Inserts/replaces the chage rule in rules.d
  lineinfile:
    path: '{{ all_files[0] }}'
    line: -a always,exit -F path=/usr/bin/chage -F auid&gt;=1000 -F auid!=unset -F key=privileged
    create: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_chage
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Inserts/replaces the chage rule in audit.rules
  lineinfile:
    path: /etc/audit/audit.rules
    line: -a always,exit -F path=/usr/bin/chage -F auid&gt;=1000 -F auid!=unset -F key=privileged
    create: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_chage
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_privileged_commands_chage:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-audit_rules_privileged_commands_chage_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_gpasswd" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure auditd Collects Information on the Use of Privileged Commands - gpasswd</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">At a minimum, the audit system should collect the execution of
privileged commands for all users and root. If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is
configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program to read audit rules during
daemon startup (the default), add a line of the following form to a file with
suffix <html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F path=/usr/bin/gpasswd -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre>
If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add a line of the following
form to <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F path=/usr/bin/gpasswd -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre></description>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000135</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-2(4)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
            <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</reference>
            <reference href="">SRG-OS-000471-VMM-001910</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.2.6.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.7.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.7</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.15.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.15.2.2</reference>
            <reference href="https://www.cisecurity.org/controls/">1</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">13</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">2</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">5</reference>
            <reference href="https://www.cisecurity.org/controls/">6</reference>
            <reference href="https://www.cisecurity.org/controls/">7</reference>
            <reference href="https://www.cisecurity.org/controls/">8</reference>
            <reference href="https://www.cisecurity.org/controls/">9</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Misuse of privileged functions, either intentionally or unintentionally by
authorized users, or by unauthorized external entities that have compromised system accounts,
is a serious and ongoing concern and can have significant adverse impacts on organizations.
Auditing the use of privileged functions is one way to detect such misuse and identify
the risk from insider and advanced persistent threats.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Privileged programs are subject to escalation-of-privilege attacks,
which attempt to subvert their normal role of providing some necessary but
limited capability. As such, motivation exists to monitor these programs for
unusual activity.</rationale>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_privileged_commands_gpasswd" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then



PATTERN="-a always,exit -F path=/usr/bin/gpasswd\\s\\+.*"
GROUP="privileged"
# Although the fix doesn't use ARCH, we reset it because it could have been set by some other remediation
ARCH=""
FULL_RULE="-a always,exit -F path=/usr/bin/gpasswd -F auid&gt;=1000 -F auid!=unset -F key=privileged"
# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_fix_audit_syscall_rule" use="legacy"/>
fix_audit_syscall_rule "auditctl" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
fix_audit_syscall_rule "augenrules" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_privileged_commands_gpasswd" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Search /etc/audit/rules.d for audit rule entries
  find:
    paths: /etc/audit/rules.d
    recurse: false
    contains: ^.*path=/usr/bin/gpasswd.*$
    patterns: '*.rules'
  register: find_gpasswd
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_gpasswd
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Use /etc/audit/rules.d/privileged.rules as the recipient for the rule
  set_fact:
    all_files:
      - /etc/audit/rules.d/privileged.rules
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_gpasswd.matched is defined and find_gpasswd.matched == 0
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_gpasswd
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
      - '{{ find_gpasswd.files | map(attribute=''path'') | list | first }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_gpasswd.matched is defined and find_gpasswd.matched &gt; 0
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_gpasswd
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Inserts/replaces the gpasswd rule in rules.d
  lineinfile:
    path: '{{ all_files[0] }}'
    line: -a always,exit -F path=/usr/bin/gpasswd -F auid&gt;=1000 -F auid!=unset -F
      key=privileged
    create: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_gpasswd
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Inserts/replaces the gpasswd rule in audit.rules
  lineinfile:
    path: /etc/audit/audit.rules
    line: -a always,exit -F path=/usr/bin/gpasswd -F auid&gt;=1000 -F auid!=unset -F
      key=privileged
    create: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_gpasswd
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_privileged_commands_gpasswd:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-audit_rules_privileged_commands_gpasswd_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_chsh" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure auditd Collects Information on the Use of Privileged Commands - chsh</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">At a minimum, the audit system should collect the execution of
privileged commands for all users and root. If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is
configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program to read audit rules during
daemon startup (the default), add a line of the following form to a file with
suffix <html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F path=/usr/bin/chsh -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre>
If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add a line of the following
form to <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F path=/usr/bin/chsh -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre></description>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000135</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-2(4)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</reference>
            <reference href="">SRG-OS-000471-VMM-001910</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.2.6.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.7.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.7</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.15.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.15.2.2</reference>
            <reference href="https://www.cisecurity.org/controls/">1</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">13</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">2</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">5</reference>
            <reference href="https://www.cisecurity.org/controls/">6</reference>
            <reference href="https://www.cisecurity.org/controls/">7</reference>
            <reference href="https://www.cisecurity.org/controls/">8</reference>
            <reference href="https://www.cisecurity.org/controls/">9</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Misuse of privileged functions, either intentionally or unintentionally by
authorized users, or by unauthorized external entities that have compromised system accounts,
is a serious and ongoing concern and can have significant adverse impacts on organizations.
Auditing the use of privileged functions is one way to detect such misuse and identify
the risk from insider and advanced persistent threats.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Privileged programs are subject to escalation-of-privilege attacks,
which attempt to subvert their normal role of providing some necessary but
limited capability. As such, motivation exists to monitor these programs for
unusual activity.</rationale>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_privileged_commands_chsh" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then



PATTERN="-a always,exit -F path=/usr/bin/chsh\\s\\+.*"
GROUP="privileged"
# Although the fix doesn't use ARCH, we reset it because it could have been set by some other remediation
ARCH=""
FULL_RULE="-a always,exit -F path=/usr/bin/chsh -F auid&gt;=1000 -F auid!=unset -F key=privileged"
# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_fix_audit_syscall_rule" use="legacy"/>
fix_audit_syscall_rule "auditctl" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
fix_audit_syscall_rule "augenrules" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_privileged_commands_chsh" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Search /etc/audit/rules.d for audit rule entries
  find:
    paths: /etc/audit/rules.d
    recurse: false
    contains: ^.*path=/usr/bin/chsh.*$
    patterns: '*.rules'
  register: find_chsh
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_chsh
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Use /etc/audit/rules.d/privileged.rules as the recipient for the rule
  set_fact:
    all_files:
      - /etc/audit/rules.d/privileged.rules
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_chsh.matched is defined and find_chsh.matched == 0
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_chsh
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
      - '{{ find_chsh.files | map(attribute=''path'') | list | first }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_chsh.matched is defined and find_chsh.matched &gt; 0
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_chsh
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Inserts/replaces the chsh rule in rules.d
  lineinfile:
    path: '{{ all_files[0] }}'
    line: -a always,exit -F path=/usr/bin/chsh -F auid&gt;=1000 -F auid!=unset -F key=privileged
    create: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_chsh
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Inserts/replaces the chsh rule in audit.rules
  lineinfile:
    path: /etc/audit/audit.rules
    line: -a always,exit -F path=/usr/bin/chsh -F auid&gt;=1000 -F auid!=unset -F key=privileged
    create: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_chsh
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_privileged_commands_chsh:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-audit_rules_privileged_commands_chsh_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_pt_chown" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure auditd Collects Information on the Use of Privileged Commands - pt_chown</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">At a minimum, the audit system should collect the execution of
privileged commands for all users and root. If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is
configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program to read audit rules during
daemon startup (the default), add a line of the following form to a file with
suffix <html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F path=/usr/libexec/pt_chown -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre>
If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add a line of the following
form to <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F path=/usr/libexec/pt_chown -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre></description>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000135</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</reference>
            <reference href="">SRG-OS-000471-VMM-001910</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.2.6.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.7.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.7</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.15.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.15.2.2</reference>
            <reference href="https://www.cisecurity.org/controls/">1</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">13</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">2</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">5</reference>
            <reference href="https://www.cisecurity.org/controls/">6</reference>
            <reference href="https://www.cisecurity.org/controls/">7</reference>
            <reference href="https://www.cisecurity.org/controls/">8</reference>
            <reference href="https://www.cisecurity.org/controls/">9</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Misuse of privileged functions, either intentionally or unintentionally by
authorized users, or by unauthorized external entities that have compromised system accounts,
is a serious and ongoing concern and can have significant adverse impacts on organizations.
Auditing the use of privileged functions is one way to detect such misuse and identify
the risk from insider and advanced persistent threats.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Privileged programs are subject to escalation-of-privilege attacks,
which attempt to subvert their normal role of providing some necessary but
limited capability. As such, motivation exists to monitor these programs for
unusual activity.</rationale>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_privileged_commands_pt_chown" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then



PATTERN="-a always,exit -F path=/usr/libexec/pt_chown\\s\\+.*"
GROUP="privileged"
# Although the fix doesn't use ARCH, we reset it because it could have been set by some other remediation
ARCH=""
FULL_RULE="-a always,exit -F path=/usr/libexec/pt_chown -F auid&gt;=1000 -F auid!=unset -F key=privileged"
# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_fix_audit_syscall_rule" use="legacy"/>
fix_audit_syscall_rule "auditctl" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
fix_audit_syscall_rule "augenrules" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_privileged_commands_pt_chown" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Search /etc/audit/rules.d for audit rule entries
  find:
    paths: /etc/audit/rules.d
    recurse: false
    contains: ^.*path=/usr/libexec/pt_chown.*$
    patterns: '*.rules'
  register: find_pt_chown
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_pt_chown
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Use /etc/audit/rules.d/privileged.rules as the recipient for the rule
  set_fact:
    all_files:
      - /etc/audit/rules.d/privileged.rules
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_pt_chown.matched is defined and find_pt_chown.matched == 0
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_pt_chown
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
      - '{{ find_pt_chown.files | map(attribute=''path'') | list | first }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_pt_chown.matched is defined and find_pt_chown.matched &gt; 0
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_pt_chown
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Inserts/replaces the pt_chown rule in rules.d
  lineinfile:
    path: '{{ all_files[0] }}'
    line: -a always,exit -F path=/usr/libexec/pt_chown -F auid&gt;=1000 -F auid!=unset
      -F key=privileged
    create: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_pt_chown
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Inserts/replaces the pt_chown rule in audit.rules
  lineinfile:
    path: /etc/audit/audit.rules
    line: -a always,exit -F path=/usr/libexec/pt_chown -F auid&gt;=1000 -F auid!=unset
      -F key=privileged
    create: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_pt_chown
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_privileged_commands_pt_chown:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-audit_rules_privileged_commands_pt_chown_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_newuidmap" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure auditd Collects Information on the Use of Privileged Commands - newuidmap</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">At a minimum, the audit system should collect the execution of
privileged commands for all users and root. If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is
configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program to read audit rules during
daemon startup (the default), add a line of the following form to a file with
suffix <html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F path=/usr/bin/newuidmap -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre>
If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add a line of the following
form to <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F path=/usr/bin/newuidmap -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre></description>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-2(4)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</reference>
            <reference href="">SRG-OS-000471-VMM-001910</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Misuse of privileged functions, either intentionally or unintentionally by
authorized users, or by unauthorized external entities that have compromised system accounts,
is a serious and ongoing concern and can have significant adverse impacts on organizations.
Auditing the use of privileged functions is one way to detect such misuse and identify
the risk from insider and advanced persistent threats.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Privileged programs are subject to escalation-of-privilege attacks,
which attempt to subvert their normal role of providing some necessary but
limited capability. As such, motivation exists to monitor these programs for
unusual activity.</rationale>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_privileged_commands_newuidmap" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then



PATTERN="-a always,exit -F path=/usr/bin/newuidmap\\s\\+.*"
GROUP="privileged"
# Although the fix doesn't use ARCH, we reset it because it could have been set by some other remediation
ARCH=""
FULL_RULE="-a always,exit -F path=/usr/bin/newuidmap -F auid&gt;=1000 -F auid!=unset -F key=privileged"
# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_fix_audit_syscall_rule" use="legacy"/>
fix_audit_syscall_rule "auditctl" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
fix_audit_syscall_rule "augenrules" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_privileged_commands_newuidmap" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Search /etc/audit/rules.d for audit rule entries
  find:
    paths: /etc/audit/rules.d
    recurse: false
    contains: ^.*path=/usr/bin/newuidmap.*$
    patterns: '*.rules'
  register: find_newuidmap
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_newuidmap
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Use /etc/audit/rules.d/privileged.rules as the recipient for the rule
  set_fact:
    all_files:
      - /etc/audit/rules.d/privileged.rules
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_newuidmap.matched is defined and find_newuidmap.matched == 0
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_newuidmap
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
      - '{{ find_newuidmap.files | map(attribute=''path'') | list | first }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_newuidmap.matched is defined and find_newuidmap.matched &gt; 0
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_newuidmap
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Inserts/replaces the newuidmap rule in rules.d
  lineinfile:
    path: '{{ all_files[0] }}'
    line: -a always,exit -F path=/usr/bin/newuidmap -F auid&gt;=1000 -F auid!=unset -F
      key=privileged
    create: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_newuidmap
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Inserts/replaces the newuidmap rule in audit.rules
  lineinfile:
    path: /etc/audit/audit.rules
    line: -a always,exit -F path=/usr/bin/newuidmap -F auid&gt;=1000 -F auid!=unset -F
      key=privileged
    create: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_newuidmap
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_privileged_commands_newuidmap:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-audit_rules_privileged_commands_newuidmap_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure auditd Collects Information on the Use of Privileged Commands</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The audit system should collect information about usage of privileged
commands for all users and root. To find the relevant setuid /
setgid programs, run the following command for each local partition
<html:i xmlns:html="http://www.w3.org/1999/xhtml">PART</html:i>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo find <html:i>PART</html:i> -xdev -type f -perm -4000 -o -type f -perm -2000 2&gt;/dev/null</html:pre>
If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code>
program to read audit rules during daemon startup (the default), add a line of
the following form to a file with suffix <html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the directory
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code> for each setuid / setgid program on the system,
replacing the <html:i xmlns:html="http://www.w3.org/1999/xhtml">SETUID_PROG_PATH</html:i> part with the full path of that setuid /
setgid program in the list:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F path=<html:i>SETUID_PROG_PATH</html:i> -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre>
If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add a line of the following
form to <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> for each setuid / setgid program on the
system, replacing the <html:i xmlns:html="http://www.w3.org/1999/xhtml">SETUID_PROG_PATH</html:i> part with the full path of that
setuid / setgid program in the list:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F path=<html:i>SETUID_PROG_PATH</html:i> -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre></description>
            <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">This rule checks for multiple syscalls related to privileged commands;
it was written with DISA STIG in mind. Other policies should use a
separate rule for each syscall that needs to be checked. For example:
<html:ul xmlns:html="http://www.w3.org/1999/xhtml"><html:li><html:code>audit_rules_privileged_commands_su</html:code></html:li><html:li><html:code>audit_rules_privileged_commands_umount</html:code></html:li><html:li><html:code>audit_rules_privileged_commands_passwd</html:code></html:li></html:ul></warning>
            <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-002234</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-2(4)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-2</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.DP-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.CO-2</reference>
            <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.2.2</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000327-GPOS-00127</reference>
            <reference href="">SRG-OS-000471-VMM-001910</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.2.6.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO08.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO12.06</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI08.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS02.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS02.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS02.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS02.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.2.6</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.7.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.7</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.15.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.15.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.5</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.7</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.1.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.2.2</reference>
            <reference href="https://www.cisecurity.org/controls/">1</reference>
            <reference href="https://www.cisecurity.org/controls/">11</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">13</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">19</reference>
            <reference href="https://www.cisecurity.org/controls/">2</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">4</reference>
            <reference href="https://www.cisecurity.org/controls/">5</reference>
            <reference href="https://www.cisecurity.org/controls/">6</reference>
            <reference href="https://www.cisecurity.org/controls/">7</reference>
            <reference href="https://www.cisecurity.org/controls/">8</reference>
            <reference href="https://www.cisecurity.org/controls/">9</reference>
            <reference href="">0582</reference>
            <reference href="">0584</reference>
            <reference href="">05885</reference>
            <reference href="">0586</reference>
            <reference href="">0846</reference>
            <reference href="">0957</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Misuse of privileged functions, either intentionally or unintentionally by
authorized users, or by unauthorized external entities that have compromised system accounts,
is a serious and ongoing concern and can have significant adverse impacts on organizations.
Auditing the use of privileged functions is one way to detect such misuse and identify
the risk from insider and advanced persistent threats.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Privileged programs are subject to escalation-of-privilege attacks,
which attempt to subvert their normal role of providing some necessary but
limited capability. As such, motivation exists to monitor these programs for
unusual activity.</rationale>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_privileged_commands" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then



# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_perform_audit_rules_privileged_commands_remediation" use="legacy"/>
perform_audit_rules_privileged_commands_remediation "auditctl" "1000"
perform_audit_rules_privileged_commands_remediation "augenrules" "1000"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_privileged_commands" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Search for privileged commands
  shell: |
    set -o pipefail
    find / -not \( -fstype afs -o -fstype ceph -o -fstype cifs -o -fstype smb3 -o -fstype smbfs -o -fstype sshfs -o -fstype ncpfs -o -fstype ncp -o -fstype nfs -o -fstype nfs4 -o -fstype gfs -o -fstype gfs2 -o -fstype glusterfs -o -fstype gpfs -o -fstype pvfs2 -o -fstype ocfs2 -o -fstype lustre -o -fstype davfs -o -fstype fuse.sshfs \) -type f \( -perm -4000 -o -perm -2000 \) 2&gt; /dev/null
  args:
    warn: false
    executable: /bin/bash
  check_mode: false
  register: find_result
  changed_when: false
  failed_when: false
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.2
    - audit_rules_privileged_commands
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Search /etc/audit/rules.d for audit rule entries
  find:
    paths: /etc/audit/rules.d
    recurse: false
    contains: ^.*path={{ item }} .*$
    patterns: '*.rules'
  with_items:
    - '{{ find_result.stdout_lines }}'
  register: files_result
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.2
    - audit_rules_privileged_commands
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Overwrites the rule in rules.d
  lineinfile:
    path: '{{ item.1.path }}'
    line: -a always,exit -F path={{ item.0.item }} -F auid&gt;=1000 -F auid!=unset -F
      key=privileged
    create: false
    regexp: ^.*path={{ item.0.item }} .*$
  with_subelements:
    - '{{ files_result.results }}'
    - files
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.2
    - audit_rules_privileged_commands
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Adds the rule in rules.d
  lineinfile:
    path: /etc/audit/rules.d/privileged.rules
    line: -a always,exit -F path={{ item.item }} -F auid&gt;=1000 -F auid!=unset -F key=privileged
    create: true
  with_items:
    - '{{ files_result.results }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - files_result.results is defined and item.matched == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.2
    - audit_rules_privileged_commands
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Inserts/replaces the rule in audit.rules
  lineinfile:
    path: /etc/audit/audit.rules
    line: -a always,exit -F path={{ item.item }} -F auid&gt;=1000 -F auid!=unset -F key=privileged
    create: true
    regexp: ^.*path={{ item.item }} .*$
  with_items:
    - '{{ files_result.results }}'
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.2
    - audit_rules_privileged_commands
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_privileged_commands:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-audit_rules_privileged_commands_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_sudo" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure auditd Collects Information on the Use of Privileged Commands - sudo</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">At a minimum, the audit system should collect the execution of
privileged commands for all users and root. If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is
configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program to read audit rules during
daemon startup (the default), add a line of the following form to a file with
suffix <html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F path=/usr/bin/sudo -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre>
If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add a line of the following
form to <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F path=/usr/bin/sudo -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre></description>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000135</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
            <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</reference>
            <reference href="">SRG-OS-000471-VMM-001910</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.2.6.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.7.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.7</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.15.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.15.2.2</reference>
            <reference href="https://www.cisecurity.org/controls/">1</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">13</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">2</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">5</reference>
            <reference href="https://www.cisecurity.org/controls/">6</reference>
            <reference href="https://www.cisecurity.org/controls/">7</reference>
            <reference href="https://www.cisecurity.org/controls/">8</reference>
            <reference href="https://www.cisecurity.org/controls/">9</reference>
            <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R19)</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Misuse of privileged functions, either intentionally or unintentionally by
authorized users, or by unauthorized external entities that have compromised system accounts,
is a serious and ongoing concern and can have significant adverse impacts on organizations.
Auditing the use of privileged functions is one way to detect such misuse and identify
the risk from insider and advanced persistent threats.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Privileged programs are subject to escalation-of-privilege attacks,
which attempt to subvert their normal role of providing some necessary but
limited capability. As such, motivation exists to monitor these programs for
unusual activity.</rationale>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_privileged_commands_sudo" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then



PATTERN="-a always,exit -F path=/usr/bin/sudo\\s\\+.*"
GROUP="privileged"
# Although the fix doesn't use ARCH, we reset it because it could have been set by some other remediation
ARCH=""
FULL_RULE="-a always,exit -F path=/usr/bin/sudo -F auid&gt;=1000 -F auid!=unset -F key=privileged"
# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_fix_audit_syscall_rule" use="legacy"/>
fix_audit_syscall_rule "auditctl" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
fix_audit_syscall_rule "augenrules" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_privileged_commands_sudo" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Search /etc/audit/rules.d for audit rule entries
  find:
    paths: /etc/audit/rules.d
    recurse: false
    contains: ^.*path=/usr/bin/sudo.*$
    patterns: '*.rules'
  register: find_sudo
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_sudo
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Use /etc/audit/rules.d/privileged.rules as the recipient for the rule
  set_fact:
    all_files:
      - /etc/audit/rules.d/privileged.rules
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_sudo.matched is defined and find_sudo.matched == 0
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_sudo
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
      - '{{ find_sudo.files | map(attribute=''path'') | list | first }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_sudo.matched is defined and find_sudo.matched &gt; 0
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_sudo
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Inserts/replaces the sudo rule in rules.d
  lineinfile:
    path: '{{ all_files[0] }}'
    line: -a always,exit -F path=/usr/bin/sudo -F auid&gt;=1000 -F auid!=unset -F key=privileged
    create: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_sudo
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Inserts/replaces the sudo rule in audit.rules
  lineinfile:
    path: /etc/audit/audit.rules
    line: -a always,exit -F path=/usr/bin/sudo -F auid&gt;=1000 -F auid!=unset -F key=privileged
    create: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_sudo
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_privileged_commands_sudo:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-audit_rules_privileged_commands_sudo_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_at" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure auditd Collects Information on the Use of Privileged Commands - at</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">At a minimum, the audit system should collect the execution of
privileged commands for all users and root. If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is
configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program to read audit rules during
daemon startup (the default), add a line of the following form to a file with
suffix <html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F path=/usr/bin/at -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre>
If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add a line of the following
form to <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F path=/usr/bin/at -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre></description>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</reference>
            <reference href="">SRG-OS-000471-VMM-001910</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Misuse of privileged functions, either intentionally or unintentionally by
authorized users, or by unauthorized external entities that have compromised system accounts,
is a serious and ongoing concern and can have significant adverse impacts on organizations.
Auditing the use of privileged functions is one way to detect such misuse and identify
the risk from insider and advanced persistent threats.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Privileged programs are subject to escalation-of-privilege attacks,
which attempt to subvert their normal role of providing some necessary but
limited capability. As such, motivation exists to monitor these programs for
unusual activity.</rationale>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_privileged_commands_at" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then



PATTERN="-a always,exit -F path=/usr/bin/at\\s\\+.*"
GROUP="privileged"
# Although the fix doesn't use ARCH, we reset it because it could have been set by some other remediation
ARCH=""
FULL_RULE="-a always,exit -F path=/usr/bin/at -F auid&gt;=1000 -F auid!=unset -F key=privileged"
# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_fix_audit_syscall_rule" use="legacy"/>
fix_audit_syscall_rule "auditctl" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
fix_audit_syscall_rule "augenrules" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_privileged_commands_at" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Search /etc/audit/rules.d for audit rule entries
  find:
    paths: /etc/audit/rules.d
    recurse: false
    contains: ^.*path=/usr/bin/at.*$
    patterns: '*.rules'
  register: find_at
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_at
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Use /etc/audit/rules.d/privileged.rules as the recipient for the rule
  set_fact:
    all_files:
      - /etc/audit/rules.d/privileged.rules
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_at.matched is defined and find_at.matched == 0
  tags:
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_at
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
      - '{{ find_at.files | map(attribute=''path'') | list | first }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_at.matched is defined and find_at.matched &gt; 0
  tags:
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_at
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Inserts/replaces the at rule in rules.d
  lineinfile:
    path: '{{ all_files[0] }}'
    line: -a always,exit -F path=/usr/bin/at -F auid&gt;=1000 -F auid!=unset -F key=privileged
    create: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_at
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Inserts/replaces the at rule in audit.rules
  lineinfile:
    path: /etc/audit/audit.rules
    line: -a always,exit -F path=/usr/bin/at -F auid&gt;=1000 -F auid!=unset -F key=privileged
    create: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_at
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_privileged_commands_at:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-audit_rules_privileged_commands_at_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_userhelper" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure auditd Collects Information on the Use of Privileged Commands - userhelper</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">At a minimum, the audit system should collect the execution of
privileged commands for all users and root. If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is
configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program to read audit rules during
daemon startup (the default), add a line of the following form to a file with
suffix <html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F path=/usr/sbin/userhelper -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre>
If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add a line of the following
form to <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F path=/usr/sbin/userhelper -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre></description>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000135</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
            <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</reference>
            <reference href="">SRG-OS-000471-VMM-001910</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.2.6.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.7.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.7</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.15.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.15.2.2</reference>
            <reference href="https://www.cisecurity.org/controls/">1</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">13</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">2</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">5</reference>
            <reference href="https://www.cisecurity.org/controls/">6</reference>
            <reference href="https://www.cisecurity.org/controls/">7</reference>
            <reference href="https://www.cisecurity.org/controls/">8</reference>
            <reference href="https://www.cisecurity.org/controls/">9</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Misuse of privileged functions, either intentionally or unintentionally by
authorized users, or by unauthorized external entities that have compromised system accounts,
is a serious and ongoing concern and can have significant adverse impacts on organizations.
Auditing the use of privileged functions is one way to detect such misuse and identify
the risk from insider and advanced persistent threats.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Privileged programs are subject to escalation-of-privilege attacks,
which attempt to subvert their normal role of providing some necessary but
limited capability. As such, motivation exists to monitor these programs for
unusual activity.</rationale>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_privileged_commands_userhelper" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then



PATTERN="-a always,exit -F path=/usr/sbin/userhelper\\s\\+.*"
GROUP="privileged"
# Although the fix doesn't use ARCH, we reset it because it could have been set by some other remediation
ARCH=""
FULL_RULE="-a always,exit -F path=/usr/sbin/userhelper -F auid&gt;=1000 -F auid!=unset -F key=privileged"
# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_fix_audit_syscall_rule" use="legacy"/>
fix_audit_syscall_rule "auditctl" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
fix_audit_syscall_rule "augenrules" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_privileged_commands_userhelper" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Search /etc/audit/rules.d for audit rule entries
  find:
    paths: /etc/audit/rules.d
    recurse: false
    contains: ^.*path=/usr/sbin/userhelper.*$
    patterns: '*.rules'
  register: find_userhelper
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_userhelper
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Use /etc/audit/rules.d/privileged.rules as the recipient for the rule
  set_fact:
    all_files:
      - /etc/audit/rules.d/privileged.rules
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_userhelper.matched is defined and find_userhelper.matched == 0
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_userhelper
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
      - '{{ find_userhelper.files | map(attribute=''path'') | list | first }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_userhelper.matched is defined and find_userhelper.matched &gt; 0
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_userhelper
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Inserts/replaces the userhelper rule in rules.d
  lineinfile:
    path: '{{ all_files[0] }}'
    line: -a always,exit -F path=/usr/sbin/userhelper -F auid&gt;=1000 -F auid!=unset
      -F key=privileged
    create: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_userhelper
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Inserts/replaces the userhelper rule in audit.rules
  lineinfile:
    path: /etc/audit/audit.rules
    line: -a always,exit -F path=/usr/sbin/userhelper -F auid&gt;=1000 -F auid!=unset
      -F key=privileged
    create: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_userhelper
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_privileged_commands_userhelper:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-audit_rules_privileged_commands_userhelper_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_passwd" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure auditd Collects Information on the Use of Privileged Commands - passwd</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">At a minimum, the audit system should collect the execution of
privileged commands for all users and root. If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is
configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program to read audit rules during
daemon startup (the default), add a line of the following form to a file with
suffix <html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F path=/usr/bin/passwd -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre>
If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add a line of the following
form to <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F path=/usr/bin/passwd -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre></description>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000135</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-2(4)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
            <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</reference>
            <reference href="">SRG-OS-000471-VMM-001910</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.2.6.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.7.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.7</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.15.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.15.2.2</reference>
            <reference href="https://www.cisecurity.org/controls/">1</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">13</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">2</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">5</reference>
            <reference href="https://www.cisecurity.org/controls/">6</reference>
            <reference href="https://www.cisecurity.org/controls/">7</reference>
            <reference href="https://www.cisecurity.org/controls/">8</reference>
            <reference href="https://www.cisecurity.org/controls/">9</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Misuse of privileged functions, either intentionally or unintentionally by
authorized users, or by unauthorized external entities that have compromised system accounts,
is a serious and ongoing concern and can have significant adverse impacts on organizations.
Auditing the use of privileged functions is one way to detect such misuse and identify
the risk from insider and advanced persistent threats.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Privileged programs are subject to escalation-of-privilege attacks,
which attempt to subvert their normal role of providing some necessary but
limited capability. As such, motivation exists to monitor these programs for
unusual activity.</rationale>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_privileged_commands_passwd" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then



PATTERN="-a always,exit -F path=/usr/bin/passwd\\s\\+.*"
GROUP="privileged"
# Although the fix doesn't use ARCH, we reset it because it could have been set by some other remediation
ARCH=""
FULL_RULE="-a always,exit -F path=/usr/bin/passwd -F auid&gt;=1000 -F auid!=unset -F key=privileged"
# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_fix_audit_syscall_rule" use="legacy"/>
fix_audit_syscall_rule "auditctl" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
fix_audit_syscall_rule "augenrules" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_privileged_commands_passwd" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Search /etc/audit/rules.d for audit rule entries
  find:
    paths: /etc/audit/rules.d
    recurse: false
    contains: ^.*path=/usr/bin/passwd.*$
    patterns: '*.rules'
  register: find_passwd
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_passwd
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Use /etc/audit/rules.d/privileged.rules as the recipient for the rule
  set_fact:
    all_files:
      - /etc/audit/rules.d/privileged.rules
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_passwd.matched is defined and find_passwd.matched == 0
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_passwd
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
      - '{{ find_passwd.files | map(attribute=''path'') | list | first }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_passwd.matched is defined and find_passwd.matched &gt; 0
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_passwd
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Inserts/replaces the passwd rule in rules.d
  lineinfile:
    path: '{{ all_files[0] }}'
    line: -a always,exit -F path=/usr/bin/passwd -F auid&gt;=1000 -F auid!=unset -F key=privileged
    create: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_passwd
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Inserts/replaces the passwd rule in audit.rules
  lineinfile:
    path: /etc/audit/audit.rules
    line: -a always,exit -F path=/usr/bin/passwd -F auid&gt;=1000 -F auid!=unset -F key=privileged
    create: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_passwd
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_privileged_commands_passwd:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-audit_rules_privileged_commands_passwd_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_unix_chkpwd" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">At a minimum, the audit system should collect the execution of
privileged commands for all users and root. If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is
configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program to read audit rules during
daemon startup (the default), add a line of the following form to a file with
suffix <html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F path=/usr/sbin/unix_chkpwd -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre>
If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add a line of the following
form to <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F path=/usr/sbin/unix_chkpwd -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre></description>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000135</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-2(4)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
            <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</reference>
            <reference href="">SRG-OS-000471-VMM-001910</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.2.6.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.7.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.7</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.15.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.15.2.2</reference>
            <reference href="https://www.cisecurity.org/controls/">1</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">13</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">2</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">5</reference>
            <reference href="https://www.cisecurity.org/controls/">6</reference>
            <reference href="https://www.cisecurity.org/controls/">7</reference>
            <reference href="https://www.cisecurity.org/controls/">8</reference>
            <reference href="https://www.cisecurity.org/controls/">9</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Misuse of privileged functions, either intentionally or unintentionally by
authorized users, or by unauthorized external entities that have compromised system accounts,
is a serious and ongoing concern and can have significant adverse impacts on organizations.
Auditing the use of privileged functions is one way to detect such misuse and identify
the risk from insider and advanced persistent threats.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Privileged programs are subject to escalation-of-privilege attacks,
which attempt to subvert their normal role of providing some necessary but
limited capability. As such, motivation exists to monitor these programs for
unusual activity.</rationale>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_privileged_commands_unix_chkpwd" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then



PATTERN="-a always,exit -F path=/usr/sbin/unix_chkpwd\\s\\+.*"
GROUP="privileged"
# Although the fix doesn't use ARCH, we reset it because it could have been set by some other remediation
ARCH=""
FULL_RULE="-a always,exit -F path=/usr/sbin/unix_chkpwd -F auid&gt;=1000 -F auid!=unset -F key=privileged"
# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_fix_audit_syscall_rule" use="legacy"/>
fix_audit_syscall_rule "auditctl" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
fix_audit_syscall_rule "augenrules" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_privileged_commands_unix_chkpwd" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Search /etc/audit/rules.d for audit rule entries
  find:
    paths: /etc/audit/rules.d
    recurse: false
    contains: ^.*path=/usr/sbin/unix_chkpwd.*$
    patterns: '*.rules'
  register: find_unix_chkpwd
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_unix_chkpwd
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Use /etc/audit/rules.d/privileged.rules as the recipient for the rule
  set_fact:
    all_files:
      - /etc/audit/rules.d/privileged.rules
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_unix_chkpwd.matched is defined and find_unix_chkpwd.matched == 0
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_unix_chkpwd
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
      - '{{ find_unix_chkpwd.files | map(attribute=''path'') | list | first }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_unix_chkpwd.matched is defined and find_unix_chkpwd.matched &gt; 0
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_unix_chkpwd
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Inserts/replaces the unix_chkpwd rule in rules.d
  lineinfile:
    path: '{{ all_files[0] }}'
    line: -a always,exit -F path=/usr/sbin/unix_chkpwd -F auid&gt;=1000 -F auid!=unset
      -F key=privileged
    create: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_unix_chkpwd
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Inserts/replaces the unix_chkpwd rule in audit.rules
  lineinfile:
    path: /etc/audit/audit.rules
    line: -a always,exit -F path=/usr/sbin/unix_chkpwd -F auid&gt;=1000 -F auid!=unset
      -F key=privileged
    create: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_unix_chkpwd
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_privileged_commands_unix_chkpwd:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-audit_rules_privileged_commands_unix_chkpwd_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_su" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure auditd Collects Information on the Use of Privileged Commands - su</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">At a minimum, the audit system should collect the execution of
privileged commands for all users and root. If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is
configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program to read audit rules during
daemon startup (the default), add a line of the following form to a file with
suffix <html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F path=/usr/bin/su -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre>
If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add a line of the following
form to <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F path=/usr/bin/su -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre></description>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000135</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
            <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</reference>
            <reference href="">SRG-OS-000471-VMM-001910</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.2.6.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.7.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.7</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.15.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.15.2.2</reference>
            <reference href="https://www.cisecurity.org/controls/">1</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">13</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">2</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">5</reference>
            <reference href="https://www.cisecurity.org/controls/">6</reference>
            <reference href="https://www.cisecurity.org/controls/">7</reference>
            <reference href="https://www.cisecurity.org/controls/">8</reference>
            <reference href="https://www.cisecurity.org/controls/">9</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Misuse of privileged functions, either intentionally or unintentionally by
authorized users, or by unauthorized external entities that have compromised system accounts,
is a serious and ongoing concern and can have significant adverse impacts on organizations.
Auditing the use of privileged functions is one way to detect such misuse and identify
the risk from insider and advanced persistent threats.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Privileged programs are subject to escalation-of-privilege attacks,
which attempt to subvert their normal role of providing some necessary but
limited capability. As such, motivation exists to monitor these programs for
unusual activity.</rationale>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_privileged_commands_su" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then



PATTERN="-a always,exit -F path=/usr/bin/su\\s\\+.*"
GROUP="privileged"
# Although the fix doesn't use ARCH, we reset it because it could have been set by some other remediation
ARCH=""
FULL_RULE="-a always,exit -F path=/usr/bin/su -F auid&gt;=1000 -F auid!=unset -F key=privileged"
# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_fix_audit_syscall_rule" use="legacy"/>
fix_audit_syscall_rule "auditctl" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
fix_audit_syscall_rule "augenrules" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_privileged_commands_su" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Search /etc/audit/rules.d for audit rule entries
  find:
    paths: /etc/audit/rules.d
    recurse: false
    contains: ^.*path=/usr/bin/su.*$
    patterns: '*.rules'
  register: find_su
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_su
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Use /etc/audit/rules.d/privileged.rules as the recipient for the rule
  set_fact:
    all_files:
      - /etc/audit/rules.d/privileged.rules
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_su.matched is defined and find_su.matched == 0
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_su
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
      - '{{ find_su.files | map(attribute=''path'') | list | first }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_su.matched is defined and find_su.matched &gt; 0
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_su
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Inserts/replaces the su rule in rules.d
  lineinfile:
    path: '{{ all_files[0] }}'
    line: -a always,exit -F path=/usr/bin/su -F auid&gt;=1000 -F auid!=unset -F key=privileged
    create: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_su
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Inserts/replaces the su rule in audit.rules
  lineinfile:
    path: /etc/audit/audit.rules
    line: -a always,exit -F path=/usr/bin/su -F auid&gt;=1000 -F auid!=unset -F key=privileged
    create: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_su
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_privileged_commands_su:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-audit_rules_privileged_commands_su_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_usernetctl" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure auditd Collects Information on the Use of Privileged Commands - usernetctl</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">At a minimum, the audit system should collect the execution of
privileged commands for all users and root. If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is
configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program to read audit rules during
daemon startup (the default), add a line of the following form to a file with
suffix <html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F path=/usr/sbin/usernetctl -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre>
If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add a line of the following
form to <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F path=/usr/sbin/usernetctl -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre></description>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-2(4)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</reference>
            <reference href="">SRG-OS-000471-VMM-001910</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Misuse of privileged functions, either intentionally or unintentionally by
authorized users, or by unauthorized external entities that have compromised system accounts,
is a serious and ongoing concern and can have significant adverse impacts on organizations.
Auditing the use of privileged functions is one way to detect such misuse and identify
the risk from insider and advanced persistent threats.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Privileged programs are subject to escalation-of-privilege attacks,
which attempt to subvert their normal role of providing some necessary but
limited capability. As such, motivation exists to monitor these programs for
unusual activity.</rationale>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_privileged_commands_usernetctl" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then



PATTERN="-a always,exit -F path=/usr/sbin/usernetctl\\s\\+.*"
GROUP="privileged"
# Although the fix doesn't use ARCH, we reset it because it could have been set by some other remediation
ARCH=""
FULL_RULE="-a always,exit -F path=/usr/sbin/usernetctl -F auid&gt;=1000 -F auid!=unset -F key=privileged"
# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_fix_audit_syscall_rule" use="legacy"/>
fix_audit_syscall_rule "auditctl" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
fix_audit_syscall_rule "augenrules" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_privileged_commands_usernetctl" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Search /etc/audit/rules.d for audit rule entries
  find:
    paths: /etc/audit/rules.d
    recurse: false
    contains: ^.*path=/usr/sbin/usernetctl.*$
    patterns: '*.rules'
  register: find_usernetctl
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_usernetctl
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Use /etc/audit/rules.d/privileged.rules as the recipient for the rule
  set_fact:
    all_files:
      - /etc/audit/rules.d/privileged.rules
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_usernetctl.matched is defined and find_usernetctl.matched == 0
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_usernetctl
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
      - '{{ find_usernetctl.files | map(attribute=''path'') | list | first }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_usernetctl.matched is defined and find_usernetctl.matched &gt; 0
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_usernetctl
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Inserts/replaces the usernetctl rule in rules.d
  lineinfile:
    path: '{{ all_files[0] }}'
    line: -a always,exit -F path=/usr/sbin/usernetctl -F auid&gt;=1000 -F auid!=unset
      -F key=privileged
    create: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_usernetctl
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Inserts/replaces the usernetctl rule in audit.rules
  lineinfile:
    path: /etc/audit/audit.rules
    line: -a always,exit -F path=/usr/sbin/usernetctl -F auid&gt;=1000 -F auid!=unset
      -F key=privileged
    create: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_usernetctl
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_privileged_commands_usernetctl:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-audit_rules_privileged_commands_usernetctl_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_mount" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure auditd Collects Information on the Use of Privileged Commands - mount</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">At a minimum, the audit system should collect the execution of
privileged commands for all users and root. If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is
configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program to read audit rules during
daemon startup (the default), add a line of the following form to a file with
suffix <html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F path=/usr/bin/mount -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre>
If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add a line of the following
form to <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F path=/usr/bin/mount -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre></description>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000135</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</reference>
            <reference href="">SRG-OS-000471-VMM-001910</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Misuse of privileged functions, either intentionally or unintentionally by
authorized users, or by unauthorized external entities that have compromised system accounts,
is a serious and ongoing concern and can have significant adverse impacts on organizations.
Auditing the use of privileged functions is one way to detect such misuse and identify
the risk from insider and advanced persistent threats.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Privileged programs are subject to escalation-of-privilege attacks,
which attempt to subvert their normal role of providing some necessary but
limited capability. As such, motivation exists to monitor these programs for
unusual activity.</rationale>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_privileged_commands_mount" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then



PATTERN="-a always,exit -F path=/usr/bin/mount\\s\\+.*"
GROUP="privileged"
# Although the fix doesn't use ARCH, we reset it because it could have been set by some other remediation
ARCH=""
FULL_RULE="-a always,exit -F path=/usr/bin/mount -F auid&gt;=1000 -F auid!=unset -F key=privileged"
# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_fix_audit_syscall_rule" use="legacy"/>
fix_audit_syscall_rule "auditctl" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
fix_audit_syscall_rule "augenrules" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_privileged_commands_mount" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Search /etc/audit/rules.d for audit rule entries
  find:
    paths: /etc/audit/rules.d
    recurse: false
    contains: ^.*path=/usr/bin/mount.*$
    patterns: '*.rules'
  register: find_mount
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_mount
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Use /etc/audit/rules.d/privileged.rules as the recipient for the rule
  set_fact:
    all_files:
      - /etc/audit/rules.d/privileged.rules
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_mount.matched is defined and find_mount.matched == 0
  tags:
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_mount
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
      - '{{ find_mount.files | map(attribute=''path'') | list | first }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_mount.matched is defined and find_mount.matched &gt; 0
  tags:
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_mount
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Inserts/replaces the mount rule in rules.d
  lineinfile:
    path: '{{ all_files[0] }}'
    line: -a always,exit -F path=/usr/bin/mount -F auid&gt;=1000 -F auid!=unset -F key=privileged
    create: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_mount
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Inserts/replaces the mount rule in audit.rules
  lineinfile:
    path: /etc/audit/audit.rules
    line: -a always,exit -F path=/usr/bin/mount -F auid&gt;=1000 -F auid!=unset -F key=privileged
    create: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_mount
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_privileged_commands_mount:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-audit_rules_privileged_commands_mount_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
        </Group>
        <Group id="xccdf_org.ssgproject.content_group_audit_execution_acl_commands">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record Execution Attempts to Run ACL Privileged Commands</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">At a minimum, the audit system should collect the execution of
ACL privileged commands for all users and root.</description>
          <platform idref="cpe:/a:machine"/>
        </Group>
        <Group id="xccdf_org.ssgproject.content_group_audit_kernel_module_loading">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record Information on Kernel Modules Loading and Unloading</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To capture kernel module loading and unloading events, use following lines, setting ARCH to
either b32 for 32-bit system, or having two lines for both b32 and b64 in case your system is 64-bit:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">
-a always,exit -F arch=<html:i>ARCH</html:i> -S init_module,delete_module -F key=modules
</html:pre>

Place to add the lines depends on a way <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured. If it is configured
to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program (the default), add the lines to a file with suffix
<html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>.

If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code> utility,
add the lines to file <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code>.</description>
          <platform idref="cpe:/a:machine"/>
          <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_kernel_module_loading" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure auditd Collects Information on Kernel Module Loading and Unloading</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To capture kernel module loading and unloading events, use following lines, setting ARCH to
either b32 for 32-bit system, or having two lines for both b32 and b64 in case your system is 64-bit:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">
-a always,exit -F arch=<html:i>ARCH</html:i> -S init_module,finit_module,delete_module -F key=modules
</html:pre>

The place to add the lines depends on a way <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured. If it is configured
to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program (the default), add the lines to a file with suffix
<html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>.

If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code> utility,
add the lines to file <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code>.</description>
            <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</reference>
            <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.2.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.2.6.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO12.06</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI08.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS02.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS02.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS02.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.2.6</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.7.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.7</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.15.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.15.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.5</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.7</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.2.2</reference>
            <reference href="https://www.cisecurity.org/controls/">1</reference>
            <reference href="https://www.cisecurity.org/controls/">11</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">13</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">19</reference>
            <reference href="https://www.cisecurity.org/controls/">2</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">4</reference>
            <reference href="https://www.cisecurity.org/controls/">5</reference>
            <reference href="https://www.cisecurity.org/controls/">6</reference>
            <reference href="https://www.cisecurity.org/controls/">7</reference>
            <reference href="https://www.cisecurity.org/controls/">8</reference>
            <reference href="https://www.cisecurity.org/controls/">9</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The addition/removal of kernel modules can be used to alter the behavior of
the kernel and potentially introduce malicious code into kernel space. It is important
to have an audit trail of modules that have been introduced into the kernel.</rationale>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_kernel_module_loading" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="low" strategy="restrict">- name: Set architecture for audit tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.7
    - audit_rules_kernel_module_loading
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for kernel module loading for x86 platform
  block:

    - name: Declare list of syscals
      set_fact:
        syscalls:
          - init_module
          - delete_module
          - finit_module

    - name: Declare number of syscalls
      set_fact: audit_syscalls_number_of_syscalls="{{ syscalls|length|int }}"

    - name: Check existence of syscalls for architecture b32 in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+{{
          item }}[\s]+|([\s]+|[,]){{ item }}([\s]+|[,]))).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$
        patterns: '*.rules'
      register: audit_syscalls_found_b32_rules_d
      loop: '{{ syscalls }}'

    - name: Get number of matched syscalls for architecture b32 in /etc/audit/rules.d/
      set_fact: audit_syscalls_matched_b32_rules_d="{{ audit_syscalls_found_b32_rules_d.results|sum(attribute='matched')|int
        }}"

    - name: Search /etc/audit/rules.d for other rules with the key modules
      find:
        paths: /etc/audit/rules.d
        contains: ^.*(?:-F key=|-k\s+)modules$
        patterns: '*.rules'
      register: find_syscalls_files

    - name: Use /etc/audit/rules.d/modules.rules as the recipient for the rule
      set_fact:
        all_files:
          - /etc/audit/rules.d/modules.rules
      when: find_syscalls_files.matched is defined and find_syscalls_files.matched
        == 0

    - name: Use matched file as the recipient for the rule
      set_fact:
        all_files:
          - '{{ find_syscalls_files.files | map(attribute=''path'') | list | first
            }}'
      when: find_syscalls_files.matched is defined and find_syscalls_files.matched
        &gt; 0

    - name: Insert the syscall rule in {{ all_files[0] }}
      block:

        - name: 'Construct rule: add rule list, action and arch'
          set_fact: tmpline="-a always,exit -F arch=b32"

        - name: 'Construct rule: add syscalls'
          set_fact: tmpline="{{ tmpline + ' -S ' + item.item }}"
          loop: '{{ audit_syscalls_found_b32_rules_d.results }}'
          when: item.matched is defined and item.matched == 0

        - name: 'Construct rule: add fields and key'
          set_fact: tmpline="{{ tmpline + ' -k modules' }}"

        - name: Insert the line in {{ all_files[0] }}
          lineinfile:
            path: '{{ all_files[0] }}'
            line: '{{ tmpline }}'
            create: true
            state: present
      when: audit_syscalls_matched_b32_rules_d &lt; audit_syscalls_number_of_syscalls

    - name: Declare list of syscals
      set_fact:
        syscalls:
          - init_module
          - delete_module
          - finit_module

    - name: Declare number of syscalls
      set_fact: audit_syscalls_number_of_syscalls="{{ syscalls|length|int }}"

    - name: Check existence of syscalls for architecture b32 in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+{{
          item }}[\s]+|([\s]+|[,]){{ item }}([\s]+|[,]))).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$
        patterns: audit.rules
      register: audit_syscalls_found_b32_audit_rules
      loop: '{{ syscalls }}'

    - name: Get number of matched syscalls for architecture b32 in /etc/audit/audit.rules
      set_fact: audit_syscalls_matched_b32_audit_rules="{{ audit_syscalls_found_b32_audit_rules.results|sum(attribute='matched')|int
        }}"

    - name: Insert the syscall rule in /etc/audit/audit.rules
      block:

        - name: 'Construct rule: add rule list, action and arch'
          set_fact: tmpline="-a always,exit -F arch=b32"

        - name: 'Construct rule: add syscalls'
          set_fact: tmpline="{{ tmpline + ' -S ' + item.item }}"
          loop: '{{ audit_syscalls_found_b32_audit_rules.results }}'
          when: item.matched is defined and item.matched == 0

        - name: 'Construct rule: add fields and key'
          set_fact: tmpline="{{ tmpline + ' -k modules' }}"

        - name: Insert the line in /etc/audit/audit.rules
          lineinfile:
            path: /etc/audit/audit.rules
            line: '{{ tmpline }}'
            create: true
            state: present
      when: audit_syscalls_matched_b32_audit_rules &lt; audit_syscalls_number_of_syscalls
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.7
    - audit_rules_kernel_module_loading
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for kernel module loading for x86_64 platform
  block:

    - name: Declare list of syscals
      set_fact:
        syscalls:
          - init_module
          - delete_module
          - finit_module

    - name: Declare number of syscalls
      set_fact: audit_syscalls_number_of_syscalls="{{ syscalls|length|int }}"

    - name: Check existence of syscalls for architecture b64 in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+{{
          item }}[\s]+|([\s]+|[,]){{ item }}([\s]+|[,]))).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$
        patterns: '*.rules'
      register: audit_syscalls_found_b64_rules_d
      loop: '{{ syscalls }}'

    - name: Get number of matched syscalls for architecture b64 in /etc/audit/rules.d/
      set_fact: audit_syscalls_matched_b64_rules_d="{{ audit_syscalls_found_b64_rules_d.results|sum(attribute='matched')|int
        }}"

    - name: Search /etc/audit/rules.d for other rules with the key modules
      find:
        paths: /etc/audit/rules.d
        contains: ^.*(?:-F key=|-k\s+)modules$
        patterns: '*.rules'
      register: find_syscalls_files

    - name: Use /etc/audit/rules.d/modules.rules as the recipient for the rule
      set_fact:
        all_files:
          - /etc/audit/rules.d/modules.rules
      when: find_syscalls_files.matched is defined and find_syscalls_files.matched
        == 0

    - name: Use matched file as the recipient for the rule
      set_fact:
        all_files:
          - '{{ find_syscalls_files.files | map(attribute=''path'') | list | first
            }}'
      when: find_syscalls_files.matched is defined and find_syscalls_files.matched
        &gt; 0

    - name: Insert the syscall rule in {{ all_files[0] }}
      block:

        - name: 'Construct rule: add rule list, action and arch'
          set_fact: tmpline="-a always,exit -F arch=b64"

        - name: 'Construct rule: add syscalls'
          set_fact: tmpline="{{ tmpline + ' -S ' + item.item }}"
          loop: '{{ audit_syscalls_found_b64_rules_d.results }}'
          when: item.matched is defined and item.matched == 0

        - name: 'Construct rule: add fields and key'
          set_fact: tmpline="{{ tmpline + ' -k modules' }}"

        - name: Insert the line in {{ all_files[0] }}
          lineinfile:
            path: '{{ all_files[0] }}'
            line: '{{ tmpline }}'
            create: true
            state: present
      when: audit_syscalls_matched_b64_rules_d &lt; audit_syscalls_number_of_syscalls

    - name: Declare list of syscals
      set_fact:
        syscalls:
          - init_module
          - delete_module
          - finit_module

    - name: Declare number of syscalls
      set_fact: audit_syscalls_number_of_syscalls="{{ syscalls|length|int }}"

    - name: Check existence of syscalls for architecture b64 in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+{{
          item }}[\s]+|([\s]+|[,]){{ item }}([\s]+|[,]))).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$
        patterns: audit.rules
      register: audit_syscalls_found_b64_audit_rules
      loop: '{{ syscalls }}'

    - name: Get number of matched syscalls for architecture b64 in /etc/audit/audit.rules
      set_fact: audit_syscalls_matched_b64_audit_rules="{{ audit_syscalls_found_b64_audit_rules.results|sum(attribute='matched')|int
        }}"

    - name: Insert the syscall rule in /etc/audit/audit.rules
      block:

        - name: 'Construct rule: add rule list, action and arch'
          set_fact: tmpline="-a always,exit -F arch=b64"

        - name: 'Construct rule: add syscalls'
          set_fact: tmpline="{{ tmpline + ' -S ' + item.item }}"
          loop: '{{ audit_syscalls_found_b64_audit_rules.results }}'
          when: item.matched is defined and item.matched == 0

        - name: 'Construct rule: add fields and key'
          set_fact: tmpline="{{ tmpline + ' -k modules' }}"

        - name: Insert the line in /etc/audit/audit.rules
          lineinfile:
            path: /etc/audit/audit.rules
            line: '{{ tmpline }}'
            create: true
            state: present
      when: audit_syscalls_matched_b64_audit_rules &lt; audit_syscalls_number_of_syscalls
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - audit_arch == "b64"
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.7
    - audit_rules_kernel_module_loading
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_kernel_module_loading:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-audit_rules_kernel_module_loading_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_kernel_module_loading_delete" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure auditd Collects Information on Kernel Module Unloading - delete_module</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To capture kernel module unloading events, use following line, setting ARCH to
either b32 for 32-bit system, or having two lines for both b32 and b64 in case your system is 64-bit:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=<html:i>ARCH</html:i> -S delete_module -F key=modules</html:pre>

Place to add the line depends on a way <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured. If it is configured
to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program (the default), add the line to a file with suffix
<html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>.

If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code> utility,
add the line to file <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code>.</description>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</reference>
            <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</reference>
            <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.2.7</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00216</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000477-GPOS-00222</reference>
            <reference href="">SRG-OS-000477-VMM-001970</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.2.6.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO12.06</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI08.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS02.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS02.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS02.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.2.6</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.7.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.7</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.15.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.15.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.5</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.7</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.2.2</reference>
            <reference href="https://www.cisecurity.org/controls/">1</reference>
            <reference href="https://www.cisecurity.org/controls/">11</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">13</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">19</reference>
            <reference href="https://www.cisecurity.org/controls/">2</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">4</reference>
            <reference href="https://www.cisecurity.org/controls/">5</reference>
            <reference href="https://www.cisecurity.org/controls/">6</reference>
            <reference href="https://www.cisecurity.org/controls/">7</reference>
            <reference href="https://www.cisecurity.org/controls/">8</reference>
            <reference href="https://www.cisecurity.org/controls/">9</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The removal of kernel modules can be used to alter the behavior of
the kernel and potentially introduce malicious code into kernel space. It is important
to have an audit trail of modules that have been introduced into the kernel.</rationale>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_kernel_module_loading_delete" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then



# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
# Note: 32-bit and 64-bit kernel syscall numbers not always line up =&gt;
#       it's required on a 64-bit system to check also for the presence
#       of 32-bit's equivalent of the corresponding rule.
#       (See `man 7 audit.rules` for details )
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	PATTERN="-a always,exit -F arch=$ARCH -S delete_module \(-F key=\|-k \).*"
	GROUP="modules"
	FULL_RULE="-a always,exit -F arch=$ARCH -S delete_module -k modules"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_fix_audit_syscall_rule" use="legacy"/>
	fix_audit_syscall_rule "auditctl" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
	fix_audit_syscall_rule "augenrules" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_kernel_module_loading_delete" system="urn:xccdf:fix:script:kubernetes">apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20delete_module%20-k%20module-change%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20delete_module%20-k%20module-change%0A
        mode: 0600
        path: /etc/audit/rules.d/75-kernel-module-loading-delete.rules
        overwrite: true
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_kernel_module_loading_delete:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-audit_rules_kernel_module_loading_delete_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_kernel_module_loading_init" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure auditd Collects Information on Kernel Module Loading - init_module</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To capture kernel module loading events, use following line, setting ARCH to
either b32 for 32-bit system, or having two lines for both b32 and b64 in case your system is 64-bit:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=<html:i>ARCH</html:i> -S init_module -F key=modules</html:pre>

Place to add the line depends on a way <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured. If it is configured
to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program (the default), add the line to a file with suffix
<html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>.

If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code> utility,
add the line to file <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code>.</description>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</reference>
            <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</reference>
            <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.2.7</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00216</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000477-GPOS-00222</reference>
            <reference href="">SRG-OS-000477-VMM-001970</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.2.6.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO12.06</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI08.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS02.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS02.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS02.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.2.6</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.7.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.7</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.15.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.15.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.5</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.7</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.2.2</reference>
            <reference href="https://www.cisecurity.org/controls/">1</reference>
            <reference href="https://www.cisecurity.org/controls/">11</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">13</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">19</reference>
            <reference href="https://www.cisecurity.org/controls/">2</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">4</reference>
            <reference href="https://www.cisecurity.org/controls/">5</reference>
            <reference href="https://www.cisecurity.org/controls/">6</reference>
            <reference href="https://www.cisecurity.org/controls/">7</reference>
            <reference href="https://www.cisecurity.org/controls/">8</reference>
            <reference href="https://www.cisecurity.org/controls/">9</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The addition of kernel modules can be used to alter the behavior of
the kernel and potentially introduce malicious code into kernel space. It is important
to have an audit trail of modules that have been introduced into the kernel.</rationale>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_kernel_module_loading_init" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then



# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
# Note: 32-bit and 64-bit kernel syscall numbers not always line up =&gt;
#       it's required on a 64-bit system to check also for the presence
#       of 32-bit's equivalent of the corresponding rule.
#       (See `man 7 audit.rules` for details )
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	PATTERN="-a always,exit -F arch=$ARCH -S init_module \(-F key=\|-k \).*"
	GROUP="modules"
	FULL_RULE="-a always,exit -F arch=$ARCH -S init_module -k modules"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_fix_audit_syscall_rule" use="legacy"/>
	fix_audit_syscall_rule "auditctl" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
	fix_audit_syscall_rule "augenrules" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_kernel_module_loading_init" system="urn:xccdf:fix:script:kubernetes">apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20init_module%20-k%20module-change%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20init_module%20-k%20module-change%0A
        mode: 0600
        path: /etc/audit/rules.d/75-kernel-module-loading-init.rules
        overwrite: true
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_kernel_module_loading_init:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-audit_rules_kernel_module_loading_init_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_kernel_module_loading_finit" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program
to read audit rules during daemon startup (the default), add the following lines to a file
with suffix <html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code> to capture kernel module
loading and unloading events, setting ARCH to either b32 or b64 as appropriate for your system:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=<html:i>ARCH</html:i> -S finit_module -F key=modules</html:pre>
If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code> utility to read audit
rules during daemon startup, add the following lines to <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> file
in order to capture kernel module loading and unloading events, setting ARCH to either b32 or
b64 as appropriate for your system:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=<html:i>ARCH</html:i> -S finit_module -F key=modules</html:pre></description>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</reference>
            <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</reference>
            <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.2.7</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00216</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000477-GPOS-00222</reference>
            <reference href="">SRG-OS-000477-VMM-001970</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.2.6.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO12.06</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI08.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS02.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS02.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS02.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.2.6</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.7.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.7</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.15.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.15.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.5</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.7</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.2.2</reference>
            <reference href="https://www.cisecurity.org/controls/">1</reference>
            <reference href="https://www.cisecurity.org/controls/">11</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">13</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">19</reference>
            <reference href="https://www.cisecurity.org/controls/">2</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">4</reference>
            <reference href="https://www.cisecurity.org/controls/">5</reference>
            <reference href="https://www.cisecurity.org/controls/">6</reference>
            <reference href="https://www.cisecurity.org/controls/">7</reference>
            <reference href="https://www.cisecurity.org/controls/">8</reference>
            <reference href="https://www.cisecurity.org/controls/">9</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The addition/removal of kernel modules can be used to alter the behavior of
the kernel and potentially introduce malicious code into kernel space. It is important
to have an audit trail of modules that have been introduced into the kernel.</rationale>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_kernel_module_loading_finit" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then



# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
# Note: 32-bit and 64-bit kernel syscall numbers not always line up =&gt;
#       it's required on a 64-bit system to check also for the presence
#       of 32-bit's equivalent of the corresponding rule.
#       (See `man 7 audit.rules` for details )
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	PATTERN="-a always,exit -F arch=$ARCH -S finit_module \(-F key=\|-k \).*"
	GROUP="modules"
	FULL_RULE="-a always,exit -F arch=$ARCH -S finit_module -k modules"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_fix_audit_syscall_rule" use="legacy"/>
	fix_audit_syscall_rule "auditctl" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
	fix_audit_syscall_rule "augenrules" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_kernel_module_loading_finit" system="urn:xccdf:fix:script:kubernetes">apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20finit_module%20-k%20module-change%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20finit_module%20-k%20module-change%0A
        mode: 0600
        path: /etc/audit/rules.d/75-kernel-module-loading-finit.rules
        overwrite: true
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_kernel_module_loading_finit:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-audit_rules_kernel_module_loading_finit_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
        </Group>
        <Group id="xccdf_org.ssgproject.content_group_audit_execution_selinux_commands">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record Execution Attempts to Run SELinux Privileged Commands</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">At a minimum, the audit system should collect the execution of
SELinux privileged commands for all users and root.</description>
          <platform idref="cpe:/a:machine"/>
          <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_execution_setsebool" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record Any Attempts to Run setsebool</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">At a minimum, the audit system should collect any execution attempt
of the <html:code xmlns:html="http://www.w3.org/1999/xhtml">setsebool</html:code> command for all users and root. If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code>
daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program to read audit rules
during daemon startup (the default), add the following lines to a file with suffix
<html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F path=/usr/sbin/setsebool -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre>
If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> file:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F path=/usr/sbin/setsebool -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre></description>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
            <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000463-GPOS-00207</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000465-GPOS-00209</reference>
            <reference href="">SRG-OS-000463-VMM-001850</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.2.6.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.7.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.7</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.15.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.15.2.2</reference>
            <reference href="https://www.cisecurity.org/controls/">1</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">13</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">2</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">5</reference>
            <reference href="https://www.cisecurity.org/controls/">6</reference>
            <reference href="https://www.cisecurity.org/controls/">7</reference>
            <reference href="https://www.cisecurity.org/controls/">8</reference>
            <reference href="https://www.cisecurity.org/controls/">9</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Misuse of privileged functions, either intentionally or unintentionally by
authorized users, or by unauthorized external entities that have compromised system accounts,
is a serious and ongoing concern and can have significant adverse impacts on organizations.
Auditing the use of privileged functions is one way to detect such misuse and identify
the risk from insider and advanced persistent threats.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Privileged programs are subject to escalation-of-privilege attacks,
which attempt to subvert their normal role of providing some necessary but
limited capability. As such, motivation exists to monitor these programs for
unusual activity.</rationale>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_execution_setsebool" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then



PATTERN="-a always,exit -F path=/usr/sbin/setsebool\\s\\+.*"
GROUP="privileged"
# Although the fix doesn't use ARCH, we reset it because it could have been set by some other remediation
ARCH=""
FULL_RULE="-a always,exit -F path=/usr/sbin/setsebool -F auid&gt;=1000 -F auid!=unset -F key=privileged"
# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_fix_audit_syscall_rule" use="legacy"/>
fix_audit_syscall_rule "auditctl" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
fix_audit_syscall_rule "augenrules" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_execution_setsebool" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Search /etc/audit/rules.d for audit rule entries
  find:
    paths: /etc/audit/rules.d
    recurse: false
    contains: ^.*path=/usr/sbin/setsebool.*$
    patterns: '*.rules'
  register: find_setsebool
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_execution_setsebool
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Use /etc/audit/rules.d/privileged.rules as the recipient for the rule
  set_fact:
    all_files:
      - /etc/audit/rules.d/privileged.rules
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_setsebool.matched is defined and find_setsebool.matched == 0
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_execution_setsebool
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
      - '{{ find_setsebool.files | map(attribute=''path'') | list | first }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_setsebool.matched is defined and find_setsebool.matched &gt; 0
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_execution_setsebool
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Inserts/replaces the setsebool rule in rules.d
  lineinfile:
    path: '{{ all_files[0] }}'
    line: -a always,exit -F path=/usr/sbin/setsebool -F auid&gt;=1000 -F auid!=unset
      -F key=privileged
    create: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_execution_setsebool
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Inserts/replaces the setsebool rule in audit.rules
  lineinfile:
    path: /etc/audit/audit.rules
    line: -a always,exit -F path=/usr/sbin/setsebool -F auid&gt;=1000 -F auid!=unset
      -F key=privileged
    create: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_execution_setsebool
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_execution_setsebool:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-audit_rules_execution_setsebool_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_execution_chcon" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record Any Attempts to Run chcon</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">At a minimum, the audit system should collect any execution attempt
of the <html:code xmlns:html="http://www.w3.org/1999/xhtml">chcon</html:code> command for all users and root. If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code>
daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program to read audit rules
during daemon startup (the default), add the following lines to a file with suffix
<html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>:

<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F path=/usr/bin/chcon -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre>

If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> file:

<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F path=/usr/bin/chcon -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre></description>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
            <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000463-GPOS-00207</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000465-GPOS-00209</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</reference>
            <reference href="">SRG-OS-000463-VMM-001850</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.2.6.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.7.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.7</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.15.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.15.2.2</reference>
            <reference href="https://www.cisecurity.org/controls/">1</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">13</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">2</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">5</reference>
            <reference href="https://www.cisecurity.org/controls/">6</reference>
            <reference href="https://www.cisecurity.org/controls/">7</reference>
            <reference href="https://www.cisecurity.org/controls/">8</reference>
            <reference href="https://www.cisecurity.org/controls/">9</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Misuse of privileged functions, either intentionally or unintentionally by
authorized users, or by unauthorized external entities that have compromised system accounts,
is a serious and ongoing concern and can have significant adverse impacts on organizations.
Auditing the use of privileged functions is one way to detect such misuse and identify
the risk from insider and advanced persistent threats.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Privileged programs are subject to escalation-of-privilege attacks,
which attempt to subvert their normal role of providing some necessary but
limited capability. As such, motivation exists to monitor these programs for
unusual activity.</rationale>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_execution_chcon" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then



PATTERN="-a always,exit -F path=/usr/bin/chcon\\s\\+.*"
GROUP="privileged"
# Although the fix doesn't use ARCH, we reset it because it could have been set by some other remediation
ARCH=""
FULL_RULE="-a always,exit -F path=/usr/bin/chcon -F auid&gt;=1000 -F auid!=unset -F key=privileged"
# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_fix_audit_syscall_rule" use="legacy"/>
fix_audit_syscall_rule "auditctl" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
fix_audit_syscall_rule "augenrules" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_execution_chcon" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Search /etc/audit/rules.d for audit rule entries
  find:
    paths: /etc/audit/rules.d
    recurse: false
    contains: ^.*path=/usr/bin/chcon.*$
    patterns: '*.rules'
  register: find_chcon
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_execution_chcon
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Use /etc/audit/rules.d/privileged.rules as the recipient for the rule
  set_fact:
    all_files:
      - /etc/audit/rules.d/privileged.rules
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_chcon.matched is defined and find_chcon.matched == 0
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_execution_chcon
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
      - '{{ find_chcon.files | map(attribute=''path'') | list | first }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_chcon.matched is defined and find_chcon.matched &gt; 0
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_execution_chcon
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Inserts/replaces the chcon rule in rules.d
  lineinfile:
    path: '{{ all_files[0] }}'
    line: -a always,exit -F path=/usr/bin/chcon -F auid&gt;=1000 -F auid!=unset -F key=privileged
    create: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_execution_chcon
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Inserts/replaces the chcon rule in audit.rules
  lineinfile:
    path: /etc/audit/audit.rules
    line: -a always,exit -F path=/usr/bin/chcon -F auid&gt;=1000 -F auid!=unset -F key=privileged
    create: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_execution_chcon
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_execution_chcon:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-audit_rules_execution_chcon_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_execution_semanage" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record Any Attempts to Run semanage</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">At a minimum, the audit system should collect any execution attempt
of the <html:code xmlns:html="http://www.w3.org/1999/xhtml">semanage</html:code> command for all users and root. If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code>
daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program to read audit rules
during daemon startup (the default), add the following lines to a file with suffix
<html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F path=/usr/sbin/semanage -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre>
If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> file:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F path=/usr/sbin/semanage -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre></description>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-2(4)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
            <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000463-GPOS-00207</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000465-GPOS-00209</reference>
            <reference href="">SRG-OS-000463-VMM-001850</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.2.6.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.7.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.7</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.15.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.15.2.2</reference>
            <reference href="https://www.cisecurity.org/controls/">1</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">13</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">2</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">5</reference>
            <reference href="https://www.cisecurity.org/controls/">6</reference>
            <reference href="https://www.cisecurity.org/controls/">7</reference>
            <reference href="https://www.cisecurity.org/controls/">8</reference>
            <reference href="https://www.cisecurity.org/controls/">9</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Misuse of privileged functions, either intentionally or unintentionally by
authorized users, or by unauthorized external entities that have compromised system accounts,
is a serious and ongoing concern and can have significant adverse impacts on organizations.
Auditing the use of privileged functions is one way to detect such misuse and identify
the risk from insider and advanced persistent threats.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Privileged programs are subject to escalation-of-privilege attacks,
which attempt to subvert their normal role of providing some necessary but
limited capability. As such, motivation exists to monitor these programs for
unusual activity.</rationale>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_execution_semanage" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then



PATTERN="-a always,exit -F path=/usr/sbin/semanage\\s\\+.*"
GROUP="privileged"
# Although the fix doesn't use ARCH, we reset it because it could have been set by some other remediation
ARCH=""
FULL_RULE="-a always,exit -F path=/usr/sbin/semanage -F auid&gt;=1000 -F auid!=unset -F key=privileged"
# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_fix_audit_syscall_rule" use="legacy"/>
fix_audit_syscall_rule "auditctl" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
fix_audit_syscall_rule "augenrules" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_execution_semanage" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Search /etc/audit/rules.d for audit rule entries
  find:
    paths: /etc/audit/rules.d
    recurse: false
    contains: ^.*path=/usr/sbin/semanage.*$
    patterns: '*.rules'
  register: find_semanage
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_execution_semanage
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Use /etc/audit/rules.d/privileged.rules as the recipient for the rule
  set_fact:
    all_files:
      - /etc/audit/rules.d/privileged.rules
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_semanage.matched is defined and find_semanage.matched == 0
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_execution_semanage
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
      - '{{ find_semanage.files | map(attribute=''path'') | list | first }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_semanage.matched is defined and find_semanage.matched &gt; 0
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_execution_semanage
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Inserts/replaces the semanage rule in rules.d
  lineinfile:
    path: '{{ all_files[0] }}'
    line: -a always,exit -F path=/usr/sbin/semanage -F auid&gt;=1000 -F auid!=unset -F
      key=privileged
    create: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_execution_semanage
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Inserts/replaces the semanage rule in audit.rules
  lineinfile:
    path: /etc/audit/audit.rules
    line: -a always,exit -F path=/usr/sbin/semanage -F auid&gt;=1000 -F auid!=unset -F
      key=privileged
    create: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_execution_semanage
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_execution_semanage:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-audit_rules_execution_semanage_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_execution_restorecon" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record Any Attempts to Run restorecon</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">At a minimum, the audit system should collect any execution attempt
of the <html:code xmlns:html="http://www.w3.org/1999/xhtml">restorecon</html:code> command for all users and root. If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code>
daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program to read audit rules
during daemon startup (the default), add the following lines to a file with suffix
<html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F path=/usr/sbin/restorecon -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre>
If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> file:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F path=/usr/sbin/restorecon -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre></description>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
            <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000463-GPOS-00207</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000465-GPOS-00209</reference>
            <reference href="">SRG-OS-000463-VMM-001850</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.2.6.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.7.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.7</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.15.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.15.2.2</reference>
            <reference href="https://www.cisecurity.org/controls/">1</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">13</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">2</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">5</reference>
            <reference href="https://www.cisecurity.org/controls/">6</reference>
            <reference href="https://www.cisecurity.org/controls/">7</reference>
            <reference href="https://www.cisecurity.org/controls/">8</reference>
            <reference href="https://www.cisecurity.org/controls/">9</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Misuse of privileged functions, either intentionally or unintentionally by
authorized users, or by unauthorized external entities that have compromised system accounts,
is a serious and ongoing concern and can have significant adverse impacts on organizations.
Auditing the use of privileged functions is one way to detect such misuse and identify
the risk from insider and advanced persistent threats.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Privileged programs are subject to escalation-of-privilege attacks,
which attempt to subvert their normal role of providing some necessary but
limited capability. As such, motivation exists to monitor these programs for
unusual activity.</rationale>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_execution_restorecon" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then



PATTERN="-a always,exit -F path=/usr/sbin/restorecon\\s\\+.*"
GROUP="privileged"
# Although the fix doesn't use ARCH, we reset it because it could have been set by some other remediation
ARCH=""
FULL_RULE="-a always,exit -F path=/usr/sbin/restorecon -F auid&gt;=1000 -F auid!=unset -F key=privileged"
# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_fix_audit_syscall_rule" use="legacy"/>
fix_audit_syscall_rule "auditctl" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
fix_audit_syscall_rule "augenrules" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_execution_restorecon" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Search /etc/audit/rules.d for audit rule entries
  find:
    paths: /etc/audit/rules.d
    recurse: false
    contains: ^.*path=/usr/sbin/restorecon.*$
    patterns: '*.rules'
  register: find_restorecon
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_execution_restorecon
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Use /etc/audit/rules.d/privileged.rules as the recipient for the rule
  set_fact:
    all_files:
      - /etc/audit/rules.d/privileged.rules
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_restorecon.matched is defined and find_restorecon.matched == 0
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_execution_restorecon
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
      - '{{ find_restorecon.files | map(attribute=''path'') | list | first }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_restorecon.matched is defined and find_restorecon.matched &gt; 0
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_execution_restorecon
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Inserts/replaces the restorecon rule in rules.d
  lineinfile:
    path: '{{ all_files[0] }}'
    line: -a always,exit -F path=/usr/sbin/restorecon -F auid&gt;=1000 -F auid!=unset
      -F key=privileged
    create: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_execution_restorecon
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Inserts/replaces the restorecon rule in audit.rules
  lineinfile:
    path: /etc/audit/audit.rules
    line: -a always,exit -F path=/usr/sbin/restorecon -F auid&gt;=1000 -F auid!=unset
      -F key=privileged
    create: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_execution_restorecon
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_execution_restorecon:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-audit_rules_execution_restorecon_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_execution_seunshare" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record Any Attempts to Run seunshare</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">At a minimum, the audit system should collect any execution attempt
of the <html:code xmlns:html="http://www.w3.org/1999/xhtml">seunshare</html:code> command for all users and root. If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code>
daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program to read audit rules
during daemon startup (the default), add the following lines to a file with suffix
<html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F path=/usr/sbin/seunshare -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre>
If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> file:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F path=/usr/sbin/seunshare -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre></description>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</reference>
            <reference href="">SRG-OS-000463-VMM-001850</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Misuse of privileged functions, either intentionally or unintentionally by
authorized users, or by unauthorized external entities that have compromised system accounts,
is a serious and ongoing concern and can have significant adverse impacts on organizations.
Auditing the use of privileged functions is one way to detect such misuse and identify
the risk from insider and advanced persistent threats.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Privileged programs are subject to escalation-of-privilege attacks,
which attempt to subvert their normal role of providing some necessary but
limited capability. As such, motivation exists to monitor these programs for
unusual activity.</rationale>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_execution_seunshare" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then



PATTERN="-a always,exit -F path=/usr/sbin/seunshare\\s\\+.*"
GROUP="privileged"
# Although the fix doesn't use ARCH, we reset it because it could have been set by some other remediation
ARCH=""
FULL_RULE="-a always,exit -F path=/usr/sbin/seunshare -F auid&gt;=1000 -F auid!=unset -F key=privileged"
# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_fix_audit_syscall_rule" use="legacy"/>
fix_audit_syscall_rule "auditctl" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
fix_audit_syscall_rule "augenrules" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_execution_seunshare" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Search /etc/audit/rules.d for audit rule entries
  find:
    paths: /etc/audit/rules.d
    recurse: false
    contains: ^.*path=/usr/sbin/seunshare.*$
    patterns: '*.rules'
  register: find_seunshare
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_execution_seunshare
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Use /etc/audit/rules.d/privileged.rules as the recipient for the rule
  set_fact:
    all_files:
      - /etc/audit/rules.d/privileged.rules
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_seunshare.matched is defined and find_seunshare.matched == 0
  tags:
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_execution_seunshare
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
      - '{{ find_seunshare.files | map(attribute=''path'') | list | first }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_seunshare.matched is defined and find_seunshare.matched &gt; 0
  tags:
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_execution_seunshare
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Inserts/replaces the seunshare rule in rules.d
  lineinfile:
    path: '{{ all_files[0] }}'
    line: -a always,exit -F path=/usr/sbin/seunshare -F auid&gt;=1000 -F auid!=unset
      -F key=privileged
    create: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_execution_seunshare
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Inserts/replaces the seunshare rule in audit.rules
  lineinfile:
    path: /etc/audit/audit.rules
    line: -a always,exit -F path=/usr/sbin/seunshare -F auid&gt;=1000 -F auid!=unset
      -F key=privileged
    create: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_execution_seunshare
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_execution_seunshare:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-audit_rules_execution_seunshare_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
        </Group>
        <Group id="xccdf_org.ssgproject.content_group_audit_dac_actions">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record Events that Modify the System's Discretionary Access Controls</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">At a minimum, the audit system should collect file permission
changes for all users and root. Note that the "-F arch=b32" lines should be
present even on a 64 bit system. These commands identify system calls for
auditing. Even if the system is 64 bit it can still execute 32 bit system
calls. Additionally, these rules can be configured in a number of ways while
still achieving the desired effect. An example of this is that the "-S" calls
could be split up and placed on separate lines, however, this is less efficient.
Add the following to <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S chmod,fchmod,fchmodat -F auid&gt;=1000 -F auid!=unset -F key=perm_mod
    -a always,exit -F arch=b32 -S chown,fchown,fchownat,lchown -F auid&gt;=1000 -F auid!=unset -F key=perm_mod
    -a always,exit -F arch=b32 -S setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
If your system is 64 bit then these lines should be duplicated and the
arch=b32 replaced with arch=b64 as follows:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b64 -S chmod,fchmod,fchmodat -F auid&gt;=1000 -F auid!=unset -F key=perm_mod
    -a always,exit -F arch=b64 -S chown,fchown,fchownat,lchown -F auid&gt;=1000 -F auid!=unset -F key=perm_mod
    -a always,exit -F arch=b64 -S setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre></description>
          <platform idref="cpe:/a:machine"/>
          <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_setxattr" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record Events that Modify the System's Discretionary Access Controls - setxattr</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">At a minimum, the audit system should collect file permission
changes for all users and root. If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured
to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following line to a file with suffix
<html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S setxattr -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
If the system is 64 bit then also add the following line:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b64 -S setxattr -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the following line to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> file:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S setxattr -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
If the system is 64 bit then also add the following line:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b64 -S setxattr -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre></description>
            <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.</warning>
            <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000126</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</reference>
            <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</reference>
            <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.5.5</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000064-GPOS-00033</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000458-GPOS-00203</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</reference>
            <reference href="">SRG-OS-000458-VMM-001810</reference>
            <reference href="">SRG-OS-000474-VMM-001940</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.2.6.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO12.06</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI08.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS02.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS02.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS02.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.2.6</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.7.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.7</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.15.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.15.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.5</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.7</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.2.2</reference>
            <reference href="https://www.cisecurity.org/controls/">1</reference>
            <reference href="https://www.cisecurity.org/controls/">11</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">13</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">19</reference>
            <reference href="https://www.cisecurity.org/controls/">2</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">4</reference>
            <reference href="https://www.cisecurity.org/controls/">5</reference>
            <reference href="https://www.cisecurity.org/controls/">6</reference>
            <reference href="https://www.cisecurity.org/controls/">7</reference>
            <reference href="https://www.cisecurity.org/controls/">8</reference>
            <reference href="https://www.cisecurity.org/controls/">9</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The changing of file permissions could indicate that a user is attempting to
gain access to information that would otherwise be disallowed. Auditing DAC modifications
can facilitate the identification of patterns of abuse among both authorized and
unauthorized users.</rationale>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_dac_modification_setxattr" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then



# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	PATTERN="-a always,exit -F arch=$ARCH -S setxattr.*"
	GROUP="perm_mod"
	FULL_RULE="-a always,exit -F arch=$ARCH -S setxattr -F auid&gt;=1000 -F auid!=unset -F key=perm_mod"

	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_fix_audit_syscall_rule" use="legacy"/>
	fix_audit_syscall_rule "augenrules" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
	fix_audit_syscall_rule "auditctl" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_dac_modification_setxattr" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="low" strategy="restrict">- name: Set architecture for audit setxattr tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_setxattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Search /etc/audit/rules.d for other DAC audit rules
  find:
    paths: /etc/audit/rules.d
    recurse: false
    contains: -F key=perm_mod$
    patterns: '*.rules'
  register: find_setxattr
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_setxattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: If existing DAC ruleset not found, use /etc/audit/rules.d/privileged.rules
    as the recipient for the rule
  set_fact:
    all_files:
      - /etc/audit/rules.d/privileged.rules
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_setxattr.matched is defined and find_setxattr.matched == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_setxattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
      - '{{ find_setxattr.files | map(attribute=''path'') | list | first }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_setxattr.matched is defined and find_setxattr.matched &gt; 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_setxattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the setxattr rule in rules.d when on x86
  lineinfile:
    path: '{{ all_files[0] }}'
    line: -a always,exit -F arch=b32 -S setxattr -F auid&gt;=1000 -F auid!=unset -F key=perm_mod
    create: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_setxattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the setxattr rule in rules.d when on x86_64
  lineinfile:
    path: '{{ all_files[0] }}'
    line: -a always,exit -F arch=b64 -S setxattr -F auid&gt;=1000 -F auid!=unset -F key=perm_mod
    create: true
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - audit_arch is defined and audit_arch == 'b64'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_setxattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the setxattr rule in /etc/audit/audit.rules when on x86
  lineinfile:
    line: -a always,exit -F arch=b32 -S setxattr -F auid&gt;=1000 -F auid!=unset -F key=perm_mod
    state: present
    dest: /etc/audit/audit.rules
    create: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_setxattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the setxattr rule in audit.rules when on x86_64
  lineinfile:
    line: -a always,exit -F arch=b64 -S setxattr -F auid&gt;=1000 -F auid!=unset -F key=perm_mod
    state: present
    dest: /etc/audit/audit.rules
    create: true
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - audit_arch is defined and audit_arch == 'b64'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_setxattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_dac_modification_setxattr:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-audit_rules_dac_modification_setxattr_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fsetxattr" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record Events that Modify the System's Discretionary Access Controls - fsetxattr</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">At a minimum, the audit system should collect file permission
changes for all users and root. If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured
to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following line to a file with suffix
<html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S fsetxattr -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
If the system is 64 bit then also add the following line:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b64 -S fsetxattr -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the following line to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> file:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S fsetxattr -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
If the system is 64 bit then also add the following line:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b64 -S fsetxattr -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre></description>
            <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.</warning>
            <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000126</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</reference>
            <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</reference>
            <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.5.5</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000064-GPOS-00033</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000458-GPOS-00203</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</reference>
            <reference href="">SRG-OS-000458-VMM-001810</reference>
            <reference href="">SRG-OS-000474-VMM-001940</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.2.6.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO12.06</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI08.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS02.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS02.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS02.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.2.6</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.7.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.7</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.15.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.15.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.5</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.7</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.2.2</reference>
            <reference href="https://www.cisecurity.org/controls/">1</reference>
            <reference href="https://www.cisecurity.org/controls/">11</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">13</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">19</reference>
            <reference href="https://www.cisecurity.org/controls/">2</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">4</reference>
            <reference href="https://www.cisecurity.org/controls/">5</reference>
            <reference href="https://www.cisecurity.org/controls/">6</reference>
            <reference href="https://www.cisecurity.org/controls/">7</reference>
            <reference href="https://www.cisecurity.org/controls/">8</reference>
            <reference href="https://www.cisecurity.org/controls/">9</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The changing of file permissions could indicate that a user is attempting to
gain access to information that would otherwise be disallowed. Auditing DAC modifications
can facilitate the identification of patterns of abuse among both authorized and
unauthorized users.</rationale>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_dac_modification_fsetxattr" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then



# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	PATTERN="-a always,exit -F arch=$ARCH -S fsetxattr.*"
	GROUP="perm_mod"
	FULL_RULE="-a always,exit -F arch=$ARCH -S fsetxattr -F auid&gt;=1000 -F auid!=unset -F key=perm_mod"

	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_fix_audit_syscall_rule" use="legacy"/>
	fix_audit_syscall_rule "augenrules" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
	fix_audit_syscall_rule "auditctl" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_dac_modification_fsetxattr" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="low" strategy="restrict">- name: Set architecture for audit fsetxattr tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_fsetxattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Search /etc/audit/rules.d for other DAC audit rules
  find:
    paths: /etc/audit/rules.d
    recurse: false
    contains: -F key=perm_mod$
    patterns: '*.rules'
  register: find_fsetxattr
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_fsetxattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: If existing DAC ruleset not found, use /etc/audit/rules.d/privileged.rules
    as the recipient for the rule
  set_fact:
    all_files:
      - /etc/audit/rules.d/privileged.rules
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_fsetxattr.matched is defined and find_fsetxattr.matched == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_fsetxattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
      - '{{ find_fsetxattr.files | map(attribute=''path'') | list | first }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_fsetxattr.matched is defined and find_fsetxattr.matched &gt; 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_fsetxattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the fsetxattr rule in rules.d when on x86
  lineinfile:
    path: '{{ all_files[0] }}'
    line: -a always,exit -F arch=b32 -S fsetxattr -F auid&gt;=1000 -F auid!=unset -F
      key=perm_mod
    create: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_fsetxattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the fsetxattr rule in rules.d when on x86_64
  lineinfile:
    path: '{{ all_files[0] }}'
    line: -a always,exit -F arch=b64 -S fsetxattr -F auid&gt;=1000 -F auid!=unset -F
      key=perm_mod
    create: true
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - audit_arch is defined and audit_arch == 'b64'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_fsetxattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the fsetxattr rule in /etc/audit/audit.rules when on x86
  lineinfile:
    line: -a always,exit -F arch=b32 -S fsetxattr -F auid&gt;=1000 -F auid!=unset -F
      key=perm_mod
    state: present
    dest: /etc/audit/audit.rules
    create: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_fsetxattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the fsetxattr rule in audit.rules when on x86_64
  lineinfile:
    line: -a always,exit -F arch=b64 -S fsetxattr -F auid&gt;=1000 -F auid!=unset -F
      key=perm_mod
    state: present
    dest: /etc/audit/audit.rules
    create: true
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - audit_arch is defined and audit_arch == 'b64'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_fsetxattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_dac_modification_fsetxattr:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-audit_rules_dac_modification_fsetxattr_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_umount2" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record Events that Modify the System's Discretionary Access Controls - umount2</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">At a minimum, the audit system should collect file system umount2
changes. If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured
to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following line to a file with suffix
<html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S umount2 -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
If the system is 64 bit then also add the following line:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b64 -S umount2 -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the following line to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> file:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S umount2 -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
If the system is 64 bit then also add the following line:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b64 -S umount2 -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre></description>
            <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.</warning>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The changing of file permissions could indicate that a user is attempting to
gain access to information that would otherwise be disallowed. Auditing DAC modifications
can facilitate the identification of patterns of abuse among both authorized and
unauthorized users.</rationale>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_dac_modification_umount2" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then



# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	PATTERN="-a always,exit -F arch=$ARCH -S umount2.*"
	GROUP="perm_mod"
	FULL_RULE="-a always,exit -F arch=$ARCH -S umount2 -F auid&gt;=1000 -F auid!=unset -F key=perm_mod"

	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_fix_audit_syscall_rule" use="legacy"/>
	fix_audit_syscall_rule "augenrules" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
	fix_audit_syscall_rule "auditctl" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_dac_modification_umount2" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="low" strategy="restrict">- name: Set architecture for audit umount2 tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - audit_rules_dac_modification_umount2
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Search /etc/audit/rules.d for other DAC audit rules
  find:
    paths: /etc/audit/rules.d
    recurse: false
    contains: -F key=perm_mod$
    patterns: '*.rules'
  register: find_umount2
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - audit_rules_dac_modification_umount2
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: If existing DAC ruleset not found, use /etc/audit/rules.d/privileged.rules
    as the recipient for the rule
  set_fact:
    all_files:
      - /etc/audit/rules.d/privileged.rules
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_umount2.matched is defined and find_umount2.matched == 0
  tags:
    - audit_rules_dac_modification_umount2
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
      - '{{ find_umount2.files | map(attribute=''path'') | list | first }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_umount2.matched is defined and find_umount2.matched &gt; 0
  tags:
    - audit_rules_dac_modification_umount2
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the umount2 rule in rules.d when on x86
  lineinfile:
    path: '{{ all_files[0] }}'
    line: -a always,exit -F arch=b32 -S umount2 -F auid&gt;=1000 -F auid!=unset -F key=perm_mod
    create: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - audit_rules_dac_modification_umount2
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the umount2 rule in rules.d when on x86_64
  lineinfile:
    path: '{{ all_files[0] }}'
    line: -a always,exit -F arch=b64 -S umount2 -F auid&gt;=1000 -F auid!=unset -F key=perm_mod
    create: true
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - audit_arch is defined and audit_arch == 'b64'
  tags:
    - audit_rules_dac_modification_umount2
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the umount2 rule in /etc/audit/audit.rules when on x86
  lineinfile:
    line: -a always,exit -F arch=b32 -S umount2 -F auid&gt;=1000 -F auid!=unset -F key=perm_mod
    state: present
    dest: /etc/audit/audit.rules
    create: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - audit_rules_dac_modification_umount2
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the umount2 rule in audit.rules when on x86_64
  lineinfile:
    line: -a always,exit -F arch=b64 -S umount2 -F auid&gt;=1000 -F auid!=unset -F key=perm_mod
    state: present
    dest: /etc/audit/audit.rules
    create: true
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - audit_arch is defined and audit_arch == 'b64'
  tags:
    - audit_rules_dac_modification_umount2
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_dac_modification_umount2:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-audit_rules_dac_modification_umount2_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_removexattr" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record Events that Modify the System's Discretionary Access Controls - removexattr</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">At a minimum, the audit system should collect file permission
changes for all users and root.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code>
program to read audit rules during daemon startup (the default), add the
following line to a file with suffix <html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S removexattr -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
If the system is 64 bit then also add the following line:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b64 -S removexattr -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the following line to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> file:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S removexattr -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
If the system is 64 bit then also add the following line:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b64 -S removexattr -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre></description>
            <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.</warning>
            <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</reference>
            <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</reference>
            <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.5.5</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000064-GPOS-00033</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000458-GPOS-00203</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000466-GPOS-00210</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</reference>
            <reference href="">SRG-OS-000458-VMM-001810</reference>
            <reference href="">SRG-OS-000474-VMM-001940</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.2.6.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO12.06</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI08.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS02.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS02.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS02.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.2.6</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.7.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.7</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.15.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.15.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.5</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.7</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.2.2</reference>
            <reference href="https://www.cisecurity.org/controls/">1</reference>
            <reference href="https://www.cisecurity.org/controls/">11</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">13</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">19</reference>
            <reference href="https://www.cisecurity.org/controls/">2</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">4</reference>
            <reference href="https://www.cisecurity.org/controls/">5</reference>
            <reference href="https://www.cisecurity.org/controls/">6</reference>
            <reference href="https://www.cisecurity.org/controls/">7</reference>
            <reference href="https://www.cisecurity.org/controls/">8</reference>
            <reference href="https://www.cisecurity.org/controls/">9</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The changing of file permissions could indicate that a user is attempting to
gain access to information that would otherwise be disallowed. Auditing DAC modifications
can facilitate the identification of patterns of abuse among both authorized and
unauthorized users.</rationale>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_dac_modification_removexattr" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then



# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	PATTERN="-a always,exit -F arch=$ARCH -S removexattr.*"
	GROUP="perm_mod"
	FULL_RULE="-a always,exit -F arch=$ARCH -S removexattr -F auid&gt;=1000 -F auid!=unset -F key=perm_mod"

	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_fix_audit_syscall_rule" use="legacy"/>
	fix_audit_syscall_rule "augenrules" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
	fix_audit_syscall_rule "auditctl" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_dac_modification_removexattr" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="low" strategy="restrict">- name: Set architecture for audit removexattr tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_removexattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Search /etc/audit/rules.d for other DAC audit rules
  find:
    paths: /etc/audit/rules.d
    recurse: false
    contains: -F key=perm_mod$
    patterns: '*.rules'
  register: find_removexattr
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_removexattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: If existing DAC ruleset not found, use /etc/audit/rules.d/privileged.rules
    as the recipient for the rule
  set_fact:
    all_files:
      - /etc/audit/rules.d/privileged.rules
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_removexattr.matched is defined and find_removexattr.matched == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_removexattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
      - '{{ find_removexattr.files | map(attribute=''path'') | list | first }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_removexattr.matched is defined and find_removexattr.matched &gt; 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_removexattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the removexattr rule in rules.d when on x86
  lineinfile:
    path: '{{ all_files[0] }}'
    line: -a always,exit -F arch=b32 -S removexattr -F auid&gt;=1000 -F auid!=unset -F
      key=perm_mod
    create: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_removexattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the removexattr rule in rules.d when on x86_64
  lineinfile:
    path: '{{ all_files[0] }}'
    line: -a always,exit -F arch=b64 -S removexattr -F auid&gt;=1000 -F auid!=unset -F
      key=perm_mod
    create: true
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - audit_arch is defined and audit_arch == 'b64'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_removexattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the removexattr rule in /etc/audit/audit.rules when on x86
  lineinfile:
    line: -a always,exit -F arch=b32 -S removexattr -F auid&gt;=1000 -F auid!=unset -F
      key=perm_mod
    state: present
    dest: /etc/audit/audit.rules
    create: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_removexattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the removexattr rule in audit.rules when on x86_64
  lineinfile:
    line: -a always,exit -F arch=b64 -S removexattr -F auid&gt;=1000 -F auid!=unset -F
      key=perm_mod
    state: present
    dest: /etc/audit/audit.rules
    create: true
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - audit_arch is defined and audit_arch == 'b64'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_removexattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_dac_modification_removexattr:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-audit_rules_dac_modification_removexattr_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fchmodat" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record Events that Modify the System's Discretionary Access Controls - fchmodat</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">At a minimum, the audit system should collect file permission
changes for all users and root. If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to
use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program to read audit rules during daemon startup
(the default), add the following line to a file with suffix <html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in
the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S fchmodat -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
If the system is 64 bit then also add the following line:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b64 -S fchmodat -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the following line to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> file:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S fchmodat -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
If the system is 64 bit then also add the following line:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b64 -S fchmodat -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre></description>
            <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.</warning>
            <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000126</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</reference>
            <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</reference>
            <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.5.5</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000064-GPOS-00033</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000458-GPOS-00203</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</reference>
            <reference href="">SRG-OS-000458-VMM-001810</reference>
            <reference href="">SRG-OS-000474-VMM-001940</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.2.6.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO12.06</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI08.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS02.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS02.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS02.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.2.6</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.7.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.7</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.15.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.15.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.5</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.7</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.2.2</reference>
            <reference href="https://www.cisecurity.org/controls/">1</reference>
            <reference href="https://www.cisecurity.org/controls/">11</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">13</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">19</reference>
            <reference href="https://www.cisecurity.org/controls/">2</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">4</reference>
            <reference href="https://www.cisecurity.org/controls/">5</reference>
            <reference href="https://www.cisecurity.org/controls/">6</reference>
            <reference href="https://www.cisecurity.org/controls/">7</reference>
            <reference href="https://www.cisecurity.org/controls/">8</reference>
            <reference href="https://www.cisecurity.org/controls/">9</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The changing of file permissions could indicate that a user is attempting to
gain access to information that would otherwise be disallowed. Auditing DAC modifications
can facilitate the identification of patterns of abuse among both authorized and
unauthorized users.</rationale>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_dac_modification_fchmodat" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then



# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	PATTERN="-a always,exit -F arch=$ARCH -S fchmodat.*"
	GROUP="perm_mod"
	FULL_RULE="-a always,exit -F arch=$ARCH -S fchmodat -F auid&gt;=1000 -F auid!=unset -F key=perm_mod"

	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_fix_audit_syscall_rule" use="legacy"/>
	fix_audit_syscall_rule "augenrules" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
	fix_audit_syscall_rule "auditctl" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_dac_modification_fchmodat" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="low" strategy="restrict">- name: Set architecture for audit fchmodat tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_fchmodat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Search /etc/audit/rules.d for other DAC audit rules
  find:
    paths: /etc/audit/rules.d
    recurse: false
    contains: -F key=perm_mod$
    patterns: '*.rules'
  register: find_fchmodat
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_fchmodat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: If existing DAC ruleset not found, use /etc/audit/rules.d/privileged.rules
    as the recipient for the rule
  set_fact:
    all_files:
      - /etc/audit/rules.d/privileged.rules
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_fchmodat.matched is defined and find_fchmodat.matched == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_fchmodat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
      - '{{ find_fchmodat.files | map(attribute=''path'') | list | first }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_fchmodat.matched is defined and find_fchmodat.matched &gt; 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_fchmodat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the fchmodat rule in rules.d when on x86
  lineinfile:
    path: '{{ all_files[0] }}'
    line: -a always,exit -F arch=b32 -S fchmodat -F auid&gt;=1000 -F auid!=unset -F key=perm_mod
    create: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_fchmodat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the fchmodat rule in rules.d when on x86_64
  lineinfile:
    path: '{{ all_files[0] }}'
    line: -a always,exit -F arch=b64 -S fchmodat -F auid&gt;=1000 -F auid!=unset -F key=perm_mod
    create: true
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - audit_arch is defined and audit_arch == 'b64'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_fchmodat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the fchmodat rule in /etc/audit/audit.rules when on x86
  lineinfile:
    line: -a always,exit -F arch=b32 -S fchmodat -F auid&gt;=1000 -F auid!=unset -F key=perm_mod
    state: present
    dest: /etc/audit/audit.rules
    create: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_fchmodat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the fchmodat rule in audit.rules when on x86_64
  lineinfile:
    line: -a always,exit -F arch=b64 -S fchmodat -F auid&gt;=1000 -F auid!=unset -F key=perm_mod
    state: present
    dest: /etc/audit/audit.rules
    create: true
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - audit_arch is defined and audit_arch == 'b64'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_fchmodat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_dac_modification_fchmodat:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-audit_rules_dac_modification_fchmodat_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_lsetxattr" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record Events that Modify the System's Discretionary Access Controls - lsetxattr</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">At a minimum, the audit system should collect file permission
changes for all users and root. If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured
to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following line to a file with suffix
<html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S lsetxattr -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
If the system is 64 bit then also add the following line:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b64 -S lsetxattr -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the following line to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> file:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S lsetxattr -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
If the system is 64 bit then also add the following line:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b64 -S lsetxattr -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre></description>
            <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.</warning>
            <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000126</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</reference>
            <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</reference>
            <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.5.5</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000064-GPOS-00033</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000458-GPOS-00203</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</reference>
            <reference href="">SRG-OS-000458-VMM-001810</reference>
            <reference href="">SRG-OS-000474-VMM-001940</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.2.6.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO12.06</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI08.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS02.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS02.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS02.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.2.6</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.7.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.7</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.15.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.15.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.5</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.7</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.2.2</reference>
            <reference href="https://www.cisecurity.org/controls/">1</reference>
            <reference href="https://www.cisecurity.org/controls/">11</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">13</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">19</reference>
            <reference href="https://www.cisecurity.org/controls/">2</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">4</reference>
            <reference href="https://www.cisecurity.org/controls/">5</reference>
            <reference href="https://www.cisecurity.org/controls/">6</reference>
            <reference href="https://www.cisecurity.org/controls/">7</reference>
            <reference href="https://www.cisecurity.org/controls/">8</reference>
            <reference href="https://www.cisecurity.org/controls/">9</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The changing of file permissions could indicate that a user is attempting to
gain access to information that would otherwise be disallowed. Auditing DAC modifications
can facilitate the identification of patterns of abuse among both authorized and
unauthorized users.</rationale>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_dac_modification_lsetxattr" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then



# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	PATTERN="-a always,exit -F arch=$ARCH -S lsetxattr.*"
	GROUP="perm_mod"
	FULL_RULE="-a always,exit -F arch=$ARCH -S lsetxattr -F auid&gt;=1000 -F auid!=unset -F key=perm_mod"

	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_fix_audit_syscall_rule" use="legacy"/>
	fix_audit_syscall_rule "augenrules" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
	fix_audit_syscall_rule "auditctl" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_dac_modification_lsetxattr" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="low" strategy="restrict">- name: Set architecture for audit lsetxattr tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_lsetxattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Search /etc/audit/rules.d for other DAC audit rules
  find:
    paths: /etc/audit/rules.d
    recurse: false
    contains: -F key=perm_mod$
    patterns: '*.rules'
  register: find_lsetxattr
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_lsetxattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: If existing DAC ruleset not found, use /etc/audit/rules.d/privileged.rules
    as the recipient for the rule
  set_fact:
    all_files:
      - /etc/audit/rules.d/privileged.rules
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_lsetxattr.matched is defined and find_lsetxattr.matched == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_lsetxattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
      - '{{ find_lsetxattr.files | map(attribute=''path'') | list | first }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_lsetxattr.matched is defined and find_lsetxattr.matched &gt; 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_lsetxattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the lsetxattr rule in rules.d when on x86
  lineinfile:
    path: '{{ all_files[0] }}'
    line: -a always,exit -F arch=b32 -S lsetxattr -F auid&gt;=1000 -F auid!=unset -F
      key=perm_mod
    create: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_lsetxattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the lsetxattr rule in rules.d when on x86_64
  lineinfile:
    path: '{{ all_files[0] }}'
    line: -a always,exit -F arch=b64 -S lsetxattr -F auid&gt;=1000 -F auid!=unset -F
      key=perm_mod
    create: true
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - audit_arch is defined and audit_arch == 'b64'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_lsetxattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the lsetxattr rule in /etc/audit/audit.rules when on x86
  lineinfile:
    line: -a always,exit -F arch=b32 -S lsetxattr -F auid&gt;=1000 -F auid!=unset -F
      key=perm_mod
    state: present
    dest: /etc/audit/audit.rules
    create: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_lsetxattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the lsetxattr rule in audit.rules when on x86_64
  lineinfile:
    line: -a always,exit -F arch=b64 -S lsetxattr -F auid&gt;=1000 -F auid!=unset -F
      key=perm_mod
    state: present
    dest: /etc/audit/audit.rules
    create: true
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - audit_arch is defined and audit_arch == 'b64'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_lsetxattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_dac_modification_lsetxattr:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-audit_rules_dac_modification_lsetxattr_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fchownat" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record Events that Modify the System's Discretionary Access Controls - fchownat</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">At a minimum, the audit system should collect file permission
changes for all users and root. If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured
to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following line to a file with suffix
<html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S fchownat -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
If the system is 64 bit then also add the following line:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b64 -S fchownat -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the following line to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> file:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S fchownat -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
If the system is 64 bit then also add the following line:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b64 -S fchownat -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre></description>
            <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.</warning>
            <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000126</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</reference>
            <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</reference>
            <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.5.5</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000064-GPOS-00033</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000458-GPOS-00203</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000474-GPOS-00219</reference>
            <reference href="">SRG-OS-000458-VMM-001810</reference>
            <reference href="">SRG-OS-000474-VMM-001940</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.2.6.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO12.06</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI08.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS02.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS02.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS02.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.2.6</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.7.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.7</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.15.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.15.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.5</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.7</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.2.2</reference>
            <reference href="https://www.cisecurity.org/controls/">1</reference>
            <reference href="https://www.cisecurity.org/controls/">11</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">13</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">19</reference>
            <reference href="https://www.cisecurity.org/controls/">2</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">4</reference>
            <reference href="https://www.cisecurity.org/controls/">5</reference>
            <reference href="https://www.cisecurity.org/controls/">6</reference>
            <reference href="https://www.cisecurity.org/controls/">7</reference>
            <reference href="https://www.cisecurity.org/controls/">8</reference>
            <reference href="https://www.cisecurity.org/controls/">9</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The changing of file permissions could indicate that a user is attempting to
gain access to information that would otherwise be disallowed. Auditing DAC modifications
can facilitate the identification of patterns of abuse among both authorized and
unauthorized users.</rationale>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_dac_modification_fchownat" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then



# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	PATTERN="-a always,exit -F arch=$ARCH -S fchownat.*"
	GROUP="perm_mod"
	FULL_RULE="-a always,exit -F arch=$ARCH -S fchownat -F auid&gt;=1000 -F auid!=unset -F key=perm_mod"

	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_fix_audit_syscall_rule" use="legacy"/>
	fix_audit_syscall_rule "augenrules" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
	fix_audit_syscall_rule "auditctl" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_dac_modification_fchownat" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="low" strategy="restrict">- name: Set architecture for audit fchownat tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_fchownat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Search /etc/audit/rules.d for other DAC audit rules
  find:
    paths: /etc/audit/rules.d
    recurse: false
    contains: -F key=perm_mod$
    patterns: '*.rules'
  register: find_fchownat
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_fchownat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: If existing DAC ruleset not found, use /etc/audit/rules.d/privileged.rules
    as the recipient for the rule
  set_fact:
    all_files:
      - /etc/audit/rules.d/privileged.rules
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_fchownat.matched is defined and find_fchownat.matched == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_fchownat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
      - '{{ find_fchownat.files | map(attribute=''path'') | list | first }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_fchownat.matched is defined and find_fchownat.matched &gt; 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_fchownat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the fchownat rule in rules.d when on x86
  lineinfile:
    path: '{{ all_files[0] }}'
    line: -a always,exit -F arch=b32 -S fchownat -F auid&gt;=1000 -F auid!=unset -F key=perm_mod
    create: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_fchownat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the fchownat rule in rules.d when on x86_64
  lineinfile:
    path: '{{ all_files[0] }}'
    line: -a always,exit -F arch=b64 -S fchownat -F auid&gt;=1000 -F auid!=unset -F key=perm_mod
    create: true
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - audit_arch is defined and audit_arch == 'b64'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_fchownat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the fchownat rule in /etc/audit/audit.rules when on x86
  lineinfile:
    line: -a always,exit -F arch=b32 -S fchownat -F auid&gt;=1000 -F auid!=unset -F key=perm_mod
    state: present
    dest: /etc/audit/audit.rules
    create: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_fchownat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the fchownat rule in audit.rules when on x86_64
  lineinfile:
    line: -a always,exit -F arch=b64 -S fchownat -F auid&gt;=1000 -F auid!=unset -F key=perm_mod
    state: present
    dest: /etc/audit/audit.rules
    create: true
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - audit_arch is defined and audit_arch == 'b64'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_fchownat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_dac_modification_fchownat:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-audit_rules_dac_modification_fchownat_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fremovexattr" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record Events that Modify the System's Discretionary Access Controls - fremovexattr</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">At a minimum, the audit system should collect file permission
changes for all users and root.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured
to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following line to a file with suffix
<html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S fremovexattr -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
If the system is 64 bit then also add the following line:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b64 -S fremovexattr -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the following line to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> file:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S fremovexattr -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
If the system is 64 bit then also add the following line:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b64 -S fremovexattr -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre></description>
            <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.</warning>
            <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</reference>
            <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</reference>
            <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.5.5</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000064-GPOS-00033</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000458-GPOS-00203</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000466-GPOS-00210</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</reference>
            <reference href="">SRG-OS-000458-VMM-001810</reference>
            <reference href="">SRG-OS-000474-VMM-001940</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.2.6.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO12.06</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI08.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS02.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS02.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS02.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.2.6</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.7.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.7</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.15.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.15.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.5</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.7</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.2.2</reference>
            <reference href="https://www.cisecurity.org/controls/">1</reference>
            <reference href="https://www.cisecurity.org/controls/">11</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">13</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">19</reference>
            <reference href="https://www.cisecurity.org/controls/">2</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">4</reference>
            <reference href="https://www.cisecurity.org/controls/">5</reference>
            <reference href="https://www.cisecurity.org/controls/">6</reference>
            <reference href="https://www.cisecurity.org/controls/">7</reference>
            <reference href="https://www.cisecurity.org/controls/">8</reference>
            <reference href="https://www.cisecurity.org/controls/">9</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The changing of file permissions could indicate that a user is attempting to
gain access to information that would otherwise be disallowed. Auditing DAC modifications
can facilitate the identification of patterns of abuse among both authorized and
unauthorized users.</rationale>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_dac_modification_fremovexattr" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then



# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	PATTERN="-a always,exit -F arch=$ARCH -S fremovexattr.*"
	GROUP="perm_mod"
	FULL_RULE="-a always,exit -F arch=$ARCH -S fremovexattr -F auid&gt;=1000 -F auid!=unset -F key=perm_mod"

	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_fix_audit_syscall_rule" use="legacy"/>
	fix_audit_syscall_rule "augenrules" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
	fix_audit_syscall_rule "auditctl" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_dac_modification_fremovexattr" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="low" strategy="restrict">- name: Set architecture for audit fremovexattr tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_fremovexattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Search /etc/audit/rules.d for other DAC audit rules
  find:
    paths: /etc/audit/rules.d
    recurse: false
    contains: -F key=perm_mod$
    patterns: '*.rules'
  register: find_fremovexattr
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_fremovexattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: If existing DAC ruleset not found, use /etc/audit/rules.d/privileged.rules
    as the recipient for the rule
  set_fact:
    all_files:
      - /etc/audit/rules.d/privileged.rules
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_fremovexattr.matched is defined and find_fremovexattr.matched == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_fremovexattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
      - '{{ find_fremovexattr.files | map(attribute=''path'') | list | first }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_fremovexattr.matched is defined and find_fremovexattr.matched &gt; 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_fremovexattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the fremovexattr rule in rules.d when on x86
  lineinfile:
    path: '{{ all_files[0] }}'
    line: -a always,exit -F arch=b32 -S fremovexattr -F auid&gt;=1000 -F auid!=unset
      -F key=perm_mod
    create: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_fremovexattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the fremovexattr rule in rules.d when on x86_64
  lineinfile:
    path: '{{ all_files[0] }}'
    line: -a always,exit -F arch=b64 -S fremovexattr -F auid&gt;=1000 -F auid!=unset
      -F key=perm_mod
    create: true
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - audit_arch is defined and audit_arch == 'b64'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_fremovexattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the fremovexattr rule in /etc/audit/audit.rules when on x86
  lineinfile:
    line: -a always,exit -F arch=b32 -S fremovexattr -F auid&gt;=1000 -F auid!=unset
      -F key=perm_mod
    state: present
    dest: /etc/audit/audit.rules
    create: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_fremovexattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the fremovexattr rule in audit.rules when on x86_64
  lineinfile:
    line: -a always,exit -F arch=b64 -S fremovexattr -F auid&gt;=1000 -F auid!=unset
      -F key=perm_mod
    state: present
    dest: /etc/audit/audit.rules
    create: true
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - audit_arch is defined and audit_arch == 'b64'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_fremovexattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_dac_modification_fremovexattr:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-audit_rules_dac_modification_fremovexattr_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_chmod" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record Events that Modify the System's Discretionary Access Controls - chmod</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">At a minimum, the audit system should collect file permission
changes for all users and root. If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to
use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program to read audit rules during daemon startup
(the default), add the following line to a file with suffix <html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in
the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S chmod -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
If the system is 64 bit then also add the following line:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b64 -S chmod -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the following line to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> file:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S chmod -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
If the system is 64 bit then also add the following line:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b64 -S chmod -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre></description>
            <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect.  Here the system calls
have been placed independent of other system calls.  Grouping these system
calls with others as identifying earlier in this guide is more efficient.</warning>
            <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000126</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</reference>
            <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</reference>
            <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.5.5</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000064-GPOS-00033</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000458-GPOS-00203</reference>
            <reference href="">SRG-OS-000458-VMM-001810</reference>
            <reference href="">SRG-OS-000474-VMM-001940</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.2.6.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO12.06</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI08.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS02.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS02.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS02.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.2.6</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.7.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.7</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.15.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.15.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.5</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.7</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.2.2</reference>
            <reference href="https://www.cisecurity.org/controls/">1</reference>
            <reference href="https://www.cisecurity.org/controls/">11</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">13</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">19</reference>
            <reference href="https://www.cisecurity.org/controls/">2</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">4</reference>
            <reference href="https://www.cisecurity.org/controls/">5</reference>
            <reference href="https://www.cisecurity.org/controls/">6</reference>
            <reference href="https://www.cisecurity.org/controls/">7</reference>
            <reference href="https://www.cisecurity.org/controls/">8</reference>
            <reference href="https://www.cisecurity.org/controls/">9</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The changing of file permissions could indicate that a user is attempting to
gain access to information that would otherwise be disallowed. Auditing DAC modifications
can facilitate the identification of patterns of abuse among both authorized and
unauthorized users.</rationale>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_dac_modification_chmod" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then



# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	PATTERN="-a always,exit -F arch=$ARCH -S chmod.*"
	GROUP="perm_mod"
	FULL_RULE="-a always,exit -F arch=$ARCH -S chmod -F auid&gt;=1000 -F auid!=unset -F key=perm_mod"

	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_fix_audit_syscall_rule" use="legacy"/>
	fix_audit_syscall_rule "augenrules" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
	fix_audit_syscall_rule "auditctl" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_dac_modification_chmod" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="low" strategy="restrict">- name: Set architecture for audit chmod tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_chmod
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Search /etc/audit/rules.d for other DAC audit rules
  find:
    paths: /etc/audit/rules.d
    recurse: false
    contains: -F key=perm_mod$
    patterns: '*.rules'
  register: find_chmod
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_chmod
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: If existing DAC ruleset not found, use /etc/audit/rules.d/privileged.rules
    as the recipient for the rule
  set_fact:
    all_files:
      - /etc/audit/rules.d/privileged.rules
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_chmod.matched is defined and find_chmod.matched == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_chmod
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
      - '{{ find_chmod.files | map(attribute=''path'') | list | first }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_chmod.matched is defined and find_chmod.matched &gt; 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_chmod
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the chmod rule in rules.d when on x86
  lineinfile:
    path: '{{ all_files[0] }}'
    line: -a always,exit -F arch=b32 -S chmod -F auid&gt;=1000 -F auid!=unset -F key=perm_mod
    create: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_chmod
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the chmod rule in rules.d when on x86_64
  lineinfile:
    path: '{{ all_files[0] }}'
    line: -a always,exit -F arch=b64 -S chmod -F auid&gt;=1000 -F auid!=unset -F key=perm_mod
    create: true
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - audit_arch is defined and audit_arch == 'b64'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_chmod
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the chmod rule in /etc/audit/audit.rules when on x86
  lineinfile:
    line: -a always,exit -F arch=b32 -S chmod -F auid&gt;=1000 -F auid!=unset -F key=perm_mod
    state: present
    dest: /etc/audit/audit.rules
    create: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_chmod
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the chmod rule in audit.rules when on x86_64
  lineinfile:
    line: -a always,exit -F arch=b64 -S chmod -F auid&gt;=1000 -F auid!=unset -F key=perm_mod
    state: present
    dest: /etc/audit/audit.rules
    create: true
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - audit_arch is defined and audit_arch == 'b64'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_chmod
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_dac_modification_chmod:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-audit_rules_dac_modification_chmod_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_umount" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record Events that Modify the System's Discretionary Access Controls - umount</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">At a minimum, the audit system should collect file system umount
changes. If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured
to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following line to a file with suffix
<html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S umount -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the following line to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> file:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S umount -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre></description>
            <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.</warning>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The changing of file permissions could indicate that a user is attempting to
gain access to information that would otherwise be disallowed. Auditing DAC modifications
can facilitate the identification of patterns of abuse among both authorized and
unauthorized users.</rationale>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_dac_modification_umount" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then



# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	PATTERN="-a always,exit -F arch=$ARCH -S umount.*"
	GROUP="perm_mod"
	FULL_RULE="-a always,exit -F arch=$ARCH -S umount -F auid&gt;=1000 -F auid!=unset -F key=perm_mod"

	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_fix_audit_syscall_rule" use="legacy"/>
	fix_audit_syscall_rule "augenrules" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
	fix_audit_syscall_rule "auditctl" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_dac_modification_umount" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="low" strategy="restrict">- name: Set architecture for audit umount tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - audit_rules_dac_modification_umount
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Search /etc/audit/rules.d for other DAC audit rules
  find:
    paths: /etc/audit/rules.d
    recurse: false
    contains: -F key=perm_mod$
    patterns: '*.rules'
  register: find_umount
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - audit_rules_dac_modification_umount
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: If existing DAC ruleset not found, use /etc/audit/rules.d/privileged.rules
    as the recipient for the rule
  set_fact:
    all_files:
      - /etc/audit/rules.d/privileged.rules
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_umount.matched is defined and find_umount.matched == 0
  tags:
    - audit_rules_dac_modification_umount
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
      - '{{ find_umount.files | map(attribute=''path'') | list | first }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_umount.matched is defined and find_umount.matched &gt; 0
  tags:
    - audit_rules_dac_modification_umount
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the umount rule in rules.d when on x86
  lineinfile:
    path: '{{ all_files[0] }}'
    line: -a always,exit -F arch=b32 -S umount -F auid&gt;=1000 -F auid!=unset -F key=perm_mod
    create: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - audit_rules_dac_modification_umount
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the umount rule in rules.d when on x86_64
  lineinfile:
    path: '{{ all_files[0] }}'
    line: -a always,exit -F arch=b64 -S umount -F auid&gt;=1000 -F auid!=unset -F key=perm_mod
    create: true
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - audit_arch is defined and audit_arch == 'b64'
  tags:
    - audit_rules_dac_modification_umount
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the umount rule in /etc/audit/audit.rules when on x86
  lineinfile:
    line: -a always,exit -F arch=b32 -S umount -F auid&gt;=1000 -F auid!=unset -F key=perm_mod
    state: present
    dest: /etc/audit/audit.rules
    create: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - audit_rules_dac_modification_umount
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the umount rule in audit.rules when on x86_64
  lineinfile:
    line: -a always,exit -F arch=b64 -S umount -F auid&gt;=1000 -F auid!=unset -F key=perm_mod
    state: present
    dest: /etc/audit/audit.rules
    create: true
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - audit_arch is defined and audit_arch == 'b64'
  tags:
    - audit_rules_dac_modification_umount
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_dac_modification_umount:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-audit_rules_dac_modification_umount_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_lremovexattr" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record Events that Modify the System's Discretionary Access Controls - lremovexattr</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">At a minimum, the audit system should collect file permission
changes for all users and root.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured
to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following line to a file with suffix
<html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S lremovexattr -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
If the system is 64 bit then also add the following line:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b64 -S lremovexattr -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the following line to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> file:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S lremovexattr -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
If the system is 64 bit then also add the following line:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b64 -S lremovexattr -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre></description>
            <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.</warning>
            <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</reference>
            <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</reference>
            <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.5.5</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000064-GPOS-00033</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000458-GPOS-00203</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000466-GPOS-00210</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</reference>
            <reference href="">SRG-OS-000458-VMM-001810</reference>
            <reference href="">SRG-OS-000474-VMM-001940</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.2.6.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO12.06</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI08.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS02.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS02.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS02.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.2.6</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.7.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.7</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.15.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.15.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.5</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.7</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.2.2</reference>
            <reference href="https://www.cisecurity.org/controls/">1</reference>
            <reference href="https://www.cisecurity.org/controls/">11</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">13</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">19</reference>
            <reference href="https://www.cisecurity.org/controls/">2</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">4</reference>
            <reference href="https://www.cisecurity.org/controls/">5</reference>
            <reference href="https://www.cisecurity.org/controls/">6</reference>
            <reference href="https://www.cisecurity.org/controls/">7</reference>
            <reference href="https://www.cisecurity.org/controls/">8</reference>
            <reference href="https://www.cisecurity.org/controls/">9</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The changing of file permissions could indicate that a user is attempting to
gain access to information that would otherwise be disallowed. Auditing DAC modifications
can facilitate the identification of patterns of abuse among both authorized and
unauthorized users.</rationale>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_dac_modification_lremovexattr" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then



# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	PATTERN="-a always,exit -F arch=$ARCH -S lremovexattr.*"
	GROUP="perm_mod"
	FULL_RULE="-a always,exit -F arch=$ARCH -S lremovexattr -F auid&gt;=1000 -F auid!=unset -F key=perm_mod"

	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_fix_audit_syscall_rule" use="legacy"/>
	fix_audit_syscall_rule "augenrules" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
	fix_audit_syscall_rule "auditctl" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_dac_modification_lremovexattr" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="low" strategy="restrict">- name: Set architecture for audit lremovexattr tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_lremovexattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Search /etc/audit/rules.d for other DAC audit rules
  find:
    paths: /etc/audit/rules.d
    recurse: false
    contains: -F key=perm_mod$
    patterns: '*.rules'
  register: find_lremovexattr
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_lremovexattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: If existing DAC ruleset not found, use /etc/audit/rules.d/privileged.rules
    as the recipient for the rule
  set_fact:
    all_files:
      - /etc/audit/rules.d/privileged.rules
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_lremovexattr.matched is defined and find_lremovexattr.matched == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_lremovexattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
      - '{{ find_lremovexattr.files | map(attribute=''path'') | list | first }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_lremovexattr.matched is defined and find_lremovexattr.matched &gt; 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_lremovexattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the lremovexattr rule in rules.d when on x86
  lineinfile:
    path: '{{ all_files[0] }}'
    line: -a always,exit -F arch=b32 -S lremovexattr -F auid&gt;=1000 -F auid!=unset
      -F key=perm_mod
    create: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_lremovexattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the lremovexattr rule in rules.d when on x86_64
  lineinfile:
    path: '{{ all_files[0] }}'
    line: -a always,exit -F arch=b64 -S lremovexattr -F auid&gt;=1000 -F auid!=unset
      -F key=perm_mod
    create: true
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - audit_arch is defined and audit_arch == 'b64'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_lremovexattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the lremovexattr rule in /etc/audit/audit.rules when on x86
  lineinfile:
    line: -a always,exit -F arch=b32 -S lremovexattr -F auid&gt;=1000 -F auid!=unset
      -F key=perm_mod
    state: present
    dest: /etc/audit/audit.rules
    create: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_lremovexattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the lremovexattr rule in audit.rules when on x86_64
  lineinfile:
    line: -a always,exit -F arch=b64 -S lremovexattr -F auid&gt;=1000 -F auid!=unset
      -F key=perm_mod
    state: present
    dest: /etc/audit/audit.rules
    create: true
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - audit_arch is defined and audit_arch == 'b64'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_lremovexattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_dac_modification_lremovexattr:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-audit_rules_dac_modification_lremovexattr_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_lchown" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record Events that Modify the System's Discretionary Access Controls - lchown</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">At a minimum, the audit system should collect file permission
changes for all users and root. If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured
to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following line to a file with suffix
<html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S lchown -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
If the system is 64 bit then also add the following line:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b64 -S lchown -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the following line to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> file:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S lchown -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
If the system is 64 bit then also add the following line:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b64 -S lchown -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre></description>
            <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.</warning>
            <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000126</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</reference>
            <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</reference>
            <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.5.5</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000064-GPOS-00033</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000458-GPOS-00203</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000474-GPOS-00219</reference>
            <reference href="">SRG-OS-000458-VMM-001810</reference>
            <reference href="">SRG-OS-000474-VMM-001940</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.2.6.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO12.06</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI08.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS02.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS02.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS02.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.2.6</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.7.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.7</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.15.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.15.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.5</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.7</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.2.2</reference>
            <reference href="https://www.cisecurity.org/controls/">1</reference>
            <reference href="https://www.cisecurity.org/controls/">11</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">13</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">19</reference>
            <reference href="https://www.cisecurity.org/controls/">2</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">4</reference>
            <reference href="https://www.cisecurity.org/controls/">5</reference>
            <reference href="https://www.cisecurity.org/controls/">6</reference>
            <reference href="https://www.cisecurity.org/controls/">7</reference>
            <reference href="https://www.cisecurity.org/controls/">8</reference>
            <reference href="https://www.cisecurity.org/controls/">9</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The changing of file permissions could indicate that a user is attempting to
gain access to information that would otherwise be disallowed. Auditing DAC modifications
can facilitate the identification of patterns of abuse among both authorized and
unauthorized users.</rationale>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_dac_modification_lchown" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then



# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	PATTERN="-a always,exit -F arch=$ARCH -S lchown.*"
	GROUP="perm_mod"
	FULL_RULE="-a always,exit -F arch=$ARCH -S lchown -F auid&gt;=1000 -F auid!=unset -F key=perm_mod"

	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_fix_audit_syscall_rule" use="legacy"/>
	fix_audit_syscall_rule "augenrules" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
	fix_audit_syscall_rule "auditctl" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_dac_modification_lchown" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="low" strategy="restrict">- name: Set architecture for audit lchown tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_lchown
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Search /etc/audit/rules.d for other DAC audit rules
  find:
    paths: /etc/audit/rules.d
    recurse: false
    contains: -F key=perm_mod$
    patterns: '*.rules'
  register: find_lchown
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_lchown
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: If existing DAC ruleset not found, use /etc/audit/rules.d/privileged.rules
    as the recipient for the rule
  set_fact:
    all_files:
      - /etc/audit/rules.d/privileged.rules
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_lchown.matched is defined and find_lchown.matched == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_lchown
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
      - '{{ find_lchown.files | map(attribute=''path'') | list | first }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_lchown.matched is defined and find_lchown.matched &gt; 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_lchown
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the lchown rule in rules.d when on x86
  lineinfile:
    path: '{{ all_files[0] }}'
    line: -a always,exit -F arch=b32 -S lchown -F auid&gt;=1000 -F auid!=unset -F key=perm_mod
    create: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_lchown
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the lchown rule in rules.d when on x86_64
  lineinfile:
    path: '{{ all_files[0] }}'
    line: -a always,exit -F arch=b64 -S lchown -F auid&gt;=1000 -F auid!=unset -F key=perm_mod
    create: true
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - audit_arch is defined and audit_arch == 'b64'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_lchown
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the lchown rule in /etc/audit/audit.rules when on x86
  lineinfile:
    line: -a always,exit -F arch=b32 -S lchown -F auid&gt;=1000 -F auid!=unset -F key=perm_mod
    state: present
    dest: /etc/audit/audit.rules
    create: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_lchown
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the lchown rule in audit.rules when on x86_64
  lineinfile:
    line: -a always,exit -F arch=b64 -S lchown -F auid&gt;=1000 -F auid!=unset -F key=perm_mod
    state: present
    dest: /etc/audit/audit.rules
    create: true
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - audit_arch is defined and audit_arch == 'b64'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_lchown
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_dac_modification_lchown:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-audit_rules_dac_modification_lchown_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_chown" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record Events that Modify the System's Discretionary Access Controls - chown</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">At a minimum, the audit system should collect file permission
changes for all users and root. If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to
use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program to read audit rules during daemon startup
(the default), add the following line to a file with suffix <html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in
the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S chown -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
If the system is 64 bit then also add the following line:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b64 -S chown -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the following line to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> file:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S chown -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
If the system is 64 bit then also add the following line:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b64 -S chown -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre></description>
            <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect.  Here the system calls
have been placed independent of other system calls.  Grouping these system
calls with others as identifying earlier in this guide is more efficient.</warning>
            <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000126</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</reference>
            <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</reference>
            <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.5.5</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000064-GPOS-00033</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000458-GPOS-00203</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000474-GPOS-00219</reference>
            <reference href="">SRG-OS-000458-VMM-001810</reference>
            <reference href="">SRG-OS-000474-VMM-001940</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.2.6.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO12.06</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI08.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS02.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS02.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS02.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.2.6</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.7.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.7</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.15.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.15.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.5</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.7</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.2.2</reference>
            <reference href="https://www.cisecurity.org/controls/">1</reference>
            <reference href="https://www.cisecurity.org/controls/">11</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">13</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">19</reference>
            <reference href="https://www.cisecurity.org/controls/">2</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">4</reference>
            <reference href="https://www.cisecurity.org/controls/">5</reference>
            <reference href="https://www.cisecurity.org/controls/">6</reference>
            <reference href="https://www.cisecurity.org/controls/">7</reference>
            <reference href="https://www.cisecurity.org/controls/">8</reference>
            <reference href="https://www.cisecurity.org/controls/">9</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The changing of file permissions could indicate that a user is attempting to
gain access to information that would otherwise be disallowed. Auditing DAC modifications
can facilitate the identification of patterns of abuse among both authorized and
unauthorized users.</rationale>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_dac_modification_chown" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then



# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	PATTERN="-a always,exit -F arch=$ARCH -S chown.*"
	GROUP="perm_mod"
	FULL_RULE="-a always,exit -F arch=$ARCH -S chown -F auid&gt;=1000 -F auid!=unset -F key=perm_mod"

	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_fix_audit_syscall_rule" use="legacy"/>
	fix_audit_syscall_rule "augenrules" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
	fix_audit_syscall_rule "auditctl" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_dac_modification_chown" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="low" strategy="restrict">- name: Set architecture for audit chown tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_chown
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Search /etc/audit/rules.d for other DAC audit rules
  find:
    paths: /etc/audit/rules.d
    recurse: false
    contains: -F key=perm_mod$
    patterns: '*.rules'
  register: find_chown
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_chown
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: If existing DAC ruleset not found, use /etc/audit/rules.d/privileged.rules
    as the recipient for the rule
  set_fact:
    all_files:
      - /etc/audit/rules.d/privileged.rules
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_chown.matched is defined and find_chown.matched == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_chown
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
      - '{{ find_chown.files | map(attribute=''path'') | list | first }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_chown.matched is defined and find_chown.matched &gt; 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_chown
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the chown rule in rules.d when on x86
  lineinfile:
    path: '{{ all_files[0] }}'
    line: -a always,exit -F arch=b32 -S chown -F auid&gt;=1000 -F auid!=unset -F key=perm_mod
    create: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_chown
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the chown rule in rules.d when on x86_64
  lineinfile:
    path: '{{ all_files[0] }}'
    line: -a always,exit -F arch=b64 -S chown -F auid&gt;=1000 -F auid!=unset -F key=perm_mod
    create: true
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - audit_arch is defined and audit_arch == 'b64'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_chown
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the chown rule in /etc/audit/audit.rules when on x86
  lineinfile:
    line: -a always,exit -F arch=b32 -S chown -F auid&gt;=1000 -F auid!=unset -F key=perm_mod
    state: present
    dest: /etc/audit/audit.rules
    create: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_chown
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the chown rule in audit.rules when on x86_64
  lineinfile:
    line: -a always,exit -F arch=b64 -S chown -F auid&gt;=1000 -F auid!=unset -F key=perm_mod
    state: present
    dest: /etc/audit/audit.rules
    create: true
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - audit_arch is defined and audit_arch == 'b64'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_chown
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_dac_modification_chown:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-audit_rules_dac_modification_chown_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fchmod" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record Events that Modify the System's Discretionary Access Controls - fchmod</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">At a minimum, the audit system should collect file permission
changes for all users and root. If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to
use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program to read audit rules during daemon startup
(the default), add the following line to a file with suffix <html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in
the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S fchmod -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
If the system is 64 bit then also add the following line:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b64 -S fchmod -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the following line to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> file:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S fchmod -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
If the system is 64 bit then also add the following line:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b64 -S fchmod -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre></description>
            <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.</warning>
            <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000126</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</reference>
            <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</reference>
            <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.5.5</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000064-GPOS-00033</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000458-GPOS-00203</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</reference>
            <reference href="">SRG-OS-000458-VMM-001810</reference>
            <reference href="">SRG-OS-000474-VMM-001940</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.2.6.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO12.06</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI08.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS02.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS02.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS02.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.2.6</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.7.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.7</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.15.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.15.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.5</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.7</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.2.2</reference>
            <reference href="https://www.cisecurity.org/controls/">1</reference>
            <reference href="https://www.cisecurity.org/controls/">11</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">13</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">19</reference>
            <reference href="https://www.cisecurity.org/controls/">2</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">4</reference>
            <reference href="https://www.cisecurity.org/controls/">5</reference>
            <reference href="https://www.cisecurity.org/controls/">6</reference>
            <reference href="https://www.cisecurity.org/controls/">7</reference>
            <reference href="https://www.cisecurity.org/controls/">8</reference>
            <reference href="https://www.cisecurity.org/controls/">9</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The changing of file permissions could indicate that a user is attempting to
gain access to information that would otherwise be disallowed. Auditing DAC modifications
can facilitate the identification of patterns of abuse among both authorized and
unauthorized users.</rationale>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_dac_modification_fchmod" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then



# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	PATTERN="-a always,exit -F arch=$ARCH -S fchmod.*"
	GROUP="perm_mod"
	FULL_RULE="-a always,exit -F arch=$ARCH -S fchmod -F auid&gt;=1000 -F auid!=unset -F key=perm_mod"

	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_fix_audit_syscall_rule" use="legacy"/>
	fix_audit_syscall_rule "augenrules" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
	fix_audit_syscall_rule "auditctl" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_dac_modification_fchmod" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="low" strategy="restrict">- name: Set architecture for audit fchmod tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_fchmod
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Search /etc/audit/rules.d for other DAC audit rules
  find:
    paths: /etc/audit/rules.d
    recurse: false
    contains: -F key=perm_mod$
    patterns: '*.rules'
  register: find_fchmod
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_fchmod
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: If existing DAC ruleset not found, use /etc/audit/rules.d/privileged.rules
    as the recipient for the rule
  set_fact:
    all_files:
      - /etc/audit/rules.d/privileged.rules
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_fchmod.matched is defined and find_fchmod.matched == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_fchmod
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
      - '{{ find_fchmod.files | map(attribute=''path'') | list | first }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_fchmod.matched is defined and find_fchmod.matched &gt; 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_fchmod
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the fchmod rule in rules.d when on x86
  lineinfile:
    path: '{{ all_files[0] }}'
    line: -a always,exit -F arch=b32 -S fchmod -F auid&gt;=1000 -F auid!=unset -F key=perm_mod
    create: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_fchmod
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the fchmod rule in rules.d when on x86_64
  lineinfile:
    path: '{{ all_files[0] }}'
    line: -a always,exit -F arch=b64 -S fchmod -F auid&gt;=1000 -F auid!=unset -F key=perm_mod
    create: true
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - audit_arch is defined and audit_arch == 'b64'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_fchmod
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the fchmod rule in /etc/audit/audit.rules when on x86
  lineinfile:
    line: -a always,exit -F arch=b32 -S fchmod -F auid&gt;=1000 -F auid!=unset -F key=perm_mod
    state: present
    dest: /etc/audit/audit.rules
    create: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_fchmod
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the fchmod rule in audit.rules when on x86_64
  lineinfile:
    line: -a always,exit -F arch=b64 -S fchmod -F auid&gt;=1000 -F auid!=unset -F key=perm_mod
    state: present
    dest: /etc/audit/audit.rules
    create: true
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - audit_arch is defined and audit_arch == 'b64'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_fchmod
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_dac_modification_fchmod:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-audit_rules_dac_modification_fchmod_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fchown" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record Events that Modify the System's Discretionary Access Controls - fchown</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">At a minimum, the audit system should collect file permission
changes for all users and root. If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured
to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following line to a file with suffix
<html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S fchown -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>

If the system is 64 bit then also add the following line:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b64 -S fchown -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>

If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the following line to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> file:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S fchown -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>

If the system is 64 bit then also add the following line:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b64 -S fchown -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre></description>
            <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.</warning>
            <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000126</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</reference>
            <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</reference>
            <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.5.5</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000064-GPOS-00033</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000458-GPOS-00203</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000474-GPOS-00219</reference>
            <reference href="">SRG-OS-000458-VMM-001810</reference>
            <reference href="">SRG-OS-000474-VMM-001940</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.2.6.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO10.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO12.06</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI08.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS02.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS02.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS02.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA01.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.2.6</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.4.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.7.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.7</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.15.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.15.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.5</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.16.1.7</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.2.2</reference>
            <reference href="https://www.cisecurity.org/controls/">1</reference>
            <reference href="https://www.cisecurity.org/controls/">11</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">13</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">19</reference>
            <reference href="https://www.cisecurity.org/controls/">2</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">4</reference>
            <reference href="https://www.cisecurity.org/controls/">5</reference>
            <reference href="https://www.cisecurity.org/controls/">6</reference>
            <reference href="https://www.cisecurity.org/controls/">7</reference>
            <reference href="https://www.cisecurity.org/controls/">8</reference>
            <reference href="https://www.cisecurity.org/controls/">9</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The changing of file permissions could indicate that a user is attempting to
gain access to information that would otherwise be disallowed. Auditing DAC modifications
can facilitate the identification of patterns of abuse among both authorized and
unauthorized users.</rationale>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_dac_modification_fchown" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then



# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	PATTERN="-a always,exit -F arch=$ARCH -S fchown.*"
	GROUP="perm_mod"
	FULL_RULE="-a always,exit -F arch=$ARCH -S fchown -F auid&gt;=1000 -F auid!=unset -F key=perm_mod"

	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_fix_audit_syscall_rule" use="legacy"/>
	fix_audit_syscall_rule "augenrules" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
	fix_audit_syscall_rule "auditctl" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_dac_modification_fchown" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="low" strategy="restrict">- name: Set architecture for audit fchown tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_fchown
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Search /etc/audit/rules.d for other DAC audit rules
  find:
    paths: /etc/audit/rules.d
    recurse: false
    contains: -F key=perm_mod$
    patterns: '*.rules'
  register: find_fchown
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_fchown
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: If existing DAC ruleset not found, use /etc/audit/rules.d/privileged.rules
    as the recipient for the rule
  set_fact:
    all_files:
      - /etc/audit/rules.d/privileged.rules
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_fchown.matched is defined and find_fchown.matched == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_fchown
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
      - '{{ find_fchown.files | map(attribute=''path'') | list | first }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_fchown.matched is defined and find_fchown.matched &gt; 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_fchown
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the fchown rule in rules.d when on x86
  lineinfile:
    path: '{{ all_files[0] }}'
    line: -a always,exit -F arch=b32 -S fchown -F auid&gt;=1000 -F auid!=unset -F key=perm_mod
    create: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_fchown
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the fchown rule in rules.d when on x86_64
  lineinfile:
    path: '{{ all_files[0] }}'
    line: -a always,exit -F arch=b64 -S fchown -F auid&gt;=1000 -F auid!=unset -F key=perm_mod
    create: true
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - audit_arch is defined and audit_arch == 'b64'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_fchown
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the fchown rule in /etc/audit/audit.rules when on x86
  lineinfile:
    line: -a always,exit -F arch=b32 -S fchown -F auid&gt;=1000 -F auid!=unset -F key=perm_mod
    state: present
    dest: /etc/audit/audit.rules
    create: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_fchown
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the fchown rule in audit.rules when on x86_64
  lineinfile:
    line: -a always,exit -F arch=b64 -S fchown -F auid&gt;=1000 -F auid!=unset -F key=perm_mod
    state: present
    dest: /etc/audit/audit.rules
    create: true
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - audit_arch is defined and audit_arch == 'b64'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_fchown
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_dac_modification_fchown:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-audit_rules_dac_modification_fchown_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
        </Group>
      </Group>
      <Group id="xccdf_org.ssgproject.content_group_configure_auditd_data_retention">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Configure auditd Data Retention</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The audit system writes data to <html:code xmlns:html="http://www.w3.org/1999/xhtml">/var/log/audit/audit.log</html:code>. By default,
<html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> rotates 5 logs by size (6MB), retaining a maximum of 30MB of
data in total, and refuses to write entries when the disk is too
full. This minimizes the risk of audit data filling its partition
and impacting other services. This also minimizes the risk of the audit
daemon temporarily disabling the system if it cannot write audit log (which
it can be configured to do).

For a busy
system or a system which is thoroughly auditing system activity, the default settings
for data retention may be
 insufficient. The log file size needed will depend heavily on what types
of events are being audited. First configure auditing to log all the events of
interest. Then monitor the log size manually for awhile to determine what file
size will allow you to keep the required data for the correct time period.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Using a dedicated partition for <html:code xmlns:html="http://www.w3.org/1999/xhtml">/var/log/audit</html:code> prevents the
<html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> logs from disrupting system functionality if they fill, and,
more importantly, prevents other activity in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/var</html:code> from filling the
partition and stopping the audit trail. (The audit logs are size-limited and
therefore unlikely to grow without bound unless configured to do so.) Some
machines may have requirements that no actions occur which cannot be audited.
If this is the case, then <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> can be configured to halt the machine
if it runs out of space. <html:b xmlns:html="http://www.w3.org/1999/xhtml">Note:</html:b> Since older logs are rotated,
configuring <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> this way does not prevent older logs from being
rotated away before they can be viewed.

<html:i xmlns:html="http://www.w3.org/1999/xhtml">If your system is configured to halt when logging cannot be performed, make
sure this can never happen under normal circumstances! Ensure that
<html:code>/var/log/audit</html:code> is on its own partition, and that this partition is
larger than the maximum amount of data <html:code>auditd</html:code> will retain
normally.</html:i></description>
        <platform idref="cpe:/a:machine"/>
        <Value id="xccdf_org.ssgproject.content_value_var_audispd_disk_full_action" type="string">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Action for audispd to take when disk is full</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The setting for disk_full_action in /etc/audisp/audisp-remote.conf</description>
          <value>single</value>
          <value selector="exec">exec</value>
          <value selector="halt">halt</value>
          <value selector="single">single</value>
          <value selector="suspend">suspend</value>
          <value selector="syslog">syslog</value>
          <value selector="warn_once">warn_once</value>
          <value selector="stop">stop</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_audispd_network_failure_action" type="string">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Action for audispd to take when network fails</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The setting for network_failure_action in /etc/audisp/audisp-remote.conf</description>
          <value>single</value>
          <value selector="exec">exec</value>
          <value selector="halt">halt</value>
          <value selector="single">single</value>
          <value selector="suspend">suspend</value>
          <value selector="syslog">syslog</value>
          <value selector="warn_once">warn_once</value>
          <value selector="stop">stop</value>
          <value selector="ignore">ignore</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_audispd_remote_server" type="string" interactive="true">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Remote server for audispd to send audit records</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">
The setting for remote_server in /etc/audit/audisp-remote.conf</description>
          <value>logcollector</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_auditd_action_mail_acct" type="string">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Account for auditd to send email when actions occurs</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The setting for action_mail_acct in /etc/audit/auditd.conf</description>
          <value selector="admin">admin</value>
          <value>root</value>
          <value selector="root">root</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_auditd_admin_space_left_action" type="string">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Action for auditd to take when disk space is low</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The setting for admin_space_left_action in /etc/audit/auditd.conf</description>
          <value>single</value>
          <value selector="email">email</value>
          <value selector="exec">exec</value>
          <value selector="halt">halt</value>
          <value selector="single">single</value>
          <value selector="suspend">suspend</value>
          <value selector="syslog">syslog</value>
          <value selector="rotate">rotate</value>
          <value selector="ignore">ignore</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_auditd_disk_error_action" type="string">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Action for auditd to take when disk errors</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The setting for disk_error_action in /etc/audit/auditd.conf</description>
          <value>single</value>
          <value selector="exec">exec</value>
          <value selector="halt">halt</value>
          <value selector="single">single</value>
          <value selector="suspend">suspend</value>
          <value selector="syslog">syslog</value>
          <value selector="ignore">ignore</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_auditd_disk_full_action" type="string">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Action for auditd to take when disk is full</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The setting for disk_full_action in /etc/audit/auditd.conf</description>
          <value>single</value>
          <value selector="exec">exec</value>
          <value selector="halt">halt</value>
          <value selector="single">single</value>
          <value selector="suspend">suspend</value>
          <value selector="syslog">syslog</value>
          <value selector="ignore">ignore</value>
          <value selector="rotate">rotate</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_auditd_flush" type="string">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Auditd priority for flushing data to disk</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The setting for flush in /etc/audit/auditd.conf</description>
          <value selector="data">data</value>
          <value>data</value>
          <value selector="incremental">incremental</value>
          <value selector="incremental_async">incremental_async</value>
          <value selector="none">none</value>
          <value selector="sync">sync</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_auditd_max_log_file" type="number">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Maximum audit log file size for auditd</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The setting for max_log_size in /etc/audit/auditd.conf</description>
          <value selector="1">1</value>
          <value selector="10">10</value>
          <value selector="20">20</value>
          <value selector="5">5</value>
          <value selector="6">6</value>
          <value>6</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_auditd_max_log_file_action" type="string">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Action for auditd to take when log files reach their maximum size</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The setting for max_log_file_action in /etc/audit/auditd.conf</description>
          <value>rotate</value>
          <value selector="keep_logs">keep_logs</value>
          <value selector="rotate">rotate</value>
          <value selector="suspend">suspend</value>
          <value selector="syslog">syslog</value>
          <value selector="ignore">ignore</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_auditd_num_logs" type="number">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Number of log files for auditd to retain</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The setting for num_logs in /etc/audit/auditd.conf</description>
          <value selector="0">0</value>
          <value selector="1">1</value>
          <value selector="2">2</value>
          <value selector="3">3</value>
          <value selector="4">4</value>
          <value selector="5">5</value>
          <value>5</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_auditd_space_left" type="number">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Size remaining in disk space before prompting space_left_action</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The setting for space_left (MB) in /etc/audit/auditd.conf</description>
          <value selector="1000MB">1000</value>
          <value selector="100MB">100</value>
          <value selector="250MB">250</value>
          <value selector="500MB">500</value>
          <value selector="750MB">750</value>
          <value>100</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_auditd_space_left_action" type="string">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Action for auditd to take when disk space just starts to run low</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The setting for space_left_action in /etc/audit/auditd.conf</description>
          <value>email</value>
          <value selector="email">email</value>
          <value selector="exec">exec</value>
          <value selector="halt">halt</value>
          <value selector="single">single</value>
          <value selector="suspend">suspend</value>
          <value selector="syslog">syslog</value>
          <value selector="rotate">rotate</value>
          <value selector="ignore">ignore</value>
        </Value>
        <Rule id="xccdf_org.ssgproject.content_rule_auditd_audispd_configure_remote_server" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Configure audispd Plugin To Send Logs To Remote Server</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Configure the audispd plugin to off-load audit records onto a different
system or media from the system being audited.
Set the <html:code xmlns:html="http://www.w3.org/1999/xhtml">remote_server</html:code> option in <html:pre xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audisp-remote.conf</html:pre>
with an IP address or hostname of the system that the audispd plugin should
send audit records to. For example
<html:pre xmlns:html="http://www.w3.org/1999/xhtml" xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2">remote_server = <html:i><xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_audispd_remote_server" use="legacy"/></html:i></html:pre></description>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-001851</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000342-GPOS-00133</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000479-GPOS-00224</reference>
          <reference href="">SRG-OS-000051-VMM-000230</reference>
          <reference href="">SRG-OS-000058-VMM-000270</reference>
          <reference href="">SRG-OS-000059-VMM-000280</reference>
          <reference href="">SRG-OS-000479-VMM-001990</reference>
          <reference href="">SRG-OS-000479-VMM-001990</reference>
          <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Information stored in one location is vulnerable to accidental or incidental
deletion or alteration.Off-loading is a common process in information systems
with limited audit storage capacity.</rationale>
          <platform idref="cpe:/a:machine"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="auditd_audispd_configure_remote_server" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then


var_audispd_remote_server="<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_audispd_remote_server" use="legacy"/>"




AUDITCONFIG=/etc/audit/audisp-remote.conf
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_replace_or_append" use="legacy"/>
replace_or_append $AUDITCONFIG '^remote_server' "$var_audispd_remote_server" ""

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="auditd_audispd_configure_remote_server" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: XCCDF Value var_audispd_remote_server # promote to variable
  set_fact:
    var_audispd_remote_server: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_audispd_remote_server" use="legacy"/>
  tags:
    - always

- name: Make sure that a remote server is configured for Audispd
  lineinfile:
    path: /etc/audit/audisp-remote.conf
    line: remote_server = {{ var_audispd_remote_server }}
    regexp: ^\s*remote_server\s*=.*$
    create: true
    state: present
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - auditd_audispd_configure_remote_server
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export export-name="oval:ssg-var_audispd_remote_server:var:1" value-id="xccdf_org.ssgproject.content_value_var_audispd_remote_server"/>
            <check-content-ref name="oval:ssg-auditd_audispd_configure_remote_server:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-auditd_audispd_configure_remote_server_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_auditd_audispd_encrypt_sent_records" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Encrypt Audit Records Sent With audispd Plugin</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Configure the operating system to encrypt the transfer of off-loaded audit
records onto a different system or media from the system being audited.

Set the <html:code xmlns:html="http://www.w3.org/1999/xhtml">transport</html:code> option in <html:pre xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audisp-remote.conf</html:pre>
to <html:code xmlns:html="http://www.w3.org/1999/xhtml">KRB5</html:code>.</description>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-001851</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-9(3)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000342-GPOS-00133</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000479-GPOS-00224</reference>
          <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Information stored in one location is vulnerable to accidental or incidental deletion
or alteration. Off-loading is a common process in information systems with limited
audit storage capacity.</rationale>
          <platform idref="cpe:/a:machine"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="auditd_audispd_encrypt_sent_records" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then




AUDISP_REMOTE_CONFIG="/etc/audit/audisp-remote.conf"
option="^transport"
value="KRB5"
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_replace_or_append" use="legacy"/>
replace_or_append $AUDISP_REMOTE_CONFIG "$option" "$value" ""

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-auditd_audispd_encrypt_sent_records:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-auditd_audispd_encrypt_sent_records_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_auditd_data_retention_action_mail_acct" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Configure auditd mail_acct Action on Low Disk Space</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> service can be configured to send email to
a designated account in certain situations. Add or correct the following line
in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/auditd.conf</html:code> to ensure that administrators are notified
via email for those situations:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml" xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2">action_mail_acct = <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_auditd_action_mail_acct" use="legacy"/></html:pre></description>
          <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.3.1</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-000139</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-001855</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(ii)</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.1.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.4.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.4.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.4.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.4.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.7.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.16.1.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.16.1.5</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.16.1.7</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.17.2.1</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(1)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-5(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-5(2)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</reference>
          <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.7.a</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000046-GPOS-00022</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000343-GPOS-00134</reference>
          <reference href="">SRG-OS-000046-VMM-000210</reference>
          <reference href="">SRG-OS-000343-VMM-001240</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.10</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO12.06</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI04.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI08.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
          <reference href="https://www.cisecurity.org/controls/">1</reference>
          <reference href="https://www.cisecurity.org/controls/">11</reference>
          <reference href="https://www.cisecurity.org/controls/">12</reference>
          <reference href="https://www.cisecurity.org/controls/">13</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">16</reference>
          <reference href="https://www.cisecurity.org/controls/">19</reference>
          <reference href="https://www.cisecurity.org/controls/">2</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">4</reference>
          <reference href="https://www.cisecurity.org/controls/">5</reference>
          <reference href="https://www.cisecurity.org/controls/">6</reference>
          <reference href="https://www.cisecurity.org/controls/">7</reference>
          <reference href="https://www.cisecurity.org/controls/">8</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Email sent to the root account is typically aliased to the
administrators of the system, who can take appropriate action.</rationale>
          <platform idref="cpe:/a:machine"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="auditd_data_retention_action_mail_acct" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then


var_auditd_action_mail_acct="<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_auditd_action_mail_acct" use="legacy"/>"



AUDITCONFIG=/etc/audit/auditd.conf
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_replace_or_append" use="legacy"/>
replace_or_append $AUDITCONFIG '^action_mail_acct' "$var_auditd_action_mail_acct" ""

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="auditd_data_retention_action_mail_acct" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: XCCDF Value var_auditd_action_mail_acct # promote to variable
  set_fact:
    var_auditd_action_mail_acct: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_auditd_action_mail_acct" use="legacy"/>
  tags:
    - always

- name: Configure auditd mail_acct Action on Low Disk Space
  lineinfile:
    dest: /etc/audit/auditd.conf
    line: action_mail_acct = {{ var_auditd_action_mail_acct }}
    state: present
    create: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.3.1
    - NIST-800-53-AU-5(2)
    - NIST-800-53-AU-5(a)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(1)
    - PCI-DSS-Req-10.7.a
    - auditd_data_retention_action_mail_acct
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export export-name="oval:ssg-var_auditd_action_mail_acct:var:1" value-id="xccdf_org.ssgproject.content_value_var_auditd_action_mail_acct"/>
            <check-content-ref name="oval:ssg-auditd_data_retention_action_mail_acct:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-auditd_data_retention_action_mail_acct_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_auditd_freq" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Set number of records to cause an explicit flush to audit logs</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To configure Audit daemon to issue an explicit flush to disk command
after writing 50 records, set <html:code xmlns:html="http://www.w3.org/1999/xhtml">freq</html:code> to <html:code xmlns:html="http://www.w3.org/1999/xhtml">50</html:code>
in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/auditd.conf</html:code>.</description>
          <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000051-GPOS-00024</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">If option <html:code xmlns:html="http://www.w3.org/1999/xhtml">freq</html:code> isn't set to <html:code xmlns:html="http://www.w3.org/1999/xhtml">50</html:code>, the flush to disk
may happen after higher number of records, increasing the danger
of audit loss.</rationale>
          <platform idref="cpe:/a:machine"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="auditd_freq" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="restrict"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

if [ -e "/etc/audit/auditd.conf" ] ; then
    LC_ALL=C sed -i "/^\s*freq\s*=\s*/Id" "/etc/audit/auditd.conf"
else
    touch "/etc/audit/auditd.conf"
fi
cp "/etc/audit/auditd.conf" "/etc/audit/auditd.conf.bak"
# Insert at the end of the file
printf '%s\n' "freq = 50" &gt;&gt; "/etc/audit/auditd.conf"
# Clean up after ourselves.
rm "/etc/audit/auditd.conf.bak"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="auditd_freq" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Set number of records to cause an explicit flush to audit logs
  block:

    - name: Check for duplicate values
      lineinfile:
        path: /etc/audit/auditd.conf
        create: false
        regexp: (?i)^\s*freq\s*=\s*
        state: absent
      check_mode: true
      changed_when: false
      register: dupes

    - name: Deduplicate values from /etc/audit/auditd.conf
      lineinfile:
        path: /etc/audit/auditd.conf
        create: false
        regexp: (?i)^\s*freq\s*=\s*
        state: absent
      when: dupes.found is defined and dupes.found &gt; 1

    - name: Insert correct line to /etc/audit/auditd.conf
      lineinfile:
        path: /etc/audit/auditd.conf
        create: true
        regexp: (?i)^\s*freq\s*=\s*
        line: freq = 50
        state: present
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - auditd_freq
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="auditd_freq" system="urn:xccdf:fix:script:kubernetes" reboot="true" complexity="low" disruption="low" strategy="restrict">apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,%23%0A%23%20This%20file%20controls%20the%20configuration%20of%20the%20audit%20daemon%0A%23%0A%0Alocal_events%20%3D%20yes%0Awrite_logs%20%3D%20yes%0Alog_file%20%3D%20/var/log/audit/audit.log%0Alog_group%20%3D%20root%0Alog_format%20%3D%20ENRICHED%0Aflush%20%3D%20incremental_async%0Afreq%20%3D%2050%0Amax_log_file%20%3D%208%0Anum_logs%20%3D%205%0Apriority_boost%20%3D%204%0Aname_format%20%3D%20hostname%0A%23%23name%20%3D%20mydomain%0Amax_log_file_action%20%3D%20rotate%0Aspace_left%20%3D%20100%0Aspace_left_action%20%3D%20syslog%0Averify_email%20%3D%20yes%0Aaction_mail_acct%20%3D%20root%0Aadmin_space_left%20%3D%2050%0Aadmin_space_left_action%20%3D%20syslog%0Adisk_full_action%20%3D%20syslog%0Adisk_error_action%20%3D%20syslog%0Ause_libwrap%20%3D%20yes%0A%23%23tcp_listen_port%20%3D%2060%0Atcp_listen_queue%20%3D%205%0Atcp_max_per_addr%20%3D%201%0A%23%23tcp_client_ports%20%3D%201024-65535%0Atcp_client_max_idle%20%3D%200%0Atransport%20%3D%20TCP%0Akrb5_principal%20%3D%20auditd%0A%23%23krb5_key_file%20%3D%20/etc/audit/audit.key%0Adistribute_network%20%3D%20no%0Aq_depth%20%3D%20400%0Aoverflow_action%20%3D%20syslog%0Amax_restarts%20%3D%2010%0Aplugin_dir%20%3D%20/etc/audit/plugins.d
        mode: 0640
        path: /etc/audit/auditd.conf
        overwrite: true
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-auditd_freq:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-auditd_freq_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_auditd_data_retention_max_log_file" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Configure auditd Max Log File Size</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Determine the amount of audit data (in megabytes)
which should be retained in each log file. Edit the file
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/auditd.conf</html:code>. Add or modify the following line, substituting
the correct value of <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_auditd_max_log_file" use="legacy"/> for <html:i xmlns:html="http://www.w3.org/1999/xhtml">STOREMB</html:i>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">max_log_file = <html:i>STOREMB</html:i></html:pre>
Set the value to <html:code xmlns:html="http://www.w3.org/1999/xhtml">6</html:code> (MB) or higher for general-purpose systems.
Larger values, of course,
support retention of even more audit data.</description>
          <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-11</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</reference>
          <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.10</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO12.06</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI08.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.4.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.4.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.4.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.4.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.7.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.16.1.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.16.1.5</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.16.1.7</reference>
          <reference href="https://www.cisecurity.org/controls/">1</reference>
          <reference href="https://www.cisecurity.org/controls/">11</reference>
          <reference href="https://www.cisecurity.org/controls/">12</reference>
          <reference href="https://www.cisecurity.org/controls/">13</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">16</reference>
          <reference href="https://www.cisecurity.org/controls/">19</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">4</reference>
          <reference href="https://www.cisecurity.org/controls/">5</reference>
          <reference href="https://www.cisecurity.org/controls/">6</reference>
          <reference href="https://www.cisecurity.org/controls/">7</reference>
          <reference href="https://www.cisecurity.org/controls/">8</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The total storage for audit log files must be large enough to retain
log information over the period required. This is a function of the maximum
log file size and the number of logs retained.</rationale>
          <platform idref="cpe:/a:machine"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="auditd_data_retention_max_log_file" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then


var_auditd_max_log_file="<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_auditd_max_log_file" use="legacy"/>"



AUDITCONFIG=/etc/audit/auditd.conf
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_replace_or_append" use="legacy"/>
replace_or_append $AUDITCONFIG '^max_log_file' "$var_auditd_max_log_file" ""

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="auditd_data_retention_max_log_file" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: XCCDF Value var_auditd_max_log_file # promote to variable
  set_fact:
    var_auditd_max_log_file: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_auditd_max_log_file" use="legacy"/>
  tags:
    - always

- name: Configure auditd Max Log File Size
  lineinfile:
    dest: /etc/audit/auditd.conf
    regexp: ^\s*max_log_file\s*=\s*.*$
    line: max_log_file = {{ var_auditd_max_log_file }}
    state: present
    create: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-53-AU-11
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.7
    - auditd_data_retention_max_log_file
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="auditd_data_retention_max_log_file" system="urn:xccdf:fix:script:kubernetes" reboot="true" complexity="low" disruption="low" strategy="restrict">apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,%23%0A%23%20This%20file%20controls%20the%20configuration%20of%20the%20audit%20daemon%0A%23%0A%0Alocal_events%20%3D%20yes%0Awrite_logs%20%3D%20yes%0Alog_file%20%3D%20/var/log/audit/audit.log%0Alog_group%20%3D%20root%0Alog_format%20%3D%20ENRICHED%0Aflush%20%3D%20incremental_async%0Afreq%20%3D%2050%0Amax_log_file%20%3D%208%0Anum_logs%20%3D%205%0Apriority_boost%20%3D%204%0Aname_format%20%3D%20hostname%0A%23%23name%20%3D%20mydomain%0Amax_log_file_action%20%3D%20rotate%0Aspace_left%20%3D%20100%0Aspace_left_action%20%3D%20syslog%0Averify_email%20%3D%20yes%0Aaction_mail_acct%20%3D%20root%0Aadmin_space_left%20%3D%2050%0Aadmin_space_left_action%20%3D%20syslog%0Adisk_full_action%20%3D%20syslog%0Adisk_error_action%20%3D%20syslog%0Ause_libwrap%20%3D%20yes%0A%23%23tcp_listen_port%20%3D%2060%0Atcp_listen_queue%20%3D%205%0Atcp_max_per_addr%20%3D%201%0A%23%23tcp_client_ports%20%3D%201024-65535%0Atcp_client_max_idle%20%3D%200%0Atransport%20%3D%20TCP%0Akrb5_principal%20%3D%20auditd%0A%23%23krb5_key_file%20%3D%20/etc/audit/audit.key%0Adistribute_network%20%3D%20no%0Aq_depth%20%3D%20400%0Aoverflow_action%20%3D%20syslog%0Amax_restarts%20%3D%2010%0Aplugin_dir%20%3D%20/etc/audit/plugins.d
        mode: 0640
        path: /etc/audit/auditd.conf
        overwrite: true
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export export-name="oval:ssg-var_auditd_max_log_file:var:1" value-id="xccdf_org.ssgproject.content_value_var_auditd_max_log_file"/>
            <check-content-ref name="oval:ssg-auditd_data_retention_max_log_file:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-auditd_data_retention_max_log_file_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_auditd_data_disk_full_action" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Configure auditd Disk Full Action when Disk Space Is Full</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> service can be configured to take an action
when disk space is running low but prior to running out of space completely.
Edit the file <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/auditd.conf</html:code>. Add or modify the following line,
substituting <html:i xmlns:html="http://www.w3.org/1999/xhtml">ACTION</html:i> appropriately:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">disk_full_action = <html:i>ACTION</html:i></html:pre>
Set this value to <html:code xmlns:html="http://www.w3.org/1999/xhtml">single</html:code> to cause the system to switch to single-user
mode for corrective action. Acceptable values also include <html:code xmlns:html="http://www.w3.org/1999/xhtml">syslog</html:code>,

<html:code xmlns:html="http://www.w3.org/1999/xhtml">exec</html:code>,

<html:code xmlns:html="http://www.w3.org/1999/xhtml">single</html:code>, and <html:code xmlns:html="http://www.w3.org/1999/xhtml">halt</html:code>. For certain systems, the need for availability
outweighs the need to log all actions, and a different setting should be
determined. Details regarding all possible values for <html:i xmlns:html="http://www.w3.org/1999/xhtml">ACTION</html:i> are described in the
<html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd.conf</html:code> man page.</description>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-5(b)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-5(2)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-5(1)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-5(4)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.10</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO12.06</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI04.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI08.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.1.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.4.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.4.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.4.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.4.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.7.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.16.1.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.16.1.5</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.16.1.7</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.17.2.1</reference>
          <reference href="https://www.cisecurity.org/controls/">1</reference>
          <reference href="https://www.cisecurity.org/controls/">11</reference>
          <reference href="https://www.cisecurity.org/controls/">12</reference>
          <reference href="https://www.cisecurity.org/controls/">13</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">16</reference>
          <reference href="https://www.cisecurity.org/controls/">19</reference>
          <reference href="https://www.cisecurity.org/controls/">2</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">4</reference>
          <reference href="https://www.cisecurity.org/controls/">5</reference>
          <reference href="https://www.cisecurity.org/controls/">6</reference>
          <reference href="https://www.cisecurity.org/controls/">7</reference>
          <reference href="https://www.cisecurity.org/controls/">8</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000047-GPOS-00023</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-000140</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Taking appropriate action in case of a filled audit storage volume will minimize
the possibility of losing audit records.</rationale>
          <platform idref="cpe:/a:machine"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="auditd_data_disk_full_action" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: XCCDF Value var_auditd_disk_full_action # promote to variable
  set_fact:
    var_auditd_disk_full_action: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_auditd_disk_full_action" use="legacy"/>
  tags:
    - always

- name: Configure auditd Disk Full Action when Disk Space Is Full
  lineinfile:
    dest: /etc/audit/auditd.conf
    line: disk_full_action = {{ var_auditd_disk_full_action }}
    regexp: ^\s*disk_full_action\s*=\s*.*$
    state: present
    create: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AU-5(1)
    - NIST-800-53-AU-5(2)
    - NIST-800-53-AU-5(4)
    - NIST-800-53-AU-5(b)
    - NIST-800-53-CM-6(a)
    - auditd_data_disk_full_action
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="auditd_data_disk_full_action" system="urn:xccdf:fix:script:kubernetes" reboot="true" complexity="low" disruption="low" strategy="restrict">apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,%23%0A%23%20This%20file%20controls%20the%20configuration%20of%20the%20audit%20daemon%0A%23%0A%0Alocal_events%20%3D%20yes%0Awrite_logs%20%3D%20yes%0Alog_file%20%3D%20/var/log/audit/audit.log%0Alog_group%20%3D%20root%0Alog_format%20%3D%20ENRICHED%0Aflush%20%3D%20incremental_async%0Afreq%20%3D%2050%0Amax_log_file%20%3D%208%0Anum_logs%20%3D%205%0Apriority_boost%20%3D%204%0Aname_format%20%3D%20hostname%0A%23%23name%20%3D%20mydomain%0Amax_log_file_action%20%3D%20rotate%0Aspace_left%20%3D%20100%0Aspace_left_action%20%3D%20syslog%0Averify_email%20%3D%20yes%0Aaction_mail_acct%20%3D%20root%0Aadmin_space_left%20%3D%2050%0Aadmin_space_left_action%20%3D%20syslog%0Adisk_full_action%20%3D%20syslog%0Adisk_error_action%20%3D%20syslog%0Ause_libwrap%20%3D%20yes%0A%23%23tcp_listen_port%20%3D%2060%0Atcp_listen_queue%20%3D%205%0Atcp_max_per_addr%20%3D%201%0A%23%23tcp_client_ports%20%3D%201024-65535%0Atcp_client_max_idle%20%3D%200%0Atransport%20%3D%20TCP%0Akrb5_principal%20%3D%20auditd%0A%23%23krb5_key_file%20%3D%20/etc/audit/audit.key%0Adistribute_network%20%3D%20no%0Aq_depth%20%3D%20400%0Aoverflow_action%20%3D%20syslog%0Amax_restarts%20%3D%2010%0Aplugin_dir%20%3D%20/etc/audit/plugins.d
        mode: 0640
        path: /etc/audit/auditd.conf
        overwrite: true
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export export-name="oval:ssg-var_auditd_disk_full_action:var:1" value-id="xccdf_org.ssgproject.content_value_var_auditd_disk_full_action"/>
            <check-content-ref name="oval:ssg-auditd_data_disk_full_action:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-auditd_data_disk_full_action_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_auditd_data_retention_flush" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Configure auditd flush priority</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> service can be configured to
synchronously write audit event data to disk. Add or correct the following
line in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/auditd.conf</html:code> to ensure that audit event data is
fully synchronized with the log files on the disk:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml" xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2">flush = <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_auditd_flush" use="legacy"/></html:pre></description>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.3.1</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-001576</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-11</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.2.6.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.4.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.4.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.4.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.4.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.7.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.2.7</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.15.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.15.2.2</reference>
          <reference href="https://www.cisecurity.org/controls/">1</reference>
          <reference href="https://www.cisecurity.org/controls/">12</reference>
          <reference href="https://www.cisecurity.org/controls/">13</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">16</reference>
          <reference href="https://www.cisecurity.org/controls/">2</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">5</reference>
          <reference href="https://www.cisecurity.org/controls/">6</reference>
          <reference href="https://www.cisecurity.org/controls/">7</reference>
          <reference href="https://www.cisecurity.org/controls/">8</reference>
          <reference href="https://www.cisecurity.org/controls/">9</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Audit data should be synchronously written to disk to ensure
log integrity. These parameters assure that all audit event data is fully
synchronized with the log files on the disk.</rationale>
          <platform idref="cpe:/a:machine"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="auditd_data_retention_flush" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: XCCDF Value var_auditd_flush # promote to variable
  set_fact:
    var_auditd_flush: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_auditd_flush" use="legacy"/>
  tags:
    - always

- name: Configure auditd Flush Priority
  lineinfile:
    dest: /etc/audit/auditd.conf
    regexp: ^\s*flush\s*=\s*.*$
    line: flush = {{ var_auditd_flush }}
    state: present
    create: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.3.1
    - NIST-800-53-AU-11
    - NIST-800-53-CM-6(a)
    - auditd_data_retention_flush
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="auditd_data_retention_flush" system="urn:xccdf:fix:script:kubernetes" reboot="true" complexity="low" disruption="low" strategy="restrict">apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,%23%0A%23%20This%20file%20controls%20the%20configuration%20of%20the%20audit%20daemon%0A%23%0A%0Alocal_events%20%3D%20yes%0Awrite_logs%20%3D%20yes%0Alog_file%20%3D%20/var/log/audit/audit.log%0Alog_group%20%3D%20root%0Alog_format%20%3D%20ENRICHED%0Aflush%20%3D%20incremental_async%0Afreq%20%3D%2050%0Amax_log_file%20%3D%208%0Anum_logs%20%3D%205%0Apriority_boost%20%3D%204%0Aname_format%20%3D%20hostname%0A%23%23name%20%3D%20mydomain%0Amax_log_file_action%20%3D%20rotate%0Aspace_left%20%3D%20100%0Aspace_left_action%20%3D%20syslog%0Averify_email%20%3D%20yes%0Aaction_mail_acct%20%3D%20root%0Aadmin_space_left%20%3D%2050%0Aadmin_space_left_action%20%3D%20syslog%0Adisk_full_action%20%3D%20syslog%0Adisk_error_action%20%3D%20syslog%0Ause_libwrap%20%3D%20yes%0A%23%23tcp_listen_port%20%3D%2060%0Atcp_listen_queue%20%3D%205%0Atcp_max_per_addr%20%3D%201%0A%23%23tcp_client_ports%20%3D%201024-65535%0Atcp_client_max_idle%20%3D%200%0Atransport%20%3D%20TCP%0Akrb5_principal%20%3D%20auditd%0A%23%23krb5_key_file%20%3D%20/etc/audit/audit.key%0Adistribute_network%20%3D%20no%0Aq_depth%20%3D%20400%0Aoverflow_action%20%3D%20syslog%0Amax_restarts%20%3D%2010%0Aplugin_dir%20%3D%20/etc/audit/plugins.d
        mode: 0640
        path: /etc/audit/auditd.conf
        overwrite: true
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export export-name="oval:ssg-var_auditd_flush:var:1" value-id="xccdf_org.ssgproject.content_value_var_auditd_flush"/>
            <check-content-ref name="oval:ssg-auditd_data_retention_flush:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-auditd_data_retention_flush_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_auditd_data_retention_max_log_file_action" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Configure auditd max_log_file_action Upon Reaching Maximum Log Size</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The default action to take when the logs reach their maximum size
is to rotate the log files, discarding the oldest one. To configure the action taken
by <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code>, add or correct the line in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/auditd.conf</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">max_log_file_action = <html:i>ACTION</html:i></html:pre>
Possible values for <html:i xmlns:html="http://www.w3.org/1999/xhtml">ACTION</html:i> are described in the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd.conf</html:code> man
page. These include:
<html:ul xmlns:html="http://www.w3.org/1999/xhtml"><html:li><html:code>syslog</html:code></html:li><html:li><html:code>suspend</html:code></html:li><html:li><html:code>rotate</html:code></html:li><html:li><html:code>keep_logs</html:code></html:li></html:ul>
Set the <html:code xmlns:html="http://www.w3.org/1999/xhtml"><html:i>ACTION</html:i></html:code> to <html:code xmlns:html="http://www.w3.org/1999/xhtml">rotate</html:code> to ensure log rotation
occurs. This is the default. The setting is case-insensitive.</description>
          <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(ii)</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.1.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.4.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.4.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.4.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.4.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.7.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.16.1.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.16.1.5</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.16.1.7</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.17.2.1</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-5(b)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-5(2)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-5(1)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-5(4)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</reference>
          <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.10</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO12.06</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI04.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI08.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
          <reference href="https://www.cisecurity.org/controls/">1</reference>
          <reference href="https://www.cisecurity.org/controls/">11</reference>
          <reference href="https://www.cisecurity.org/controls/">12</reference>
          <reference href="https://www.cisecurity.org/controls/">13</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">16</reference>
          <reference href="https://www.cisecurity.org/controls/">19</reference>
          <reference href="https://www.cisecurity.org/controls/">2</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">4</reference>
          <reference href="https://www.cisecurity.org/controls/">5</reference>
          <reference href="https://www.cisecurity.org/controls/">6</reference>
          <reference href="https://www.cisecurity.org/controls/">7</reference>
          <reference href="https://www.cisecurity.org/controls/">8</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000047-GPOS-00023</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-000140</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Automatically rotating logs (by setting this to <html:code xmlns:html="http://www.w3.org/1999/xhtml">rotate</html:code>)
minimizes the chances of the system unexpectedly running out of disk space by
being overwhelmed with log data. However, for systems that must never discard
log data, or which use external processes to transfer it and reclaim space,
<html:code xmlns:html="http://www.w3.org/1999/xhtml">keep_logs</html:code> can be employed.</rationale>
          <platform idref="cpe:/a:machine"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="auditd_data_retention_max_log_file_action" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then


var_auditd_max_log_file_action="<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_auditd_max_log_file_action" use="legacy"/>"



AUDITCONFIG=/etc/audit/auditd.conf
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_replace_or_append" use="legacy"/>
replace_or_append $AUDITCONFIG '^max_log_file_action' "$var_auditd_max_log_file_action" ""

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="auditd_data_retention_max_log_file_action" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: XCCDF Value var_auditd_max_log_file_action # promote to variable
  set_fact:
    var_auditd_max_log_file_action: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_auditd_max_log_file_action" use="legacy"/>
  tags:
    - always

- name: Configure auditd max_log_file_action Upon Reaching Maximum Log Size
  lineinfile:
    dest: /etc/audit/auditd.conf
    line: max_log_file_action = {{ var_auditd_max_log_file_action }}
    regexp: ^\s*max_log_file_action\s*=\s*.*$
    state: present
    create: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-53-AU-5(1)
    - NIST-800-53-AU-5(2)
    - NIST-800-53-AU-5(4)
    - NIST-800-53-AU-5(b)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.7
    - auditd_data_retention_max_log_file_action
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="auditd_data_retention_max_log_file_action" system="urn:xccdf:fix:script:kubernetes" reboot="true" complexity="low" disruption="low" strategy="restrict">apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,%23%0A%23%20This%20file%20controls%20the%20configuration%20of%20the%20audit%20daemon%0A%23%0A%0Alocal_events%20%3D%20yes%0Awrite_logs%20%3D%20yes%0Alog_file%20%3D%20/var/log/audit/audit.log%0Alog_group%20%3D%20root%0Alog_format%20%3D%20ENRICHED%0Aflush%20%3D%20incremental_async%0Afreq%20%3D%2050%0Amax_log_file%20%3D%208%0Anum_logs%20%3D%205%0Apriority_boost%20%3D%204%0Aname_format%20%3D%20hostname%0A%23%23name%20%3D%20mydomain%0Amax_log_file_action%20%3D%20rotate%0Aspace_left%20%3D%20100%0Aspace_left_action%20%3D%20syslog%0Averify_email%20%3D%20yes%0Aaction_mail_acct%20%3D%20root%0Aadmin_space_left%20%3D%2050%0Aadmin_space_left_action%20%3D%20syslog%0Adisk_full_action%20%3D%20syslog%0Adisk_error_action%20%3D%20syslog%0Ause_libwrap%20%3D%20yes%0A%23%23tcp_listen_port%20%3D%2060%0Atcp_listen_queue%20%3D%205%0Atcp_max_per_addr%20%3D%201%0A%23%23tcp_client_ports%20%3D%201024-65535%0Atcp_client_max_idle%20%3D%200%0Atransport%20%3D%20TCP%0Akrb5_principal%20%3D%20auditd%0A%23%23krb5_key_file%20%3D%20/etc/audit/audit.key%0Adistribute_network%20%3D%20no%0Aq_depth%20%3D%20400%0Aoverflow_action%20%3D%20syslog%0Amax_restarts%20%3D%2010%0Aplugin_dir%20%3D%20/etc/audit/plugins.d
        mode: 0640
        path: /etc/audit/auditd.conf
        overwrite: true
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export export-name="oval:ssg-var_auditd_max_log_file_action:var:1" value-id="xccdf_org.ssgproject.content_value_var_auditd_max_log_file_action"/>
            <check-content-ref name="oval:ssg-auditd_data_retention_max_log_file_action:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-auditd_data_retention_max_log_file_action_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_auditd_name_format" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Set hostname as computer node name in audit logs</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To configure Audit daemon to use value returned by gethostname
syscall as computer node name in the audit events,
set <html:code xmlns:html="http://www.w3.org/1999/xhtml">name_format</html:code> to <html:code xmlns:html="http://www.w3.org/1999/xhtml">hostname</html:code>
in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/auditd.conf</html:code>.</description>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-001851</reference>
          <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000039-GPOS-00017</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000342-GPOS-00133</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000479-GPOS-00224</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">If option <html:code xmlns:html="http://www.w3.org/1999/xhtml">name_format</html:code> is left at its default value of
<html:code xmlns:html="http://www.w3.org/1999/xhtml">none</html:code>, audit events from different computers may be hard
to distinguish.</rationale>
          <platform idref="cpe:/a:machine"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="auditd_name_format" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="restrict"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

if [ -e "/etc/audit/auditd.conf" ] ; then
    LC_ALL=C sed -i "/^\s*name_format\s*=\s*/Id" "/etc/audit/auditd.conf"
else
    touch "/etc/audit/auditd.conf"
fi
cp "/etc/audit/auditd.conf" "/etc/audit/auditd.conf.bak"
# Insert at the end of the file
printf '%s\n' "name_format = hostname" &gt;&gt; "/etc/audit/auditd.conf"
# Clean up after ourselves.
rm "/etc/audit/auditd.conf.bak"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="auditd_name_format" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Set hostname as computer node name in audit logs
  block:

    - name: Check for duplicate values
      lineinfile:
        path: /etc/audit/auditd.conf
        create: false
        regexp: (?i)^\s*name_format\s*=\s*
        state: absent
      check_mode: true
      changed_when: false
      register: dupes

    - name: Deduplicate values from /etc/audit/auditd.conf
      lineinfile:
        path: /etc/audit/auditd.conf
        create: false
        regexp: (?i)^\s*name_format\s*=\s*
        state: absent
      when: dupes.found is defined and dupes.found &gt; 1

    - name: Insert correct line to /etc/audit/auditd.conf
      lineinfile:
        path: /etc/audit/auditd.conf
        create: true
        regexp: (?i)^\s*name_format\s*=\s*
        line: name_format = hostname
        state: present
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - auditd_name_format
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="auditd_name_format" system="urn:xccdf:fix:script:kubernetes" reboot="true" complexity="low" disruption="low" strategy="restrict">apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,%23%0A%23%20This%20file%20controls%20the%20configuration%20of%20the%20audit%20daemon%0A%23%0A%0Alocal_events%20%3D%20yes%0Awrite_logs%20%3D%20yes%0Alog_file%20%3D%20/var/log/audit/audit.log%0Alog_group%20%3D%20root%0Alog_format%20%3D%20ENRICHED%0Aflush%20%3D%20incremental_async%0Afreq%20%3D%2050%0Amax_log_file%20%3D%208%0Anum_logs%20%3D%205%0Apriority_boost%20%3D%204%0Aname_format%20%3D%20hostname%0A%23%23name%20%3D%20mydomain%0Amax_log_file_action%20%3D%20rotate%0Aspace_left%20%3D%20100%0Aspace_left_action%20%3D%20syslog%0Averify_email%20%3D%20yes%0Aaction_mail_acct%20%3D%20root%0Aadmin_space_left%20%3D%2050%0Aadmin_space_left_action%20%3D%20syslog%0Adisk_full_action%20%3D%20syslog%0Adisk_error_action%20%3D%20syslog%0Ause_libwrap%20%3D%20yes%0A%23%23tcp_listen_port%20%3D%2060%0Atcp_listen_queue%20%3D%205%0Atcp_max_per_addr%20%3D%201%0A%23%23tcp_client_ports%20%3D%201024-65535%0Atcp_client_max_idle%20%3D%200%0Atransport%20%3D%20TCP%0Akrb5_principal%20%3D%20auditd%0A%23%23krb5_key_file%20%3D%20/etc/audit/audit.key%0Adistribute_network%20%3D%20no%0Aq_depth%20%3D%20400%0Aoverflow_action%20%3D%20syslog%0Amax_restarts%20%3D%2010%0Aplugin_dir%20%3D%20/etc/audit/plugins.d
        mode: 0640
        path: /etc/audit/auditd.conf
        overwrite: true
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-auditd_name_format:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-auditd_name_format_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_auditd_log_format" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Resolve information before writing to audit logs</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To configure Audit daemon to resolve all uid, gid, syscall,
architecture, and socket address information before writing the
events to disk, set <html:code xmlns:html="http://www.w3.org/1999/xhtml">log_format</html:code> to <html:code xmlns:html="http://www.w3.org/1999/xhtml">ENRICHED</html:code>
in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/auditd.conf</html:code>.</description>
          <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000255-GPOS-00096</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">If option <html:code xmlns:html="http://www.w3.org/1999/xhtml">log_format</html:code> isn't set to <html:code xmlns:html="http://www.w3.org/1999/xhtml">ENRICHED</html:code>, the
audit records will be stored in a format exactly as the kernel sends them.</rationale>
          <platform idref="cpe:/a:machine"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="auditd_log_format" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="restrict"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

if [ -e "/etc/audit/auditd.conf" ] ; then
    LC_ALL=C sed -i "/^\s*log_format\s*=\s*/Id" "/etc/audit/auditd.conf"
else
    touch "/etc/audit/auditd.conf"
fi
cp "/etc/audit/auditd.conf" "/etc/audit/auditd.conf.bak"
# Insert at the end of the file
printf '%s\n' "log_format = ENRICHED" &gt;&gt; "/etc/audit/auditd.conf"
# Clean up after ourselves.
rm "/etc/audit/auditd.conf.bak"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="auditd_log_format" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Resolve information before writing to audit logs
  block:

    - name: Check for duplicate values
      lineinfile:
        path: /etc/audit/auditd.conf
        create: false
        regexp: (?i)^\s*log_format\s*=\s*
        state: absent
      check_mode: true
      changed_when: false
      register: dupes

    - name: Deduplicate values from /etc/audit/auditd.conf
      lineinfile:
        path: /etc/audit/auditd.conf
        create: false
        regexp: (?i)^\s*log_format\s*=\s*
        state: absent
      when: dupes.found is defined and dupes.found &gt; 1

    - name: Insert correct line to /etc/audit/auditd.conf
      lineinfile:
        path: /etc/audit/auditd.conf
        create: true
        regexp: (?i)^\s*log_format\s*=\s*
        line: log_format = ENRICHED
        state: present
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - auditd_log_format
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="auditd_log_format" system="urn:xccdf:fix:script:kubernetes" reboot="true" complexity="low" disruption="low" strategy="restrict">apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,%23%0A%23%20This%20file%20controls%20the%20configuration%20of%20the%20audit%20daemon%0A%23%0A%0Alocal_events%20%3D%20yes%0Awrite_logs%20%3D%20yes%0Alog_file%20%3D%20/var/log/audit/audit.log%0Alog_group%20%3D%20root%0Alog_format%20%3D%20ENRICHED%0Aflush%20%3D%20incremental_async%0Afreq%20%3D%2050%0Amax_log_file%20%3D%208%0Anum_logs%20%3D%205%0Apriority_boost%20%3D%204%0Aname_format%20%3D%20hostname%0A%23%23name%20%3D%20mydomain%0Amax_log_file_action%20%3D%20rotate%0Aspace_left%20%3D%20100%0Aspace_left_action%20%3D%20syslog%0Averify_email%20%3D%20yes%0Aaction_mail_acct%20%3D%20root%0Aadmin_space_left%20%3D%2050%0Aadmin_space_left_action%20%3D%20syslog%0Adisk_full_action%20%3D%20syslog%0Adisk_error_action%20%3D%20syslog%0Ause_libwrap%20%3D%20yes%0A%23%23tcp_listen_port%20%3D%2060%0Atcp_listen_queue%20%3D%205%0Atcp_max_per_addr%20%3D%201%0A%23%23tcp_client_ports%20%3D%201024-65535%0Atcp_client_max_idle%20%3D%200%0Atransport%20%3D%20TCP%0Akrb5_principal%20%3D%20auditd%0A%23%23krb5_key_file%20%3D%20/etc/audit/audit.key%0Adistribute_network%20%3D%20no%0Aq_depth%20%3D%20400%0Aoverflow_action%20%3D%20syslog%0Amax_restarts%20%3D%2010%0Aplugin_dir%20%3D%20/etc/audit/plugins.d
        mode: 0640
        path: /etc/audit/auditd.conf
        overwrite: true
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-auditd_log_format:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-auditd_log_format_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_auditd_data_retention_space_left_action" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Configure auditd space_left Action on Low Disk Space</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> service can be configured to take an action
when disk space <html:i xmlns:html="http://www.w3.org/1999/xhtml">starts</html:i> to run low.
Edit the file <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/auditd.conf</html:code>. Modify the following line,
substituting <html:i xmlns:html="http://www.w3.org/1999/xhtml">ACTION</html:i> appropriately:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">space_left_action = <html:i>ACTION</html:i></html:pre>
Possible values for <html:i xmlns:html="http://www.w3.org/1999/xhtml">ACTION</html:i> are described in the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd.conf</html:code> man page.
These include:
<html:ul xmlns:html="http://www.w3.org/1999/xhtml"><html:li><html:code>syslog</html:code></html:li><html:li><html:code>email</html:code></html:li><html:li><html:code>exec</html:code></html:li><html:li><html:code>suspend</html:code></html:li><html:li><html:code>single</html:code></html:li><html:li><html:code>halt</html:code></html:li></html:ul>
Set this to <html:code xmlns:html="http://www.w3.org/1999/xhtml">email</html:code> (instead of the default,
which is <html:code xmlns:html="http://www.w3.org/1999/xhtml">suspend</html:code>) as it is more likely to get prompt attention. Acceptable values
also include <html:code xmlns:html="http://www.w3.org/1999/xhtml">suspend</html:code>, <html:code xmlns:html="http://www.w3.org/1999/xhtml">single</html:code>, and <html:code xmlns:html="http://www.w3.org/1999/xhtml">halt</html:code>.</description>
          <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.3.1</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-001855</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(ii)</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.1.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.4.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.4.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.4.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.4.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.7.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.16.1.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.16.1.5</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.16.1.7</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.17.2.1</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-5(b)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-5(2)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-5(1)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-5(4)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</reference>
          <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.7</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000343-GPOS-00134</reference>
          <reference href="">SRG-OS-000343-VMM-001240</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.10</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO12.06</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI04.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI08.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
          <reference href="https://www.cisecurity.org/controls/">1</reference>
          <reference href="https://www.cisecurity.org/controls/">11</reference>
          <reference href="https://www.cisecurity.org/controls/">12</reference>
          <reference href="https://www.cisecurity.org/controls/">13</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">16</reference>
          <reference href="https://www.cisecurity.org/controls/">19</reference>
          <reference href="https://www.cisecurity.org/controls/">2</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">4</reference>
          <reference href="https://www.cisecurity.org/controls/">5</reference>
          <reference href="https://www.cisecurity.org/controls/">6</reference>
          <reference href="https://www.cisecurity.org/controls/">7</reference>
          <reference href="https://www.cisecurity.org/controls/">8</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Notifying administrators of an impending disk space problem may
allow them to take corrective action prior to any disruption.</rationale>
          <platform idref="cpe:/a:machine"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="auditd_data_retention_space_left_action" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then


var_auditd_space_left_action="<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_auditd_space_left_action" use="legacy"/>"



#
# If space_left_action present in /etc/audit/auditd.conf, change value
# to var_auditd_space_left_action, else
# add "space_left_action = $var_auditd_space_left_action" to /etc/audit/auditd.conf
#

AUDITCONFIG=/etc/audit/auditd.conf
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_replace_or_append" use="legacy"/>
replace_or_append $AUDITCONFIG '^space_left_action' "$var_auditd_space_left_action" ""

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="auditd_data_retention_space_left_action" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: XCCDF Value var_auditd_space_left_action # promote to variable
  set_fact:
    var_auditd_space_left_action: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_auditd_space_left_action" use="legacy"/>
  tags:
    - always

- name: Configure auditd space_left Action on Low Disk Space
  lineinfile:
    dest: /etc/audit/auditd.conf
    line: space_left_action = {{ var_auditd_space_left_action }}
    regexp: ^\s*space_left_action\s*=\s*.*$
    state: present
    create: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.3.1
    - NIST-800-53-AU-5(1)
    - NIST-800-53-AU-5(2)
    - NIST-800-53-AU-5(4)
    - NIST-800-53-AU-5(b)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.7
    - auditd_data_retention_space_left_action
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="auditd_data_retention_space_left_action" system="urn:xccdf:fix:script:kubernetes" reboot="true" complexity="low" disruption="low" strategy="restrict">apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,%23%0A%23%20This%20file%20controls%20the%20configuration%20of%20the%20audit%20daemon%0A%23%0A%0Alocal_events%20%3D%20yes%0Awrite_logs%20%3D%20yes%0Alog_file%20%3D%20/var/log/audit/audit.log%0Alog_group%20%3D%20root%0Alog_format%20%3D%20ENRICHED%0Aflush%20%3D%20incremental_async%0Afreq%20%3D%2050%0Amax_log_file%20%3D%208%0Anum_logs%20%3D%205%0Apriority_boost%20%3D%204%0Aname_format%20%3D%20hostname%0A%23%23name%20%3D%20mydomain%0Amax_log_file_action%20%3D%20rotate%0Aspace_left%20%3D%20100%0Aspace_left_action%20%3D%20syslog%0Averify_email%20%3D%20yes%0Aaction_mail_acct%20%3D%20root%0Aadmin_space_left%20%3D%2050%0Aadmin_space_left_action%20%3D%20syslog%0Adisk_full_action%20%3D%20syslog%0Adisk_error_action%20%3D%20syslog%0Ause_libwrap%20%3D%20yes%0A%23%23tcp_listen_port%20%3D%2060%0Atcp_listen_queue%20%3D%205%0Atcp_max_per_addr%20%3D%201%0A%23%23tcp_client_ports%20%3D%201024-65535%0Atcp_client_max_idle%20%3D%200%0Atransport%20%3D%20TCP%0Akrb5_principal%20%3D%20auditd%0A%23%23krb5_key_file%20%3D%20/etc/audit/audit.key%0Adistribute_network%20%3D%20no%0Aq_depth%20%3D%20400%0Aoverflow_action%20%3D%20syslog%0Amax_restarts%20%3D%2010%0Aplugin_dir%20%3D%20/etc/audit/plugins.d
        mode: 0640
        path: /etc/audit/auditd.conf
        overwrite: true
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export export-name="oval:ssg-var_auditd_space_left_action:var:1" value-id="xccdf_org.ssgproject.content_value_var_auditd_space_left_action"/>
            <check-content-ref name="oval:ssg-auditd_data_retention_space_left_action:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-auditd_data_retention_space_left_action_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_auditd_data_disk_error_action" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Configure auditd Disk Error Action on Disk Error</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> service can be configured to take an action
when there is a disk error.
Edit the file <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/auditd.conf</html:code>. Add or modify the following line,
substituting <html:i xmlns:html="http://www.w3.org/1999/xhtml">ACTION</html:i> appropriately:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">disk_error_action = <html:i>ACTION</html:i></html:pre>
Set this value to <html:code xmlns:html="http://www.w3.org/1999/xhtml">single</html:code> to cause the system to switch to single-user
mode for corrective action. Acceptable values also include <html:code xmlns:html="http://www.w3.org/1999/xhtml">syslog</html:code>,
<html:code xmlns:html="http://www.w3.org/1999/xhtml">exec</html:code>, <html:code xmlns:html="http://www.w3.org/1999/xhtml">single</html:code>, and <html:code xmlns:html="http://www.w3.org/1999/xhtml">halt</html:code>. For certain systems, the need for availability
outweighs the need to log all actions, and a different setting should be
determined. Details regarding all possible values for <html:i xmlns:html="http://www.w3.org/1999/xhtml">ACTION</html:i> are described in the
<html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd.conf</html:code> man page.</description>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-5(b)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-5(2)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-5(1)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-5(4)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.10</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO12.06</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI04.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI08.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.1.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.4.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.4.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.4.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.4.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.7.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.16.1.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.16.1.5</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.16.1.7</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.17.2.1</reference>
          <reference href="https://www.cisecurity.org/controls/">1</reference>
          <reference href="https://www.cisecurity.org/controls/">11</reference>
          <reference href="https://www.cisecurity.org/controls/">12</reference>
          <reference href="https://www.cisecurity.org/controls/">13</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">16</reference>
          <reference href="https://www.cisecurity.org/controls/">19</reference>
          <reference href="https://www.cisecurity.org/controls/">2</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">4</reference>
          <reference href="https://www.cisecurity.org/controls/">5</reference>
          <reference href="https://www.cisecurity.org/controls/">6</reference>
          <reference href="https://www.cisecurity.org/controls/">7</reference>
          <reference href="https://www.cisecurity.org/controls/">8</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000047-GPOS-00023</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-000140</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Taking appropriate action in case of disk errors will minimize the possibility of
losing audit records.</rationale>
          <platform idref="cpe:/a:machine"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="auditd_data_disk_error_action" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: XCCDF Value var_auditd_disk_error_action # promote to variable
  set_fact:
    var_auditd_disk_error_action: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_auditd_disk_error_action" use="legacy"/>
  tags:
    - always

- name: Configure auditd Disk Error Action on Disk Error
  lineinfile:
    dest: /etc/audit/auditd.conf
    line: disk_error_action = {{ var_auditd_disk_error_action }}
    regexp: ^\s*disk_error_action\s*=\s*.*$
    state: present
    create: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AU-5(1)
    - NIST-800-53-AU-5(2)
    - NIST-800-53-AU-5(4)
    - NIST-800-53-AU-5(b)
    - NIST-800-53-CM-6(a)
    - auditd_data_disk_error_action
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="auditd_data_disk_error_action" system="urn:xccdf:fix:script:kubernetes" reboot="true" complexity="low" disruption="low" strategy="restrict">apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,%23%0A%23%20This%20file%20controls%20the%20configuration%20of%20the%20audit%20daemon%0A%23%0A%0Alocal_events%20%3D%20yes%0Awrite_logs%20%3D%20yes%0Alog_file%20%3D%20/var/log/audit/audit.log%0Alog_group%20%3D%20root%0Alog_format%20%3D%20ENRICHED%0Aflush%20%3D%20incremental_async%0Afreq%20%3D%2050%0Amax_log_file%20%3D%208%0Anum_logs%20%3D%205%0Apriority_boost%20%3D%204%0Aname_format%20%3D%20hostname%0A%23%23name%20%3D%20mydomain%0Amax_log_file_action%20%3D%20rotate%0Aspace_left%20%3D%20100%0Aspace_left_action%20%3D%20syslog%0Averify_email%20%3D%20yes%0Aaction_mail_acct%20%3D%20root%0Aadmin_space_left%20%3D%2050%0Aadmin_space_left_action%20%3D%20syslog%0Adisk_full_action%20%3D%20syslog%0Adisk_error_action%20%3D%20syslog%0Ause_libwrap%20%3D%20yes%0A%23%23tcp_listen_port%20%3D%2060%0Atcp_listen_queue%20%3D%205%0Atcp_max_per_addr%20%3D%201%0A%23%23tcp_client_ports%20%3D%201024-65535%0Atcp_client_max_idle%20%3D%200%0Atransport%20%3D%20TCP%0Akrb5_principal%20%3D%20auditd%0A%23%23krb5_key_file%20%3D%20/etc/audit/audit.key%0Adistribute_network%20%3D%20no%0Aq_depth%20%3D%20400%0Aoverflow_action%20%3D%20syslog%0Amax_restarts%20%3D%2010%0Aplugin_dir%20%3D%20/etc/audit/plugins.d
        mode: 0640
        path: /etc/audit/auditd.conf
        overwrite: true
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export export-name="oval:ssg-var_auditd_disk_error_action:var:1" value-id="xccdf_org.ssgproject.content_value_var_auditd_disk_error_action"/>
            <check-content-ref name="oval:ssg-auditd_data_disk_error_action:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-auditd_data_disk_error_action_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_auditd_data_retention_num_logs" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Configure auditd Number of Logs Retained</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Determine how many log files
<html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> should retain when it rotates logs.
Edit the file <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/auditd.conf</html:code>. Add or modify the following
line, substituting <html:i xmlns:html="http://www.w3.org/1999/xhtml">NUMLOGS</html:i> with the correct value of <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_auditd_num_logs" use="legacy"/>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">num_logs = <html:i>NUMLOGS</html:i></html:pre>
Set the value to 5 for general-purpose systems.
Note that values less than 2 result in no log rotation.</description>
          <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.3.1</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-11</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</reference>
          <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.10</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO12.06</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI08.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.4.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.4.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.4.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.4.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.7.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.16.1.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.16.1.5</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.16.1.7</reference>
          <reference href="https://www.cisecurity.org/controls/">1</reference>
          <reference href="https://www.cisecurity.org/controls/">11</reference>
          <reference href="https://www.cisecurity.org/controls/">12</reference>
          <reference href="https://www.cisecurity.org/controls/">13</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">16</reference>
          <reference href="https://www.cisecurity.org/controls/">19</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">4</reference>
          <reference href="https://www.cisecurity.org/controls/">5</reference>
          <reference href="https://www.cisecurity.org/controls/">6</reference>
          <reference href="https://www.cisecurity.org/controls/">7</reference>
          <reference href="https://www.cisecurity.org/controls/">8</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The total storage for audit log files must be large enough to retain
log information over the period required. This is a function of the maximum log
file size and the number of logs retained.</rationale>
          <platform idref="cpe:/a:machine"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="auditd_data_retention_num_logs" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then


var_auditd_num_logs="<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_auditd_num_logs" use="legacy"/>"



AUDITCONFIG=/etc/audit/auditd.conf
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_replace_or_append" use="legacy"/>
replace_or_append $AUDITCONFIG '^num_logs' "$var_auditd_num_logs" ""

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="auditd_data_retention_num_logs" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: XCCDF Value var_auditd_num_logs # promote to variable
  set_fact:
    var_auditd_num_logs: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_auditd_num_logs" use="legacy"/>
  tags:
    - always

- name: Configure auditd Number of Logs Retained
  lineinfile:
    dest: /etc/audit/auditd.conf
    line: num_logs = {{ var_auditd_num_logs }}
    regexp: ^\s*num_logs\s*=\s*.*$
    state: present
    create: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.3.1
    - NIST-800-53-AU-11
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.7
    - auditd_data_retention_num_logs
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="auditd_data_retention_num_logs" system="urn:xccdf:fix:script:kubernetes" reboot="true" complexity="low" disruption="low" strategy="restrict">apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,%23%0A%23%20This%20file%20controls%20the%20configuration%20of%20the%20audit%20daemon%0A%23%0A%0Alocal_events%20%3D%20yes%0Awrite_logs%20%3D%20yes%0Alog_file%20%3D%20/var/log/audit/audit.log%0Alog_group%20%3D%20root%0Alog_format%20%3D%20ENRICHED%0Aflush%20%3D%20incremental_async%0Afreq%20%3D%2050%0Amax_log_file%20%3D%208%0Anum_logs%20%3D%205%0Apriority_boost%20%3D%204%0Aname_format%20%3D%20hostname%0A%23%23name%20%3D%20mydomain%0Amax_log_file_action%20%3D%20rotate%0Aspace_left%20%3D%20100%0Aspace_left_action%20%3D%20syslog%0Averify_email%20%3D%20yes%0Aaction_mail_acct%20%3D%20root%0Aadmin_space_left%20%3D%2050%0Aadmin_space_left_action%20%3D%20syslog%0Adisk_full_action%20%3D%20syslog%0Adisk_error_action%20%3D%20syslog%0Ause_libwrap%20%3D%20yes%0A%23%23tcp_listen_port%20%3D%2060%0Atcp_listen_queue%20%3D%205%0Atcp_max_per_addr%20%3D%201%0A%23%23tcp_client_ports%20%3D%201024-65535%0Atcp_client_max_idle%20%3D%200%0Atransport%20%3D%20TCP%0Akrb5_principal%20%3D%20auditd%0A%23%23krb5_key_file%20%3D%20/etc/audit/audit.key%0Adistribute_network%20%3D%20no%0Aq_depth%20%3D%20400%0Aoverflow_action%20%3D%20syslog%0Amax_restarts%20%3D%2010%0Aplugin_dir%20%3D%20/etc/audit/plugins.d
        mode: 0640
        path: /etc/audit/auditd.conf
        overwrite: true
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export export-name="oval:ssg-var_auditd_num_logs:var:1" value-id="xccdf_org.ssgproject.content_value_var_auditd_num_logs"/>
            <check-content-ref name="oval:ssg-auditd_data_retention_num_logs:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-auditd_data_retention_num_logs_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_auditd_audispd_syslog_plugin_activated" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Configure auditd to use audispd's syslog plugin</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To configure the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> service to use the
<html:code xmlns:html="http://www.w3.org/1999/xhtml">syslog</html:code> plug-in of the <html:code xmlns:html="http://www.w3.org/1999/xhtml">audispd</html:code> audit event multiplexor, set
the <html:code xmlns:html="http://www.w3.org/1999/xhtml">active</html:code> line in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/plugins.d/syslog.conf</html:code> to <html:code xmlns:html="http://www.w3.org/1999/xhtml">yes</html:code>.
Restart the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> service:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo service auditd restart</html:pre></description>
          <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.3.1</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-000136</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(B)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(6)(ii)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(8)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(2)(iii)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.314(a)(2)(i)(C)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.314(a)(2)(iii)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-4(1)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</reference>
          <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</reference>
          <reference href="">SRG-OS-000051-VMM-000230</reference>
          <reference href="">SRG-OS-000058-VMM-000270</reference>
          <reference href="">SRG-OS-000059-VMM-000280</reference>
          <reference href="">SRG-OS-000479-VMM-001990</reference>
          <reference href="">SRG-OS-000479-VMM-001990</reference>
          <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.5.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.10</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO12.06</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI08.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.4.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.4.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.4.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.4.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.7.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.16.1.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.16.1.5</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.16.1.7</reference>
          <reference href="https://www.cisecurity.org/controls/">1</reference>
          <reference href="https://www.cisecurity.org/controls/">11</reference>
          <reference href="https://www.cisecurity.org/controls/">12</reference>
          <reference href="https://www.cisecurity.org/controls/">13</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">16</reference>
          <reference href="https://www.cisecurity.org/controls/">19</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">4</reference>
          <reference href="https://www.cisecurity.org/controls/">5</reference>
          <reference href="https://www.cisecurity.org/controls/">6</reference>
          <reference href="https://www.cisecurity.org/controls/">7</reference>
          <reference href="https://www.cisecurity.org/controls/">8</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000479-GPOS-00224</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000342-GPOS-00133</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The auditd service does not include the ability to send audit
records to a centralized server for management directly. It does, however,
include a plug-in for audit event multiplexor (audispd) to pass audit records
to the local syslog server</rationale>
          <platform idref="cpe:/a:machine"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="auditd_audispd_syslog_plugin_activated" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then


var_syslog_active="yes"


AUDISP_SYSLOGCONFIG=/etc/audit/plugins.d/syslog.conf
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_replace_or_append" use="legacy"/>
replace_or_append $AUDISP_SYSLOGCONFIG '^active' "$var_syslog_active" ""

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="auditd_audispd_syslog_plugin_activated" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: enable syslog plugin
  lineinfile:
    dest: /etc/audit/plugins.d/syslog.conf
    regexp: ^active
    line: active = yes
    create: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.3.1
    - NIST-800-53-AU-4(1)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.3
    - auditd_audispd_syslog_plugin_activated
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-auditd_audispd_syslog_plugin_activated:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-auditd_audispd_syslog_plugin_activated_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_auditd_write_logs" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Write Audit Logs to the Disk</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To configure Audit daemon to write Audit logs to the disk, set
<html:code xmlns:html="http://www.w3.org/1999/xhtml">write_logs</html:code> to <html:code xmlns:html="http://www.w3.org/1999/xhtml">yes</html:code> in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/auditd.conf</html:code>.
This is the default setting.</description>
          <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">If <html:code xmlns:html="http://www.w3.org/1999/xhtml">write_logs</html:code> isn't set to <html:code xmlns:html="http://www.w3.org/1999/xhtml">yes</html:code>, the Audit logs will
not be written to the disk.</rationale>
          <platform idref="cpe:/a:machine"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="auditd_write_logs" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="restrict"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

if [ -e "/etc/audit/auditd.conf" ] ; then
    LC_ALL=C sed -i "/^\s*write_logs\s*=\s*/Id" "/etc/audit/auditd.conf"
else
    touch "/etc/audit/auditd.conf"
fi
cp "/etc/audit/auditd.conf" "/etc/audit/auditd.conf.bak"
# Insert at the end of the file
printf '%s\n' "write_logs = yes" &gt;&gt; "/etc/audit/auditd.conf"
# Clean up after ourselves.
rm "/etc/audit/auditd.conf.bak"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="auditd_write_logs" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Write Audit Logs to the Disk
  block:

    - name: Check for duplicate values
      lineinfile:
        path: /etc/audit/auditd.conf
        create: false
        regexp: (?i)^\s*write_logs\s*=\s*
        state: absent
      check_mode: true
      changed_when: false
      register: dupes

    - name: Deduplicate values from /etc/audit/auditd.conf
      lineinfile:
        path: /etc/audit/auditd.conf
        create: false
        regexp: (?i)^\s*write_logs\s*=\s*
        state: absent
      when: dupes.found is defined and dupes.found &gt; 1

    - name: Insert correct line to /etc/audit/auditd.conf
      lineinfile:
        path: /etc/audit/auditd.conf
        create: true
        regexp: (?i)^\s*write_logs\s*=\s*
        line: write_logs = yes
        state: present
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - auditd_write_logs
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="auditd_write_logs" system="urn:xccdf:fix:script:kubernetes" reboot="true" complexity="low" disruption="low" strategy="restrict">apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,%23%0A%23%20This%20file%20controls%20the%20configuration%20of%20the%20audit%20daemon%0A%23%0A%0Alocal_events%20%3D%20yes%0Awrite_logs%20%3D%20yes%0Alog_file%20%3D%20/var/log/audit/audit.log%0Alog_group%20%3D%20root%0Alog_format%20%3D%20ENRICHED%0Aflush%20%3D%20incremental_async%0Afreq%20%3D%2050%0Amax_log_file%20%3D%208%0Anum_logs%20%3D%205%0Apriority_boost%20%3D%204%0Aname_format%20%3D%20hostname%0A%23%23name%20%3D%20mydomain%0Amax_log_file_action%20%3D%20rotate%0Aspace_left%20%3D%20100%0Aspace_left_action%20%3D%20syslog%0Averify_email%20%3D%20yes%0Aaction_mail_acct%20%3D%20root%0Aadmin_space_left%20%3D%2050%0Aadmin_space_left_action%20%3D%20syslog%0Adisk_full_action%20%3D%20syslog%0Adisk_error_action%20%3D%20syslog%0Ause_libwrap%20%3D%20yes%0A%23%23tcp_listen_port%20%3D%2060%0Atcp_listen_queue%20%3D%205%0Atcp_max_per_addr%20%3D%201%0A%23%23tcp_client_ports%20%3D%201024-65535%0Atcp_client_max_idle%20%3D%200%0Atransport%20%3D%20TCP%0Akrb5_principal%20%3D%20auditd%0A%23%23krb5_key_file%20%3D%20/etc/audit/audit.key%0Adistribute_network%20%3D%20no%0Aq_depth%20%3D%20400%0Aoverflow_action%20%3D%20syslog%0Amax_restarts%20%3D%2010%0Aplugin_dir%20%3D%20/etc/audit/plugins.d
        mode: 0640
        path: /etc/audit/auditd.conf
        overwrite: true
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-auditd_write_logs:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-auditd_write_logs_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_auditd_data_retention_admin_space_left_action" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Configure auditd admin_space_left Action on Low Disk Space</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> service can be configured to take an action
when disk space is running low but prior to running out of space completely.
Edit the file <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/auditd.conf</html:code>. Add or modify the following line,
substituting <html:i xmlns:html="http://www.w3.org/1999/xhtml">ACTION</html:i> appropriately:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">admin_space_left_action = <html:i>ACTION</html:i></html:pre>
Set this value to <html:code xmlns:html="http://www.w3.org/1999/xhtml">single</html:code> to cause the system to switch to single user
mode for corrective action. Acceptable values also include <html:code xmlns:html="http://www.w3.org/1999/xhtml">suspend</html:code> and
<html:code xmlns:html="http://www.w3.org/1999/xhtml">halt</html:code>. For certain systems, the need for availability
outweighs the need to log all actions, and a different setting should be
determined. Details regarding all possible values for <html:i xmlns:html="http://www.w3.org/1999/xhtml">ACTION</html:i> are described in the
<html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd.conf</html:code> man page.</description>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000343-GPOS-00134</reference>
          <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.3.1</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-000140</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-001343</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-001855</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(ii)</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.1.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.4.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.4.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.4.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.4.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.7.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.16.1.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.16.1.5</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.16.1.7</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.17.2.1</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-5(b)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-5(2)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-5(1)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-5(4)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</reference>
          <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.10</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO12.06</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI04.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI08.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
          <reference href="https://www.cisecurity.org/controls/">1</reference>
          <reference href="https://www.cisecurity.org/controls/">11</reference>
          <reference href="https://www.cisecurity.org/controls/">12</reference>
          <reference href="https://www.cisecurity.org/controls/">13</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">16</reference>
          <reference href="https://www.cisecurity.org/controls/">19</reference>
          <reference href="https://www.cisecurity.org/controls/">2</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">4</reference>
          <reference href="https://www.cisecurity.org/controls/">5</reference>
          <reference href="https://www.cisecurity.org/controls/">6</reference>
          <reference href="https://www.cisecurity.org/controls/">7</reference>
          <reference href="https://www.cisecurity.org/controls/">8</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Administrators should be made aware of an inability to record
audit records. If a separate partition or logical volume of adequate size
is used, running low on space for audit records should never occur.</rationale>
          <platform idref="cpe:/a:machine"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="auditd_data_retention_admin_space_left_action" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then


var_auditd_admin_space_left_action="<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_auditd_admin_space_left_action" use="legacy"/>"



AUDITCONFIG=/etc/audit/auditd.conf
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_replace_or_append" use="legacy"/>
replace_or_append $AUDITCONFIG '^admin_space_left_action' "$var_auditd_admin_space_left_action" ""

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="auditd_data_retention_admin_space_left_action" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: XCCDF Value var_auditd_admin_space_left_action # promote to variable
  set_fact:
    var_auditd_admin_space_left_action: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_auditd_admin_space_left_action" use="legacy"/>
  tags:
    - always

- name: Configure auditd admin_space_left Action on Low Disk Space
  lineinfile:
    dest: /etc/audit/auditd.conf
    line: admin_space_left_action = {{ var_auditd_admin_space_left_action }}
    regexp: ^\s*admin_space_left_action\s*=\s*.*$
    state: present
    create: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.3.1
    - NIST-800-53-AU-5(1)
    - NIST-800-53-AU-5(2)
    - NIST-800-53-AU-5(4)
    - NIST-800-53-AU-5(b)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.7
    - auditd_data_retention_admin_space_left_action
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="auditd_data_retention_admin_space_left_action" system="urn:xccdf:fix:script:kubernetes" reboot="true" complexity="low" disruption="low" strategy="restrict">apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,%23%0A%23%20This%20file%20controls%20the%20configuration%20of%20the%20audit%20daemon%0A%23%0A%0Alocal_events%20%3D%20yes%0Awrite_logs%20%3D%20yes%0Alog_file%20%3D%20/var/log/audit/audit.log%0Alog_group%20%3D%20root%0Alog_format%20%3D%20ENRICHED%0Aflush%20%3D%20incremental_async%0Afreq%20%3D%2050%0Amax_log_file%20%3D%208%0Anum_logs%20%3D%205%0Apriority_boost%20%3D%204%0Aname_format%20%3D%20hostname%0A%23%23name%20%3D%20mydomain%0Amax_log_file_action%20%3D%20rotate%0Aspace_left%20%3D%20100%0Aspace_left_action%20%3D%20syslog%0Averify_email%20%3D%20yes%0Aaction_mail_acct%20%3D%20root%0Aadmin_space_left%20%3D%2050%0Aadmin_space_left_action%20%3D%20syslog%0Adisk_full_action%20%3D%20syslog%0Adisk_error_action%20%3D%20syslog%0Ause_libwrap%20%3D%20yes%0A%23%23tcp_listen_port%20%3D%2060%0Atcp_listen_queue%20%3D%205%0Atcp_max_per_addr%20%3D%201%0A%23%23tcp_client_ports%20%3D%201024-65535%0Atcp_client_max_idle%20%3D%200%0Atransport%20%3D%20TCP%0Akrb5_principal%20%3D%20auditd%0A%23%23krb5_key_file%20%3D%20/etc/audit/audit.key%0Adistribute_network%20%3D%20no%0Aq_depth%20%3D%20400%0Aoverflow_action%20%3D%20syslog%0Amax_restarts%20%3D%2010%0Aplugin_dir%20%3D%20/etc/audit/plugins.d
        mode: 0640
        path: /etc/audit/auditd.conf
        overwrite: true
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export export-name="oval:ssg-var_auditd_admin_space_left_action:var:1" value-id="xccdf_org.ssgproject.content_value_var_auditd_admin_space_left_action"/>
            <check-content-ref name="oval:ssg-auditd_data_retention_admin_space_left_action:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-auditd_data_retention_admin_space_left_action_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_auditd_local_events" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Include Local Events in Audit Logs</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To configure Audit daemon to include local events in Audit logs, set
<html:code xmlns:html="http://www.w3.org/1999/xhtml">local_events</html:code> to <html:code xmlns:html="http://www.w3.org/1999/xhtml">yes</html:code> in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/auditd.conf</html:code>.
This is the default setting.</description>
          <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">If option <html:code xmlns:html="http://www.w3.org/1999/xhtml">local_events</html:code> isn't set to <html:code xmlns:html="http://www.w3.org/1999/xhtml">yes</html:code> only events from
network will be aggregated.</rationale>
          <platform idref="cpe:/a:machine"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="auditd_local_events" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="restrict"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

if [ -e "/etc/audit/auditd.conf" ] ; then
    LC_ALL=C sed -i "/^\s*local_events\s*=\s*/Id" "/etc/audit/auditd.conf"
else
    touch "/etc/audit/auditd.conf"
fi
cp "/etc/audit/auditd.conf" "/etc/audit/auditd.conf.bak"
# Insert at the end of the file
printf '%s\n' "local_events = yes" &gt;&gt; "/etc/audit/auditd.conf"
# Clean up after ourselves.
rm "/etc/audit/auditd.conf.bak"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="auditd_local_events" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Include Local Events in Audit Logs
  block:

    - name: Check for duplicate values
      lineinfile:
        path: /etc/audit/auditd.conf
        create: false
        regexp: (?i)^\s*local_events\s*=\s*
        state: absent
      check_mode: true
      changed_when: false
      register: dupes

    - name: Deduplicate values from /etc/audit/auditd.conf
      lineinfile:
        path: /etc/audit/auditd.conf
        create: false
        regexp: (?i)^\s*local_events\s*=\s*
        state: absent
      when: dupes.found is defined and dupes.found &gt; 1

    - name: Insert correct line to /etc/audit/auditd.conf
      lineinfile:
        path: /etc/audit/auditd.conf
        create: true
        regexp: (?i)^\s*local_events\s*=\s*
        line: local_events = yes
        state: present
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - auditd_local_events
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="auditd_local_events" system="urn:xccdf:fix:script:kubernetes" reboot="true" complexity="low" disruption="low" strategy="restrict">apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,%23%0A%23%20This%20file%20controls%20the%20configuration%20of%20the%20audit%20daemon%0A%23%0A%0Alocal_events%20%3D%20yes%0Awrite_logs%20%3D%20yes%0Alog_file%20%3D%20/var/log/audit/audit.log%0Alog_group%20%3D%20root%0Alog_format%20%3D%20ENRICHED%0Aflush%20%3D%20incremental_async%0Afreq%20%3D%2050%0Amax_log_file%20%3D%208%0Anum_logs%20%3D%205%0Apriority_boost%20%3D%204%0Aname_format%20%3D%20hostname%0A%23%23name%20%3D%20mydomain%0Amax_log_file_action%20%3D%20rotate%0Aspace_left%20%3D%20100%0Aspace_left_action%20%3D%20syslog%0Averify_email%20%3D%20yes%0Aaction_mail_acct%20%3D%20root%0Aadmin_space_left%20%3D%2050%0Aadmin_space_left_action%20%3D%20syslog%0Adisk_full_action%20%3D%20syslog%0Adisk_error_action%20%3D%20syslog%0Ause_libwrap%20%3D%20yes%0A%23%23tcp_listen_port%20%3D%2060%0Atcp_listen_queue%20%3D%205%0Atcp_max_per_addr%20%3D%201%0A%23%23tcp_client_ports%20%3D%201024-65535%0Atcp_client_max_idle%20%3D%200%0Atransport%20%3D%20TCP%0Akrb5_principal%20%3D%20auditd%0A%23%23krb5_key_file%20%3D%20/etc/audit/audit.key%0Adistribute_network%20%3D%20no%0Aq_depth%20%3D%20400%0Aoverflow_action%20%3D%20syslog%0Amax_restarts%20%3D%2010%0Aplugin_dir%20%3D%20/etc/audit/plugins.d
        mode: 0640
        path: /etc/audit/auditd.conf
        overwrite: true
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-auditd_local_events:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-auditd_local_events_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
      </Group>
      <Group id="xccdf_org.ssgproject.content_group_policy_rules">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">System Accounting with auditd</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> program can perform comprehensive
monitoring of system activity. This section makes use of recommended
configuration settings for specific policies or use cases.
The rules in this section make use of rules defined in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/usr/share/doc/audit-VERSION/rules</html:code>.</description>
        <platform idref="cpe:/a:machine"/>
      </Group>
    </Group>
    <Group id="xccdf_org.ssgproject.content_group_permissions">
      <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">File Permissions and Masks</title>
      <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Traditional Unix security relies heavily on file and
directory permissions to prevent unauthorized users from reading or
modifying files to which they should not have access.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Several of the commands in this section search filesystems
for files or directories with certain characteristics, and are
intended to be run on every local partition on a given system.
When the variable <html:i xmlns:html="http://www.w3.org/1999/xhtml">PART</html:i> appears in one of the commands below,
it means that the command is intended to be run repeatedly, with the
name of each local partition substituted for <html:i xmlns:html="http://www.w3.org/1999/xhtml">PART</html:i> in turn.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
The following command prints a list of all xfs partitions on the local
system, which is the default filesystem for Fedora
installations:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ mount -t xfs | awk '{print $3}'</html:pre>
For any systems that use a different
local filesystem type, modify this command as appropriate.</description>
      <Group id="xccdf_org.ssgproject.content_group_mounting">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Restrict Dynamic Mounting and Unmounting of
Filesystems</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Linux includes a number of facilities for the automated addition
and removal of filesystems on a running system.  These facilities may be
necessary in many environments, but this capability also carries some risk -- whether direct
risk from allowing users to introduce arbitrary filesystems,
or risk that software flaws in the automated mount facility itself could
allow an attacker to compromise the system.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
This command can be used to list the types of filesystems that are
available to the currently executing kernel:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ find /lib/modules/`uname -r`/kernel/fs -type f -name '*.ko'</html:pre>
If these filesystems are not required then they can be explicitly disabled
in a configuratio file in  <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/modprobe.d</html:code>.</description>
        <Rule id="xccdf_org.ssgproject.content_rule_service_autofs_disabled" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable the Automounter</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">autofs</html:code> daemon mounts and unmounts filesystems, such as user
home directories shared via NFS, on demand. In addition, autofs can be used to handle
removable media, and the default configuration provides the cdrom device as <html:code xmlns:html="http://www.w3.org/1999/xhtml">/misc/cd</html:code>.
However, this method of providing access to removable media is not common, so autofs
can almost always be disabled if NFS is not in use. Even if NFS is required, it may be
possible to configure filesystem mounts statically by editing <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/fstab</html:code>
rather than relying on the automounter.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>

The <html:code xmlns:html="http://www.w3.org/1999/xhtml">autofs</html:code> service can be disabled with the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo systemctl mask --now autofs.service</html:pre></description>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.4.6</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-000778</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-001958</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(i)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(1)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(2)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(1)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(iv)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">MP-7</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000114-GPOS-00059</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000378-GPOS-00163</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.2.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS01.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.10</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.10</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.11.2.6</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.18.1.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.6.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.6.2.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.7.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.6</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.3.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.3</reference>
          <reference href="https://www.cisecurity.org/controls/">1</reference>
          <reference href="https://www.cisecurity.org/controls/">12</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">16</reference>
          <reference href="https://www.cisecurity.org/controls/">5</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disabling the automounter permits the administrator to
statically control filesystem mounting through <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/fstab</html:code>.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Additionally, automatically mounting filesystems permits easy introduction of
unknown devices, thereby facilitating malicious activity.</rationale>
          <platform idref="cpe:/a:machine"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="service_autofs_disabled" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

SYSTEMCTL_EXEC='/usr/bin/systemctl'
"$SYSTEMCTL_EXEC" stop 'autofs.service'
"$SYSTEMCTL_EXEC" disable 'autofs.service'
"$SYSTEMCTL_EXEC" mask 'autofs.service'
# Disable socket activation if we have a unit file for it
if "$SYSTEMCTL_EXEC" list-unit-files | grep -q '^autofs.socket'; then
    "$SYSTEMCTL_EXEC" stop 'autofs.socket'
    "$SYSTEMCTL_EXEC" mask 'autofs.socket'
fi
# The service may not be running because it has been started and failed,
# so let's reset the state so OVAL checks pass.
# Service should be 'inactive', not 'failed' after reboot though.
"$SYSTEMCTL_EXEC" reset-failed 'autofs.service' || true

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="service_autofs_disabled" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="disable">- name: Disable service autofs
  block:

    - name: Gather the service facts
      service_facts: null

    - name: Disable service autofs
      systemd:
        name: autofs.service
        enabled: 'no'
        state: stopped
        masked: 'yes'
      when: '"autofs.service" in ansible_facts.services'
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.4.6
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - disable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - service_autofs_disabled

- name: Unit Socket Exists - autofs.socket
  command: systemctl list-unit-files autofs.socket
  args:
    warn: false
  register: socket_file_exists
  changed_when: false
  ignore_errors: true
  check_mode: false
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.4.6
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - disable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - service_autofs_disabled

- name: Disable socket autofs
  systemd:
    name: autofs.socket
    enabled: 'no'
    state: stopped
    masked: 'yes'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - '"autofs.socket" in socket_file_exists.stdout_lines[1]'
  tags:
    - NIST-800-171-3.4.6
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - disable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - service_autofs_disabled
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="service_autofs_disabled" system="urn:xccdf:fix:script:puppet" complexity="low" disruption="low" strategy="enable">include disable_autofs

class disable_autofs {
  service {'autofs':
    enable =&gt; false,
    ensure =&gt; 'stopped',
  }
}
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="service_autofs_disabled" system="urn:xccdf:fix:script:kubernetes">apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    systemd:
      units:
      - enabled: false
        name: autofs.service
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-service_autofs_disabled:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-service_autofs_disabled_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_grub2_nousb_argument" selected="false" role="full" severity="unknown">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable Kernel Support for USB via Bootloader Configuration</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">All USB support can be disabled by adding the <html:code xmlns:html="http://www.w3.org/1999/xhtml">nousb</html:code>
argument to the kernel's boot loader configuration. To do so,
append "nousb" to the kernel line in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/default/grub</html:code> as shown:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">kernel /vmlinuz-<html:i>VERSION</html:i> ro vga=ext root=/dev/VolGroup00/LogVol00 rhgb quiet nousb</html:pre></description>
          <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="functionality">Disabling all kernel support for USB will cause problems for systems
with USB-based keyboards, mice, or printers. This configuration is
infeasible for systems which require USB devices, which is common.</warning>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-001250</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(i)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(1)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(2)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(1)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(iv)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">MP-7</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.2.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS01.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.03</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.11.2.6</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.6.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.6.2.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.7.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.1</reference>
          <reference href="https://www.cisecurity.org/controls/">12</reference>
          <reference href="https://www.cisecurity.org/controls/">16</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disabling the USB subsystem within the Linux kernel at system boot will
protect against potentially malicious USB devices, although it is only practical
in specialized systems.</rationale>
          <platform idref="cpe:/a:grub2"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="grub2_nousb_argument" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q grub2-common; then

# Correct the form of default kernel command line in /etc/default/grub
if ! grep -q ^GRUB_CMDLINE_LINUX=\".*nousb.*\" /etc/default/grub;
then
  # Edit configuration setting
  # Append 'nousb' argument to /etc/default/grub (if not present yet)
  sed -i "s/\(GRUB_CMDLINE_LINUX=\)\"\(.*\)\"/\1\"\2 nousb\"/" /etc/default/grub
  # Edit runtime setting
  # Correct the form of kernel command line for each installed kernel in the bootloader
  /sbin/grubby --update-kernel=ALL --args="nousb"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-grub2_nousb_argument:def:1" href="ssg-fedora-oval.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_kernel_module_udf_disabled" selected="false" role="full" severity="low">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable Mounting of udf</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">
To configure the system to prevent the <html:code xmlns:html="http://www.w3.org/1999/xhtml">udf</html:code>
kernel module from being loaded, add the following line to a file in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/modprobe.d</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">install udf /bin/true</html:pre>
This effectively prevents usage of this uncommon filesystem.

The <html:code xmlns:html="http://www.w3.org/1999/xhtml">udf</html:code> filesystem type is the universal disk format
used to implement the ISO/IEC 13346 and ECMA-167 specifications.
This is an open vendor filesystem type for data storage on a broad
range of media. This filesystem type is neccessary to support
writing DVDs and newer optical disc formats.</description>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.4.6</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.11</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.12</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.3</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.06</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.5.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.6.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.2.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.2.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
          <reference href="https://www.cisecurity.org/controls/">11</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">9</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Removing support for unneeded filesystem types reduces the local
attack surface of the system.</rationale>
          <platform idref="cpe:/a:machine"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="kernel_module_udf_disabled" system="urn:xccdf:fix:script:sh" reboot="true" complexity="low" disruption="medium" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

if LC_ALL=C grep -q -m 1 "^install udf" /etc/modprobe.d/udf.conf ; then
	sed -i 's/^install udf.*/install udf /bin/true/g' /etc/modprobe.d/udf.conf
else
	echo -e "\n# Disable per security requirements" &gt;&gt; /etc/modprobe.d/udf.conf
	echo "install udf /bin/true" &gt;&gt; /etc/modprobe.d/udf.conf
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="kernel_module_udf_disabled" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="medium" strategy="disable">- name: Ensure kernel module 'udf' is disabled
  lineinfile:
    create: true
    dest: /etc/modprobe.d/udf.conf
    regexp: udf
    line: install udf /bin/true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.4.6
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - disable_strategy
    - kernel_module_udf_disabled
    - low_complexity
    - low_severity
    - medium_disruption
    - reboot_required
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="kernel_module_udf_disabled" system="urn:xccdf:fix:script:kubernetes">apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,install%20udf%20/bin/true%0A
        mode: 0644
        path: /etc/modprobe.d/75-kernel_module_udf_disabled.conf
        overwrite: true
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-kernel_module_udf_disabled:def:1" href="ssg-fedora-oval.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_kernel_module_vfat_disabled" selected="false" role="full" severity="low">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable Mounting of vFAT filesystems</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">
To configure the system to prevent the <html:code xmlns:html="http://www.w3.org/1999/xhtml">vfat</html:code>
kernel module from being loaded, add the following line to a file in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/modprobe.d</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">install vfat /bin/true</html:pre>
This effectively prevents usage of this uncommon filesystem.

The <html:code xmlns:html="http://www.w3.org/1999/xhtml">vFAT</html:code> filesystem format is primarily used on older
windows systems and portable USB drives or flash modules. It comes
in three types <html:code xmlns:html="http://www.w3.org/1999/xhtml">FAT12</html:code>, <html:code xmlns:html="http://www.w3.org/1999/xhtml">FAT16</html:code>, and <html:code xmlns:html="http://www.w3.org/1999/xhtml">FAT32</html:code>
all of which are supported by the <html:code xmlns:html="http://www.w3.org/1999/xhtml">vfat</html:code> kernel module.</description>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.4.6</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.11</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.12</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.3</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.06</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.5.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.6.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.2.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.2.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
          <reference href="https://www.cisecurity.org/controls/">11</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">9</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Removing support for unneeded filesystems reduces the local attack
surface of the system.</rationale>
          <platform idref="cpe:/a:machine"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="kernel_module_vfat_disabled" system="urn:xccdf:fix:script:sh" reboot="true" complexity="low" disruption="medium" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

if LC_ALL=C grep -q -m 1 "^install vfat" /etc/modprobe.d/vfat.conf ; then
	sed -i 's/^install vfat.*/install vfat /bin/true/g' /etc/modprobe.d/vfat.conf
else
	echo -e "\n# Disable per security requirements" &gt;&gt; /etc/modprobe.d/vfat.conf
	echo "install vfat /bin/true" &gt;&gt; /etc/modprobe.d/vfat.conf
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="kernel_module_vfat_disabled" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="medium" strategy="disable">- name: Ensure kernel module 'vfat' is disabled
  lineinfile:
    create: true
    dest: /etc/modprobe.d/vfat.conf
    regexp: vfat
    line: install vfat /bin/true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.4.6
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - disable_strategy
    - kernel_module_vfat_disabled
    - low_complexity
    - low_severity
    - medium_disruption
    - reboot_required
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="kernel_module_vfat_disabled" system="urn:xccdf:fix:script:kubernetes">apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,install%20vfat%20/bin/true%0A
        mode: 0644
        path: /etc/modprobe.d/75-kernel_module_vfat_disabled.conf
        overwrite: true
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-kernel_module_vfat_disabled:def:1" href="ssg-fedora-oval.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_kernel_module_hfsplus_disabled" selected="false" role="full" severity="low">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable Mounting of hfsplus</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">
To configure the system to prevent the <html:code xmlns:html="http://www.w3.org/1999/xhtml">hfsplus</html:code>
kernel module from being loaded, add the following line to a file in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/modprobe.d</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">install hfsplus /bin/true</html:pre>
This effectively prevents usage of this uncommon filesystem.</description>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.4.6</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.11</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.12</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.3</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.06</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.5.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.6.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.2.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.2.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
          <reference href="https://www.cisecurity.org/controls/">11</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">9</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Linux kernel modules which implement filesystems that are not needed by the
local system should be disabled.</rationale>
          <platform idref="cpe:/a:machine"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="kernel_module_hfsplus_disabled" system="urn:xccdf:fix:script:sh" reboot="true" complexity="low" disruption="medium" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

if LC_ALL=C grep -q -m 1 "^install hfsplus" /etc/modprobe.d/hfsplus.conf ; then
	sed -i 's/^install hfsplus.*/install hfsplus /bin/true/g' /etc/modprobe.d/hfsplus.conf
else
	echo -e "\n# Disable per security requirements" &gt;&gt; /etc/modprobe.d/hfsplus.conf
	echo "install hfsplus /bin/true" &gt;&gt; /etc/modprobe.d/hfsplus.conf
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="kernel_module_hfsplus_disabled" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="medium" strategy="disable">- name: Ensure kernel module 'hfsplus' is disabled
  lineinfile:
    create: true
    dest: /etc/modprobe.d/hfsplus.conf
    regexp: hfsplus
    line: install hfsplus /bin/true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.4.6
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - disable_strategy
    - kernel_module_hfsplus_disabled
    - low_complexity
    - low_severity
    - medium_disruption
    - reboot_required
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="kernel_module_hfsplus_disabled" system="urn:xccdf:fix:script:kubernetes">apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,install%20hfsplus%20/bin/true%0A
        mode: 0644
        path: /etc/modprobe.d/75-kernel_module_hfsplus_disabled.conf
        overwrite: true
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-kernel_module_hfsplus_disabled:def:1" href="ssg-fedora-oval.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_kernel_module_jffs2_disabled" selected="false" role="full" severity="low">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable Mounting of jffs2</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">
To configure the system to prevent the <html:code xmlns:html="http://www.w3.org/1999/xhtml">jffs2</html:code>
kernel module from being loaded, add the following line to a file in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/modprobe.d</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">install jffs2 /bin/true</html:pre>
This effectively prevents usage of this uncommon filesystem.</description>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.4.6</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.11</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.12</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.3</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.06</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.5.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.6.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.2.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.2.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
          <reference href="https://www.cisecurity.org/controls/">11</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">9</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Linux kernel modules which implement filesystems that are not needed by the
local system should be disabled.</rationale>
          <platform idref="cpe:/a:machine"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="kernel_module_jffs2_disabled" system="urn:xccdf:fix:script:sh" reboot="true" complexity="low" disruption="medium" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

if LC_ALL=C grep -q -m 1 "^install jffs2" /etc/modprobe.d/jffs2.conf ; then
	sed -i 's/^install jffs2.*/install jffs2 /bin/true/g' /etc/modprobe.d/jffs2.conf
else
	echo -e "\n# Disable per security requirements" &gt;&gt; /etc/modprobe.d/jffs2.conf
	echo "install jffs2 /bin/true" &gt;&gt; /etc/modprobe.d/jffs2.conf
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="kernel_module_jffs2_disabled" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="medium" strategy="disable">- name: Ensure kernel module 'jffs2' is disabled
  lineinfile:
    create: true
    dest: /etc/modprobe.d/jffs2.conf
    regexp: jffs2
    line: install jffs2 /bin/true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.4.6
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - disable_strategy
    - kernel_module_jffs2_disabled
    - low_complexity
    - low_severity
    - medium_disruption
    - reboot_required
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="kernel_module_jffs2_disabled" system="urn:xccdf:fix:script:kubernetes">apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,install%20jffs2%20/bin/true%0A
        mode: 0644
        path: /etc/modprobe.d/75-kernel_module_jffs2_disabled.conf
        overwrite: true
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-kernel_module_jffs2_disabled:def:1" href="ssg-fedora-oval.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_kernel_module_usb-storage_disabled" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable Modprobe Loading of USB Storage Driver</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To prevent USB storage devices from being used, configure the kernel module loading system
to prevent automatic loading of the USB storage driver.

To configure the system to prevent the <html:code xmlns:html="http://www.w3.org/1999/xhtml">usb-storage</html:code>
kernel module from being loaded, add the following line to a file in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/modprobe.d</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">install usb-storage /bin/true</html:pre>
This will prevent the <html:code xmlns:html="http://www.w3.org/1999/xhtml">modprobe</html:code> program from loading the <html:code xmlns:html="http://www.w3.org/1999/xhtml">usb-storage</html:code>
module, but will not prevent an administrator (or another program) from using the
<html:code xmlns:html="http://www.w3.org/1999/xhtml">insmod</html:code> program to load the module manually.</description>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.21</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-000778</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-001958</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(i)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(1)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(2)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(1)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(iv)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">MP-7</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000114-GPOS-00059</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000378-GPOS-00163</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.2.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS01.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.10</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.10</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.11.2.6</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.18.1.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.6.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.6.2.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.7.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.6</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.3.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.3</reference>
          <reference href="https://www.cisecurity.org/controls/">1</reference>
          <reference href="https://www.cisecurity.org/controls/">12</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">16</reference>
          <reference href="https://www.cisecurity.org/controls/">5</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">USB storage devices such as thumb drives can be used to introduce
malicious software.</rationale>
          <platform idref="cpe:/a:machine"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="kernel_module_usb-storage_disabled" system="urn:xccdf:fix:script:sh" reboot="true" complexity="low" disruption="medium" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

if LC_ALL=C grep -q -m 1 "^install usb-storage" /etc/modprobe.d/usb-storage.conf ; then
	sed -i 's/^install usb-storage.*/install usb-storage /bin/true/g' /etc/modprobe.d/usb-storage.conf
else
	echo -e "\n# Disable per security requirements" &gt;&gt; /etc/modprobe.d/usb-storage.conf
	echo "install usb-storage /bin/true" &gt;&gt; /etc/modprobe.d/usb-storage.conf
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="kernel_module_usb-storage_disabled" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="medium" strategy="disable">- name: Ensure kernel module 'usb-storage' is disabled
  lineinfile:
    create: true
    dest: /etc/modprobe.d/usb-storage.conf
    regexp: usb-storage
    line: install usb-storage /bin/true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.21
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - disable_strategy
    - kernel_module_usb-storage_disabled
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="kernel_module_usb-storage_disabled" system="urn:xccdf:fix:script:kubernetes">apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,install%20usb-storage%20/bin/true%0A
        mode: 0644
        path: /etc/modprobe.d/75-kernel_module_usb-storage_disabled.conf
        overwrite: true
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-kernel_module_usb-storage_disabled:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-kernel_module_usb-storage_disabled_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_kernel_module_squashfs_disabled" selected="false" role="full" severity="low">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable Mounting of squashfs</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">
To configure the system to prevent the <html:code xmlns:html="http://www.w3.org/1999/xhtml">squashfs</html:code>
kernel module from being loaded, add the following line to a file in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/modprobe.d</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">install squashfs /bin/true</html:pre>
This effectively prevents usage of this uncommon filesystem.

The <html:code xmlns:html="http://www.w3.org/1999/xhtml">squashfs</html:code> filesystem type is a compressed read-only Linux
filesystem embedded in small footprint systems (similar to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">cramfs</html:code>). A <html:code xmlns:html="http://www.w3.org/1999/xhtml">squashfs</html:code> image can be used without having
to first decompress the image.</description>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.4.6</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.11</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.12</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.3</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.06</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.5.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.6.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.2.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.2.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
          <reference href="https://www.cisecurity.org/controls/">11</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">9</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Removing support for unneeded filesystem types reduces the local attack
surface of the system.</rationale>
          <platform idref="cpe:/a:machine"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="kernel_module_squashfs_disabled" system="urn:xccdf:fix:script:sh" reboot="true" complexity="low" disruption="medium" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

if LC_ALL=C grep -q -m 1 "^install squashfs" /etc/modprobe.d/squashfs.conf ; then
	sed -i 's/^install squashfs.*/install squashfs /bin/true/g' /etc/modprobe.d/squashfs.conf
else
	echo -e "\n# Disable per security requirements" &gt;&gt; /etc/modprobe.d/squashfs.conf
	echo "install squashfs /bin/true" &gt;&gt; /etc/modprobe.d/squashfs.conf
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="kernel_module_squashfs_disabled" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="medium" strategy="disable">- name: Ensure kernel module 'squashfs' is disabled
  lineinfile:
    create: true
    dest: /etc/modprobe.d/squashfs.conf
    regexp: squashfs
    line: install squashfs /bin/true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.4.6
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - disable_strategy
    - kernel_module_squashfs_disabled
    - low_complexity
    - low_severity
    - medium_disruption
    - reboot_required
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="kernel_module_squashfs_disabled" system="urn:xccdf:fix:script:kubernetes">apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,install%20squashfs%20/bin/true%0A
        mode: 0644
        path: /etc/modprobe.d/75-kernel_module_squashfs_disabled.conf
        overwrite: true
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-kernel_module_squashfs_disabled:def:1" href="ssg-fedora-oval.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_bios_assign_password" selected="false" role="full" severity="unknown">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Assign Password to Prevent Changes to Boot Firmware Configuration</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Assign a password to the system boot firmware (historically called BIOS on PC
systems) to require a password for any configuration changes.</description>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Assigning a password to the system boot firmware prevents anyone
with physical access from configuring the system to boot
from local media and circumvent the operating system's access controls.
For systems in physically secure locations, such as
a data center or Sensitive Compartmented Information Facility (SCIF), this risk must be weighed
against the risk of administrative personnel being unable to conduct recovery operations in
a timely fashion.</rationale>
          <platform idref="cpe:/a:machine"/>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_kernel_module_hfs_disabled" selected="false" role="full" severity="low">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable Mounting of hfs</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">
To configure the system to prevent the <html:code xmlns:html="http://www.w3.org/1999/xhtml">hfs</html:code>
kernel module from being loaded, add the following line to a file in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/modprobe.d</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">install hfs /bin/true</html:pre>
This effectively prevents usage of this uncommon filesystem.</description>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.4.6</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.11</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.12</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.3</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.06</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.5.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.6.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.2.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.2.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
          <reference href="https://www.cisecurity.org/controls/">11</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">9</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Linux kernel modules which implement filesystems that are not needed by the
local system should be disabled.</rationale>
          <platform idref="cpe:/a:machine"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="kernel_module_hfs_disabled" system="urn:xccdf:fix:script:sh" reboot="true" complexity="low" disruption="medium" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

if LC_ALL=C grep -q -m 1 "^install hfs" /etc/modprobe.d/hfs.conf ; then
	sed -i 's/^install hfs.*/install hfs /bin/true/g' /etc/modprobe.d/hfs.conf
else
	echo -e "\n# Disable per security requirements" &gt;&gt; /etc/modprobe.d/hfs.conf
	echo "install hfs /bin/true" &gt;&gt; /etc/modprobe.d/hfs.conf
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="kernel_module_hfs_disabled" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="medium" strategy="disable">- name: Ensure kernel module 'hfs' is disabled
  lineinfile:
    create: true
    dest: /etc/modprobe.d/hfs.conf
    regexp: hfs
    line: install hfs /bin/true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.4.6
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - disable_strategy
    - kernel_module_hfs_disabled
    - low_complexity
    - low_severity
    - medium_disruption
    - reboot_required
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="kernel_module_hfs_disabled" system="urn:xccdf:fix:script:kubernetes">apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,install%20hfs%20/bin/true%0A
        mode: 0644
        path: /etc/modprobe.d/75-kernel_module_hfs_disabled.conf
        overwrite: true
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-kernel_module_hfs_disabled:def:1" href="ssg-fedora-oval.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_kernel_module_freevxfs_disabled" selected="false" role="full" severity="low">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable Mounting of freevxfs</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">
To configure the system to prevent the <html:code xmlns:html="http://www.w3.org/1999/xhtml">freevxfs</html:code>
kernel module from being loaded, add the following line to a file in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/modprobe.d</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">install freevxfs /bin/true</html:pre>
This effectively prevents usage of this uncommon filesystem.</description>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.4.6</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.11</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.12</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.3</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.06</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.5.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.6.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.2.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.2.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
          <reference href="https://www.cisecurity.org/controls/">11</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">9</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Linux kernel modules which implement filesystems that are not needed by the
local system should be disabled.</rationale>
          <platform idref="cpe:/a:machine"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="kernel_module_freevxfs_disabled" system="urn:xccdf:fix:script:sh" reboot="true" complexity="low" disruption="medium" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

if LC_ALL=C grep -q -m 1 "^install freevxfs" /etc/modprobe.d/freevxfs.conf ; then
	sed -i 's/^install freevxfs.*/install freevxfs /bin/true/g' /etc/modprobe.d/freevxfs.conf
else
	echo -e "\n# Disable per security requirements" &gt;&gt; /etc/modprobe.d/freevxfs.conf
	echo "install freevxfs /bin/true" &gt;&gt; /etc/modprobe.d/freevxfs.conf
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="kernel_module_freevxfs_disabled" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="medium" strategy="disable">- name: Ensure kernel module 'freevxfs' is disabled
  lineinfile:
    create: true
    dest: /etc/modprobe.d/freevxfs.conf
    regexp: freevxfs
    line: install freevxfs /bin/true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.4.6
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - disable_strategy
    - kernel_module_freevxfs_disabled
    - low_complexity
    - low_severity
    - medium_disruption
    - reboot_required
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="kernel_module_freevxfs_disabled" system="urn:xccdf:fix:script:kubernetes">apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,install%20freevxfs%20/bin/true%0A
        mode: 0644
        path: /etc/modprobe.d/75-kernel_module_freevxfs_disabled.conf
        overwrite: true
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-kernel_module_freevxfs_disabled:def:1" href="ssg-fedora-oval.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_bios_disable_usb_boot" selected="false" role="full" severity="unknown">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable Booting from USB Devices in Boot Firmware</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Configure the system boot firmware (historically called BIOS on PC
systems) to disallow booting from USB drives.</description>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-001250</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">MP-7</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.2.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS01.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.03</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.11.2.6</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.6.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.6.2.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.7.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.1</reference>
          <reference href="https://www.cisecurity.org/controls/">12</reference>
          <reference href="https://www.cisecurity.org/controls/">16</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Booting a system from a USB device would allow an attacker to
circumvent any security measures provided by the operating system. Attackers
could mount partitions and modify the configuration of the OS.</rationale>
          <platform idref="cpe:/a:machine"/>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_kernel_module_cramfs_disabled" selected="false" role="full" severity="low">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable Mounting of cramfs</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">
To configure the system to prevent the <html:code xmlns:html="http://www.w3.org/1999/xhtml">cramfs</html:code>
kernel module from being loaded, add the following line to a file in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/modprobe.d</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">install cramfs /bin/true</html:pre>
This effectively prevents usage of this uncommon filesystem.

The <html:code xmlns:html="http://www.w3.org/1999/xhtml">cramfs</html:code> filesystem type is a compressed read-only
Linux filesystem embedded in small footprint systems. A
<html:code xmlns:html="http://www.w3.org/1999/xhtml">cramfs</html:code> image can be used without having to first
decompress the image.</description>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.4.6</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.11</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.12</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.3</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.06</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.5.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.6.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.2.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.2.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
          <reference href="https://www.cisecurity.org/controls/">11</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">9</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000095-GPOS-00049</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-000381</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Removing support for unneeded filesystem types reduces the local attack surface
of the server.</rationale>
          <platform idref="cpe:/a:machine"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="kernel_module_cramfs_disabled" system="urn:xccdf:fix:script:sh" reboot="true" complexity="low" disruption="medium" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

if LC_ALL=C grep -q -m 1 "^install cramfs" /etc/modprobe.d/cramfs.conf ; then
	sed -i 's/^install cramfs.*/install cramfs /bin/true/g' /etc/modprobe.d/cramfs.conf
else
	echo -e "\n# Disable per security requirements" &gt;&gt; /etc/modprobe.d/cramfs.conf
	echo "install cramfs /bin/true" &gt;&gt; /etc/modprobe.d/cramfs.conf
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="kernel_module_cramfs_disabled" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="medium" strategy="disable">- name: Ensure kernel module 'cramfs' is disabled
  lineinfile:
    create: true
    dest: /etc/modprobe.d/cramfs.conf
    regexp: cramfs
    line: install cramfs /bin/true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.4.6
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - disable_strategy
    - kernel_module_cramfs_disabled
    - low_complexity
    - low_severity
    - medium_disruption
    - reboot_required
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="kernel_module_cramfs_disabled" system="urn:xccdf:fix:script:kubernetes">apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,install%20cramfs%20/bin/true%0A
        mode: 0644
        path: /etc/modprobe.d/75-kernel_module_cramfs_disabled.conf
        overwrite: true
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-kernel_module_cramfs_disabled:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-kernel_module_cramfs_disabled_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
      </Group>
      <Group id="xccdf_org.ssgproject.content_group_restrictions">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Restrict Programs from Dangerous Execution Patterns</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The recommendations in this section are designed to
ensure that the system's features to protect against potentially
dangerous program execution are activated.
These protections are applied at the system initialization or
kernel level, and defend against certain types of badly-configured
or compromised programs.</description>
        <Rule id="xccdf_org.ssgproject.content_rule_sysctl_kernel_core_pattern" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable storing core dumps</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To set the runtime status of the <html:code xmlns:html="http://www.w3.org/1999/xhtml">kernel.core_pattern</html:code> kernel parameter, run the following command: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo sysctl -w kernel.core_pattern=|/bin/false</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/sysctl.d</html:code>: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">kernel.core_pattern = |/bin/false</html:pre></description>
          <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_SMF_EXT.1</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">A core dump includes a memory image taken at the time the operating system
terminates an application. The memory image could contain sensitive data and is generally useful
only for developers trying to debug problems.</rationale>
          <platform idref="cpe:/a:machine"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_kernel_core_pattern" system="urn:xccdf:fix:script:sh" reboot="true" complexity="low" disruption="medium" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then



#
# Set runtime for kernel.core_pattern
#
/sbin/sysctl -q -n -w kernel.core_pattern="|/bin/false"

#
# If kernel.core_pattern present in /etc/sysctl.conf, change value to "|/bin/false"
#	else, add "kernel.core_pattern = |/bin/false" to /etc/sysctl.conf
#
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_replace_or_append" use="legacy"/>
replace_or_append '/etc/sysctl.conf' '^kernel.core_pattern' "|/bin/false" ''

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_kernel_core_pattern" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="medium" strategy="disable">- name: Ensure sysctl kernel.core_pattern is set to |/bin/false
  sysctl:
    name: kernel.core_pattern
    value: '|/bin/false'
    state: present
    reload: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_kernel_core_pattern
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_kernel_core_pattern" system="urn:xccdf:fix:script:kubernetes">apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,kernel.core_pattern%20%3D%20%7C/bin/false%0A
        mode: 0644
        path: /etc/sysctl.d/75-sysctl_kernel_core_pattern.conf
        overwrite: true
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-sysctl_kernel_core_pattern:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-sysctl_kernel_core_pattern_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_sysctl_kernel_perf_event_paranoid" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disallow kernel profiling by unprivileged users</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To set the runtime status of the <html:code xmlns:html="http://www.w3.org/1999/xhtml">kernel.perf_event_paranoid</html:code> kernel parameter, run the following command: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo sysctl -w kernel.perf_event_paranoid=2</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/sysctl.d</html:code>: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">kernel.perf_event_paranoid = 2</html:pre></description>
          <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R23)</reference>
          <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_SMF_EXT.1</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000132-GPOS-00067</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000138-GPOS-00069</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-001090</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Kernel profiling can reveal sensitive information about kernel behaviour.</rationale>
          <platform idref="cpe:/a:machine"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_kernel_perf_event_paranoid" system="urn:xccdf:fix:script:sh" reboot="true" complexity="low" disruption="medium" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then



#
# Set runtime for kernel.perf_event_paranoid
#
/sbin/sysctl -q -n -w kernel.perf_event_paranoid="2"

#
# If kernel.perf_event_paranoid present in /etc/sysctl.conf, change value to "2"
#	else, add "kernel.perf_event_paranoid = 2" to /etc/sysctl.conf
#
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_replace_or_append" use="legacy"/>
replace_or_append '/etc/sysctl.conf' '^kernel.perf_event_paranoid' "2" ''

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_kernel_perf_event_paranoid" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="medium" strategy="disable">- name: Ensure sysctl kernel.perf_event_paranoid is set to 2
  sysctl:
    name: kernel.perf_event_paranoid
    value: '2'
    state: present
    reload: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_kernel_perf_event_paranoid
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_kernel_perf_event_paranoid" system="urn:xccdf:fix:script:kubernetes">apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,kernel.perf_event_paranoid%3D2%0A
        mode: 0644
        path: /etc/sysctl.d/75-sysctl_kernel_perf_event_paranoid.conf
        overwrite: true
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-sysctl_kernel_perf_event_paranoid:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-sysctl_kernel_perf_event_paranoid_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_sysctl_kernel_modules_disabled" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable loading and unloading of kernel modules</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To set the runtime status of the <html:code xmlns:html="http://www.w3.org/1999/xhtml">kernel.modules_disabled</html:code> kernel parameter, run the following command: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo sysctl -w kernel.modules_disabled=1</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/sysctl.d</html:code>: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">kernel.modules_disabled = 1</html:pre></description>
          <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">This rule doesn't come with Bash remediation. Remediating this rule during the installation process disrupts the install and boot process.</warning>
          <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R24)</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Malicious kernel modules can have a significant impact on system security and
availability. Disabling loading of kernel modules prevents this threat. Note
that once this option has been set, it cannot be reverted without doing a
system reboot. Make sure that all needed kernel modules are loaded before
setting this option.</rationale>
          <platform idref="cpe:/a:machine"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_kernel_modules_disabled" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="medium" strategy="disable">- name: Ensure sysctl kernel.modules_disabled is set to 1
  sysctl:
    name: kernel.modules_disabled
    value: '1'
    state: present
    reload: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_kernel_modules_disabled
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-sysctl_kernel_modules_disabled:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-sysctl_kernel_modules_disabled_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_sysctl_kernel_kexec_load_disabled" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable Kernel Image Loading</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To set the runtime status of the <html:code xmlns:html="http://www.w3.org/1999/xhtml">kernel.kexec_load_disabled</html:code> kernel parameter, run the following command: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo sysctl -w kernel.kexec_load_disabled=1</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/sysctl.d</html:code>: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">kernel.kexec_load_disabled = 1</html:pre></description>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000366-GPOS-00153</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-001749</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disabling kexec_load allows greater control of the kernel memory.
It makes it impossible to load another kernel image after it has been disabled.
</rationale>
          <platform idref="cpe:/a:machine"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_kernel_kexec_load_disabled" system="urn:xccdf:fix:script:sh" reboot="true" complexity="low" disruption="medium" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then



#
# Set runtime for kernel.kexec_load_disabled
#
/sbin/sysctl -q -n -w kernel.kexec_load_disabled="1"

#
# If kernel.kexec_load_disabled present in /etc/sysctl.conf, change value to "1"
#	else, add "kernel.kexec_load_disabled = 1" to /etc/sysctl.conf
#
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_replace_or_append" use="legacy"/>
replace_or_append '/etc/sysctl.conf' '^kernel.kexec_load_disabled' "1" ''

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_kernel_kexec_load_disabled" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="medium" strategy="disable">- name: Ensure sysctl kernel.kexec_load_disabled is set to 1
  sysctl:
    name: kernel.kexec_load_disabled
    value: '1'
    state: present
    reload: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_kernel_kexec_load_disabled
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_kernel_kexec_load_disabled" system="urn:xccdf:fix:script:kubernetes">apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,kernel.kexec_load_disabled%3D1%0A
        mode: 0644
        path: /etc/sysctl.d/75-sysctl_kernel_kexec_load_disabled.conf
        overwrite: true
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-sysctl_kernel_kexec_load_disabled:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-sysctl_kernel_kexec_load_disabled_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_sysctl_kernel_yama_ptrace_scope" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Restrict usage of ptrace to descendant processes</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To set the runtime status of the <html:code xmlns:html="http://www.w3.org/1999/xhtml">kernel.yama.ptrace_scope</html:code> kernel parameter, run the following command: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo sysctl -w kernel.yama.ptrace_scope=1</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/sysctl.d</html:code>: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">kernel.yama.ptrace_scope = 1</html:pre></description>
          <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R25)</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000132-GPOS-00067</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Unrestricted usage of ptrace allows compromised binaries to run ptrace
on another processes of the user. Like this, the attacker can steal
sensitive information from the target processes (e.g. SSH sessions, web browser, ...)
without any additional assistance from the user (i.e. without resorting to phishing).
</rationale>
          <platform idref="cpe:/a:machine"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_kernel_yama_ptrace_scope" system="urn:xccdf:fix:script:sh" reboot="true" complexity="low" disruption="medium" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then



#
# Set runtime for kernel.yama.ptrace_scope
#
/sbin/sysctl -q -n -w kernel.yama.ptrace_scope="1"

#
# If kernel.yama.ptrace_scope present in /etc/sysctl.conf, change value to "1"
#	else, add "kernel.yama.ptrace_scope = 1" to /etc/sysctl.conf
#
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_replace_or_append" use="legacy"/>
replace_or_append '/etc/sysctl.conf' '^kernel.yama.ptrace_scope' "1" ''

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_kernel_yama_ptrace_scope" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="medium" strategy="disable">- name: Ensure sysctl kernel.yama.ptrace_scope is set to 1
  sysctl:
    name: kernel.yama.ptrace_scope
    value: '1'
    state: present
    reload: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_kernel_yama_ptrace_scope
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_kernel_yama_ptrace_scope" system="urn:xccdf:fix:script:kubernetes">apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,kernel.yama.ptrace_scope%3D1%0A
        mode: 0644
        path: /etc/sysctl.d/75-sysctl_kernel_yama_ptrace_scope.conf
        overwrite: true
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-sysctl_kernel_yama_ptrace_scope:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-sysctl_kernel_yama_ptrace_scope_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_sysctl_vm_mmap_min_addr" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Prevent applications from mapping low portion of virtual memory</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To set the runtime status of the <html:code xmlns:html="http://www.w3.org/1999/xhtml">vm.mmap_min_addr</html:code> kernel parameter, run the following command: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo sysctl -w vm.mmap_min_addr=65536</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/sysctl.d</html:code>: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">vm.mmap_min_addr = 65536</html:pre></description>
          <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R23)</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">vm.mmap_min_addr</html:code> parameter specifies the minimum virtual
address that a process is allowed to mmap. Allowing a process to mmap low
portion of virtual memory can have security implications such as such as
heightened risk of kernel null pointer dereference defects.</rationale>
          <platform idref="cpe:/a:machine"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_vm_mmap_min_addr" system="urn:xccdf:fix:script:sh" reboot="true" complexity="low" disruption="medium" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then



#
# Set runtime for vm.mmap_min_addr
#
/sbin/sysctl -q -n -w vm.mmap_min_addr="65536"

#
# If vm.mmap_min_addr present in /etc/sysctl.conf, change value to "65536"
#	else, add "vm.mmap_min_addr = 65536" to /etc/sysctl.conf
#
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_replace_or_append" use="legacy"/>
replace_or_append '/etc/sysctl.conf' '^vm.mmap_min_addr' "65536" ''

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_vm_mmap_min_addr" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="medium" strategy="disable">- name: Ensure sysctl vm.mmap_min_addr is set to 65536
  sysctl:
    name: vm.mmap_min_addr
    value: '65536'
    state: present
    reload: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_vm_mmap_min_addr
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-sysctl_vm_mmap_min_addr:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-sysctl_vm_mmap_min_addr_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_sysctl_net_core_bpf_jit_harden" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Harden the operation of the BPF just-in-time compiler</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To set the runtime status of the <html:code xmlns:html="http://www.w3.org/1999/xhtml">net.core.bpf_jit_harden</html:code> kernel parameter, run the following command: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo sysctl -w net.core.bpf_jit_harden=2</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/sysctl.d</html:code>: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">net.core.bpf_jit_harden = 2</html:pre></description>
          <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_SMF_EXT.1</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">When hardened, the extended Berkeley Packet Filter just-in-time compiler
will randomize any kernel addresses in the BPF programs and maps,
and will not expose the JIT addresses in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/proc/kallsyms</html:code>.</rationale>
          <platform idref="cpe:/a:machine"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_net_core_bpf_jit_harden" system="urn:xccdf:fix:script:sh" reboot="true" complexity="low" disruption="medium" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then



#
# Set runtime for net.core.bpf_jit_harden
#
/sbin/sysctl -q -n -w net.core.bpf_jit_harden="2"

#
# If net.core.bpf_jit_harden present in /etc/sysctl.conf, change value to "2"
#	else, add "net.core.bpf_jit_harden = 2" to /etc/sysctl.conf
#
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_replace_or_append" use="legacy"/>
replace_or_append '/etc/sysctl.conf' '^net.core.bpf_jit_harden' "2" ''

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_net_core_bpf_jit_harden" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="medium" strategy="disable">- name: Ensure sysctl net.core.bpf_jit_harden is set to 2
  sysctl:
    name: net.core.bpf_jit_harden
    value: '2'
    state: present
    reload: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_core_bpf_jit_harden
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_net_core_bpf_jit_harden" system="urn:xccdf:fix:script:kubernetes">apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,net.core.bpf_jit_harden%3D2%0A
        mode: 0644
        path: /etc/sysctl.d/75-sysctl_net_core_bpf_jit_harden.conf
        overwrite: true
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-sysctl_net_core_bpf_jit_harden:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-sysctl_net_core_bpf_jit_harden_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_sysctl_user_max_user_namespaces" selected="false" role="full" severity="low">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable the use of user namespaces</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To set the runtime status of the <html:code xmlns:html="http://www.w3.org/1999/xhtml">user.max_user_namespaces</html:code> kernel parameter,
run the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo sysctl -w user.max_user_namespaces=0</html:pre>

To make sure that the setting is persistent,
add the following line to a file in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/sysctl.d</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">user.max_user_namespaces = 0</html:pre>
When containers are deployed on the machine, the value should be set
to large non-zero value.</description>
          <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">This configuration baseline was created to deploy the base operating system for general purpose
workloads. When the operating system is configured for certain purposes, such as to host Linux Containers,
it is expected that <html:code xmlns:html="http://www.w3.org/1999/xhtml">user.max_user_namespaces</html:code> will be enabled.</warning>
          <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_SMF_EXT.1</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-39</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">User namespaces are used primarily for Linux containers. The value 0
disallows the use of user namespaces.</rationale>
          <platform idref="cpe:/a:machine"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_user_max_user_namespaces" system="urn:xccdf:fix:script:sh" reboot="true" complexity="low" disruption="medium" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then



#
# Set runtime for user.max_user_namespaces
#
/sbin/sysctl -q -n -w user.max_user_namespaces="0"

#
# If user.max_user_namespaces present in /etc/sysctl.conf, change value to "0"
#	else, add "user.max_user_namespaces = 0" to /etc/sysctl.conf
#
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_replace_or_append" use="legacy"/>
replace_or_append '/etc/sysctl.conf' '^user.max_user_namespaces' "0" ''

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_user_max_user_namespaces" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="medium" strategy="disable">- name: Ensure sysctl user.max_user_namespaces is set to 0
  sysctl:
    name: user.max_user_namespaces
    value: '0'
    state: present
    reload: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-SC-39
    - disable_strategy
    - low_complexity
    - low_severity
    - medium_disruption
    - reboot_required
    - sysctl_user_max_user_namespaces
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_user_max_user_namespaces" system="urn:xccdf:fix:script:kubernetes">apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,user.max_user_namespaces%20%3D%200%0A
        mode: 0644
        path: /etc/sysctl.d/75-sysctl_user_max_user_namespaces.conf
        overwrite: true
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-sysctl_user_max_user_namespaces:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-sysctl_user_max_user_namespaces_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_sysctl_kernel_pid_max" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Configure maximum number of process identifiers</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To set the runtime status of the <html:code xmlns:html="http://www.w3.org/1999/xhtml">kernel.pid_max</html:code> kernel parameter, run the following command: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo sysctl -w kernel.pid_max=65536</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/sysctl.d</html:code>: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">kernel.pid_max = 65536</html:pre></description>
          <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R23)</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">kernel.pid_max</html:code> parameter configures upper limit on process
identifiers (PID). If this number is not high enough, it might happen that
forking of new processes is not possible, because all available PIDs are
exhausted. Increasing this number enhances availability.</rationale>
          <platform idref="cpe:/a:machine"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_kernel_pid_max" system="urn:xccdf:fix:script:sh" reboot="true" complexity="low" disruption="medium" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then



#
# Set runtime for kernel.pid_max
#
/sbin/sysctl -q -n -w kernel.pid_max="65536"

#
# If kernel.pid_max present in /etc/sysctl.conf, change value to "65536"
#	else, add "kernel.pid_max = 65536" to /etc/sysctl.conf
#
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_replace_or_append" use="legacy"/>
replace_or_append '/etc/sysctl.conf' '^kernel.pid_max' "65536" ''

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_kernel_pid_max" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="medium" strategy="disable">- name: Ensure sysctl kernel.pid_max is set to 65536
  sysctl:
    name: kernel.pid_max
    value: '65536'
    state: present
    reload: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_kernel_pid_max
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-sysctl_kernel_pid_max:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-sysctl_kernel_pid_max_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_sysctl_kernel_dmesg_restrict" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Restrict Access to Kernel Message Buffer</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To set the runtime status of the <html:code xmlns:html="http://www.w3.org/1999/xhtml">kernel.dmesg_restrict</html:code> kernel parameter, run the following command: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo sysctl -w kernel.dmesg_restrict=1</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/sysctl.d</html:code>: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">kernel.dmesg_restrict = 1</html:pre></description>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.5</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-001314</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(4)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(c)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SI-11(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SI-11(b)</reference>
          <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R23)</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000132-GPOS-00067</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000138-GPOS-00069</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Unprivileged access to the kernel syslog can expose sensitive kernel
address information.</rationale>
          <platform idref="cpe:/a:machine"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_kernel_dmesg_restrict" system="urn:xccdf:fix:script:sh" reboot="true" complexity="low" disruption="medium" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then



#
# Set runtime for kernel.dmesg_restrict
#
/sbin/sysctl -q -n -w kernel.dmesg_restrict="1"

#
# If kernel.dmesg_restrict present in /etc/sysctl.conf, change value to "1"
#	else, add "kernel.dmesg_restrict = 1" to /etc/sysctl.conf
#
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_replace_or_append" use="legacy"/>
replace_or_append '/etc/sysctl.conf' '^kernel.dmesg_restrict' "1" ''

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_kernel_dmesg_restrict" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="medium" strategy="disable">- name: Ensure sysctl kernel.dmesg_restrict is set to 1
  sysctl:
    name: kernel.dmesg_restrict
    value: '1'
    state: present
    reload: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.5
    - NIST-800-53-SI-11(a)
    - NIST-800-53-SI-11(b)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_kernel_dmesg_restrict
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_kernel_dmesg_restrict" system="urn:xccdf:fix:script:kubernetes">apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,kernel.dmesg_restrict%3D1%0A
        mode: 0644
        path: /etc/sysctl.d/75-sysctl_kernel_dmesg_restrict.conf
        overwrite: true
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-sysctl_kernel_dmesg_restrict:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-sysctl_kernel_dmesg_restrict_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_sysctl_kernel_unprivileged_bpf_disabled" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable Access to Network bpf() Syscall From Unprivileged Processes</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To set the runtime status of the <html:code xmlns:html="http://www.w3.org/1999/xhtml">kernel.unprivileged_bpf_disabled</html:code> kernel parameter, run the following command: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo sysctl -w kernel.unprivileged_bpf_disabled=1</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/sysctl.d</html:code>: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">kernel.unprivileged_bpf_disabled = 1</html:pre></description>
          <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_SMF_EXT.1</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000132-GPOS-00067</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Loading and accessing the packet filters programs and maps using the bpf()
syscall has the potential of revealing sensitive information about the kernel state.</rationale>
          <platform idref="cpe:/a:machine"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_kernel_unprivileged_bpf_disabled" system="urn:xccdf:fix:script:sh" reboot="true" complexity="low" disruption="medium" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then



#
# Set runtime for kernel.unprivileged_bpf_disabled
#
/sbin/sysctl -q -n -w kernel.unprivileged_bpf_disabled="1"

#
# If kernel.unprivileged_bpf_disabled present in /etc/sysctl.conf, change value to "1"
#	else, add "kernel.unprivileged_bpf_disabled = 1" to /etc/sysctl.conf
#
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_replace_or_append" use="legacy"/>
replace_or_append '/etc/sysctl.conf' '^kernel.unprivileged_bpf_disabled' "1" ''

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_kernel_unprivileged_bpf_disabled" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="medium" strategy="disable">- name: Ensure sysctl kernel.unprivileged_bpf_disabled is set to 1
  sysctl:
    name: kernel.unprivileged_bpf_disabled
    value: '1'
    state: present
    reload: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_kernel_unprivileged_bpf_disabled
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_kernel_unprivileged_bpf_disabled" system="urn:xccdf:fix:script:kubernetes">apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,kernel.unprivileged_bpf_disabled%3D1%0A
        mode: 0644
        path: /etc/sysctl.d/75-sysctl_kernel_unprivileged_bpf_disabled.conf
        overwrite: true
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-sysctl_kernel_unprivileged_bpf_disabled:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-sysctl_kernel_unprivileged_bpf_disabled_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_sysctl_kernel_perf_event_max_sample_rate" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Limit sampling frequency of the Perf system</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To set the runtime status of the <html:code xmlns:html="http://www.w3.org/1999/xhtml">kernel.perf_event_max_sample_rate</html:code> kernel parameter, run the following command: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo sysctl -w kernel.perf_event_max_sample_rate=1</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/sysctl.d</html:code>: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">kernel.perf_event_max_sample_rate = 1</html:pre></description>
          <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R23)</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">kernel.perf_event_max_sample_rate</html:code> parameter configures maximum
frequency of collecting of samples for the Perf system. It is expressed in
samples per second. Restricting usage of <html:code xmlns:html="http://www.w3.org/1999/xhtml">Perf</html:code> system decreases risk
of potential availability problems.</rationale>
          <platform idref="cpe:/a:machine"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_kernel_perf_event_max_sample_rate" system="urn:xccdf:fix:script:sh" reboot="true" complexity="low" disruption="medium" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then



#
# Set runtime for kernel.perf_event_max_sample_rate
#
/sbin/sysctl -q -n -w kernel.perf_event_max_sample_rate="1"

#
# If kernel.perf_event_max_sample_rate present in /etc/sysctl.conf, change value to "1"
#	else, add "kernel.perf_event_max_sample_rate = 1" to /etc/sysctl.conf
#
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_replace_or_append" use="legacy"/>
replace_or_append '/etc/sysctl.conf' '^kernel.perf_event_max_sample_rate' "1" ''

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_kernel_perf_event_max_sample_rate" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="medium" strategy="disable">- name: Ensure sysctl kernel.perf_event_max_sample_rate is set to 1
  sysctl:
    name: kernel.perf_event_max_sample_rate
    value: '1'
    state: present
    reload: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_kernel_perf_event_max_sample_rate
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-sysctl_kernel_perf_event_max_sample_rate:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-sysctl_kernel_perf_event_max_sample_rate_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_sysctl_kernel_perf_cpu_time_max_percent" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Limit CPU consumption of the Perf system</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To set the runtime status of the <html:code xmlns:html="http://www.w3.org/1999/xhtml">kernel.perf_cpu_time_max_percent</html:code> kernel parameter, run the following command: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo sysctl -w kernel.perf_cpu_time_max_percent=1</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/sysctl.d</html:code>: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">kernel.perf_cpu_time_max_percent = 1</html:pre></description>
          <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R23)</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">kernel.perf_cpu_time_max_percent</html:code> configures a treshold of
maximum percentile of CPU that can be used by Perf system. Restricting usage
of <html:code xmlns:html="http://www.w3.org/1999/xhtml">Perf</html:code> system decreases risk of potential availability problems.</rationale>
          <platform idref="cpe:/a:machine"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_kernel_perf_cpu_time_max_percent" system="urn:xccdf:fix:script:sh" reboot="true" complexity="low" disruption="medium" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then



#
# Set runtime for kernel.perf_cpu_time_max_percent
#
/sbin/sysctl -q -n -w kernel.perf_cpu_time_max_percent="1"

#
# If kernel.perf_cpu_time_max_percent present in /etc/sysctl.conf, change value to "1"
#	else, add "kernel.perf_cpu_time_max_percent = 1" to /etc/sysctl.conf
#
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_replace_or_append" use="legacy"/>
replace_or_append '/etc/sysctl.conf' '^kernel.perf_cpu_time_max_percent' "1" ''

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_kernel_perf_cpu_time_max_percent" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="medium" strategy="disable">- name: Ensure sysctl kernel.perf_cpu_time_max_percent is set to 1
  sysctl:
    name: kernel.perf_cpu_time_max_percent
    value: '1'
    state: present
    reload: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_kernel_perf_cpu_time_max_percent
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-sysctl_kernel_perf_cpu_time_max_percent:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-sysctl_kernel_perf_cpu_time_max_percent_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_sysctl_kernel_sysrq" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disallow magic SysRq key</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To set the runtime status of the <html:code xmlns:html="http://www.w3.org/1999/xhtml">kernel.sysrq</html:code> kernel parameter, run the following command: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo sysctl -w kernel.sysrq=0</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/sysctl.d</html:code>: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">kernel.sysrq = 0</html:pre></description>
          <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R23)</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The Magic SysRq key allows sending certain commands directly to the running
kernel. It can dump various system and process information, potentially
revealing sensitive information. It can also reboot or shutdown the machine,
disturbing its availability.</rationale>
          <platform idref="cpe:/a:machine"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_kernel_sysrq" system="urn:xccdf:fix:script:sh" reboot="true" complexity="low" disruption="medium" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then



#
# Set runtime for kernel.sysrq
#
/sbin/sysctl -q -n -w kernel.sysrq="0"

#
# If kernel.sysrq present in /etc/sysctl.conf, change value to "0"
#	else, add "kernel.sysrq = 0" to /etc/sysctl.conf
#
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_replace_or_append" use="legacy"/>
replace_or_append '/etc/sysctl.conf' '^kernel.sysrq' "0" ''

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_kernel_sysrq" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="medium" strategy="disable">- name: Ensure sysctl kernel.sysrq is set to 0
  sysctl:
    name: kernel.sysrq
    value: '0'
    state: present
    reload: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_kernel_sysrq
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-sysctl_kernel_sysrq:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-sysctl_kernel_sysrq_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Group id="xccdf_org.ssgproject.content_group_poisoning">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Memory Poisoning</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Memory Poisoning consists of writing a special value to uninitialized or freed memory.
Poisoning can be used as a mechanism to prevent leak of information and detection of
corrupted memory.</description>
          <platform idref="cpe:/a:machine"/>
          <Rule id="xccdf_org.ssgproject.content_rule_grub2_page_poison_argument" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Enable page allocator poisoning</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To enable poisoning of free pages,
add the argument <html:code xmlns:html="http://www.w3.org/1999/xhtml">page_poison=1</html:code> to the default
GRUB 2 command line for the Linux operating system in
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/default/grub</html:code>, in the manner below:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">GRUB_CMDLINE_LINUX="page_poison=1"</html:pre></description>
            <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="management">The GRUB 2 configuration file, <html:code xmlns:html="http://www.w3.org/1999/xhtml">grub.cfg</html:code>,
is automatically updated each time a new kernel is installed. Note that any
changes to <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/default/grub</html:code> require rebuilding the <html:code xmlns:html="http://www.w3.org/1999/xhtml">grub.cfg</html:code>
file. To update the GRUB 2 configuration file manually, use the
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">grub2-mkconfig -o</html:pre> command as follows:
<html:ul xmlns:html="http://www.w3.org/1999/xhtml"><html:li>On BIOS-based machines, issue the following command as <html:code>root</html:code>:
<html:pre>~]# grub2-mkconfig -o /boot/grub2/grub.cfg</html:pre></html:li><html:li>On UEFI-based machines, issue the following command as <html:code>root</html:code>:

<html:pre>~]# grub2-mkconfig -o /boot/efi/EFI/fedora/grub.cfg</html:pre></html:li></html:ul></warning>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000134-GPOS-00068</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-001084</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Poisoning writes an arbitrary value to freed pages, so any modification or
reference to that page after being freed or before being initialized will be
detected and prevented.
This prevents many types of use-after-free vulnerabilities at little performance cost.
Also prevents leak of data and detection of corrupted memory.</rationale>
            <platform idref="cpe:/a:grub2"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="grub2_page_poison_argument" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ] &amp;&amp; { rpm --quiet -q grub2-common; }; then

# Correct grub2 kernelopts value using grub2-editenv
if ! grub2-editenv - list | grep -qE '^kernelopts=(.*\s)?page_poison=1(\s.*)?$'; then
  grub2-editenv - set "$(grub2-editenv - list | grep kernelopts) page_poison=1"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="grub2_page_poison_argument" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="medium" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-53-CM-6(a)
    - grub2_page_poison_argument
    - low_disruption
    - medium_complexity
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: get current kernel parameters
  command: /usr/bin/grub2-editenv - list
  register: kernelopts
  changed_when: false
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - '"grub2-common" in ansible_facts.packages'
  tags:
    - NIST-800-53-CM-6(a)
    - grub2_page_poison_argument
    - low_disruption
    - medium_complexity
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Update the bootloader menu
  command: /usr/bin/grub2-editenv - set "{{ item }} page_poison=1"
  with_items: '{{ kernelopts.stdout_lines | select(''match'', ''^kernelopts.*'') |
    list }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - '"grub2-common" in ansible_facts.packages'
    - kernelopts.stdout_lines is defined
    - kernelopts.stdout_lines | length &gt; 0
    - kernelopts.stdout | regex_search('^kernelopts=(?:.*\s)?page_poison=1(?:\s.*)?$',
      multiline=True) is none
  tags:
    - NIST-800-53-CM-6(a)
    - grub2_page_poison_argument
    - low_disruption
    - medium_complexity
    - medium_severity
    - reboot_required
    - restrict_strategy
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-grub2_page_poison_argument:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-grub2_page_poison_argument_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_grub2_slub_debug_argument" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Enable SLUB/SLAB allocator poisoning</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To enable poisoning of SLUB/SLAB objects,
add the argument <html:code xmlns:html="http://www.w3.org/1999/xhtml">slub_debug=P</html:code> to the default
GRUB 2 command line for the Linux operating system in
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/default/grub</html:code>, in the manner below:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">GRUB_CMDLINE_LINUX="slub_debug=P"</html:pre></description>
            <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="management">The GRUB 2 configuration file, <html:code xmlns:html="http://www.w3.org/1999/xhtml">grub.cfg</html:code>,
is automatically updated each time a new kernel is installed. Note that any
changes to <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/default/grub</html:code> require rebuilding the <html:code xmlns:html="http://www.w3.org/1999/xhtml">grub.cfg</html:code>
file. To update the GRUB 2 configuration file manually, use the
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">grub2-mkconfig -o</html:pre> command as follows:
<html:ul xmlns:html="http://www.w3.org/1999/xhtml"><html:li>On BIOS-based machines, issue the following command as <html:code>root</html:code>:
<html:pre>~]# grub2-mkconfig -o /boot/grub2/grub.cfg</html:pre></html:li><html:li>On UEFI-based machines, issue the following command as <html:code>root</html:code>:

<html:pre>~]# grub2-mkconfig -o /boot/efi/EFI/fedora/grub.cfg</html:pre></html:li></html:ul></warning>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000433-GPOS-00192</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000134-GPOS-00068</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-001084</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Poisoning writes an arbitrary value to freed objects, so any modification or
reference to that object after being freed or before being initialized will be
detected and prevented.
This prevents many types of use-after-free vulnerabilities at little performance cost.
Also prevents leak of data and detection of corrupted memory.</rationale>
            <platform idref="cpe:/a:grub2"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="grub2_slub_debug_argument" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ] &amp;&amp; { rpm --quiet -q grub2-common; }; then

# Correct grub2 kernelopts value using grub2-editenv
if ! grub2-editenv - list | grep -qE '^kernelopts=(.*\s)?slub_debug=P(\s.*)?$'; then
  grub2-editenv - set "$(grub2-editenv - list | grep kernelopts) slub_debug=P"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="grub2_slub_debug_argument" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="medium" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-53-CM-6(a)
    - grub2_slub_debug_argument
    - low_disruption
    - medium_complexity
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: get current kernel parameters
  command: /usr/bin/grub2-editenv - list
  register: kernelopts
  changed_when: false
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - '"grub2-common" in ansible_facts.packages'
  tags:
    - NIST-800-53-CM-6(a)
    - grub2_slub_debug_argument
    - low_disruption
    - medium_complexity
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Update the bootloader menu
  command: /usr/bin/grub2-editenv - set "{{ item }} slub_debug=P"
  with_items: '{{ kernelopts.stdout_lines | select(''match'', ''^kernelopts.*'') |
    list }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - '"grub2-common" in ansible_facts.packages'
    - kernelopts.stdout_lines is defined
    - kernelopts.stdout_lines | length &gt; 0
    - kernelopts.stdout | regex_search('^kernelopts=(?:.*\s)?slub_debug=P(?:\s.*)?$',
      multiline=True) is none
  tags:
    - NIST-800-53-CM-6(a)
    - grub2_slub_debug_argument
    - low_disruption
    - medium_complexity
    - medium_severity
    - reboot_required
    - restrict_strategy
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-grub2_slub_debug_argument:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-grub2_slub_debug_argument_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
        </Group>
        <Group id="xccdf_org.ssgproject.content_group_enable_nx">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Enable Execute Disable (XD) or No Execute (NX) Support on
x86 Systems</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Recent processors in the x86 family support the
ability to prevent code execution on a per memory page basis.
Generically and on AMD processors, this ability is called No
Execute (NX), while on Intel processors it is called Execute
Disable (XD). This ability can help prevent exploitation of buffer
overflow vulnerabilities and should be activated whenever possible.
Extra steps must be taken to ensure that this protection is
enabled, particularly on 32-bit x86 systems. Other processors, such
as Itanium and POWER, have included such support since inception
and the standard kernel for those platforms supports the
feature. This is enabled by default on the latest Red Hat and 
Fedora systems if supported by the hardware.</description>
          <Rule id="xccdf_org.ssgproject.content_rule_install_PAE_kernel_on_x86-32" selected="false" role="full" severity="unknown">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Install PAE Kernel on Supported 32-bit x86 Systems</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Systems that are using the 64-bit x86 kernel package
do not need to install the kernel-PAE package because the 64-bit
x86 kernel already includes this support. However, if the system is
32-bit and also supports the PAE and NX features as
determined in the previous section, the kernel-PAE package should
be installed to enable XD or NX support.
The <html:code xmlns:html="http://www.w3.org/1999/xhtml">kernel-PAE</html:code> package can be installed with the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">
$ sudo dnf install kernel-PAE</html:pre>
The installation process should also have configured the
bootloader to load the new kernel at boot. Verify this after reboot
and modify <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/default/grub</html:code> if necessary.</description>
            <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="hardware">The kernel-PAE package should not be
installed on older systems that do not support the XD or NX bit, as
8this may prevent them from booting.8</warning>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.3</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.5.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.6.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.4</reference>
            <reference href="https://www.cisecurity.org/controls/">11</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">9</reference>
            <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R9)</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">On 32-bit systems that support the XD or NX bit, the vendor-supplied
PAE kernel is required to enable either Execute Disable (XD) or No Execute (NX) support.</rationale>
            <platform idref="cpe:/a:machine"/>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-install_PAE_kernel_on_x86-32:def:1" href="ssg-fedora-oval.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_bios_enable_execution_restrictions" selected="false" role="full" severity="unknown">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Enable NX or XD Support in the BIOS</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Reboot the system and enter the BIOS or Setup configuration menu.
Navigate the BIOS configuration menu and make sure that the option is enabled. The setting may be located
under a Security section. Look for Execute Disable (XD) on Intel-based systems and No Execute (NX)
on AMD-based systems.</description>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-39</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.3</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.5.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.6.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.4</reference>
            <reference href="https://www.cisecurity.org/controls/">11</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">9</reference>
            <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R9)</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Computers with the ability to prevent this type of code execution frequently put an option in the BIOS that will
allow users to turn the feature on or off at will.</rationale>
            <platform idref="cpe:/a:machine"/>
          </Rule>
        </Group>
        <Group id="xccdf_org.ssgproject.content_group_coredumps">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable Core Dumps</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">A core dump file is the memory image of an executable
program when it was terminated by the operating system due to
errant behavior. In most cases, only software developers
legitimately need to access these files. The core dump files may
also contain sensitive information, or unnecessarily occupy large
amounts of disk space.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Once a hard limit is set in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/security/limits.conf</html:code>, or
to a file within the <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/security/limits.d/</html:code> directory, a
user cannot increase that limit within his or her own session. If access
to core dumps is required, consider restricting them to only
certain users or groups. See the <html:code xmlns:html="http://www.w3.org/1999/xhtml">limits.conf</html:code> man page for more
information.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
The core dumps of setuid programs are further protected. The
<html:code xmlns:html="http://www.w3.org/1999/xhtml">sysctl</html:code> variable <html:code xmlns:html="http://www.w3.org/1999/xhtml">fs.suid_dumpable</html:code> controls whether
the kernel allows core dumps from these programs at all. The default
value of 0 is recommended.</description>
          <Rule id="xccdf_org.ssgproject.content_rule_service_systemd-coredump_disabled" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable acquiring, saving, and processing core dumps</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">systemd-coredump.socket</html:code> unit is a socket activation of
the <html:code xmlns:html="http://www.w3.org/1999/xhtml">systemd-coredump@.service</html:code> which processes core dumps.
By masking the unit, core dump processing is disabled.</description>
            <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_SMF_EXT.1</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">A core dump includes a memory image taken at the time the operating system
terminates an application. The memory image could contain sensitive data
and is generally useful only for developers trying to debug problems.</rationale>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="service_systemd-coredump_disabled" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

SYSTEMCTL_EXEC='/usr/bin/systemctl'
"$SYSTEMCTL_EXEC" stop 'systemd-coredump.service'
"$SYSTEMCTL_EXEC" disable 'systemd-coredump.service'
"$SYSTEMCTL_EXEC" mask 'systemd-coredump.service'
# Disable socket activation if we have a unit file for it
if "$SYSTEMCTL_EXEC" list-unit-files | grep -q '^systemd-coredump.socket'; then
    "$SYSTEMCTL_EXEC" stop 'systemd-coredump.socket'
    "$SYSTEMCTL_EXEC" mask 'systemd-coredump.socket'
fi
# The service may not be running because it has been started and failed,
# so let's reset the state so OVAL checks pass.
# Service should be 'inactive', not 'failed' after reboot though.
"$SYSTEMCTL_EXEC" reset-failed 'systemd-coredump.service' || true

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="service_systemd-coredump_disabled" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="disable">- name: Disable service systemd-coredump
  block:

    - name: Gather the service facts
      service_facts: null

    - name: Disable service systemd-coredump
      systemd:
        name: systemd-coredump.service
        enabled: 'no'
        state: stopped
        masked: 'yes'
      when: '"systemd-coredump.service" in ansible_facts.services'
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - disable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - service_systemd-coredump_disabled

- name: Unit Socket Exists - systemd-coredump.socket
  command: systemctl list-unit-files systemd-coredump.socket
  args:
    warn: false
  register: socket_file_exists
  changed_when: false
  ignore_errors: true
  check_mode: false
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - disable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - service_systemd-coredump_disabled

- name: Disable socket systemd-coredump
  systemd:
    name: systemd-coredump.socket
    enabled: 'no'
    state: stopped
    masked: 'yes'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - '"systemd-coredump.socket" in socket_file_exists.stdout_lines[1]'
  tags:
    - disable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - service_systemd-coredump_disabled
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="service_systemd-coredump_disabled" system="urn:xccdf:fix:script:puppet" complexity="low" disruption="low" strategy="enable">include disable_systemd-coredump

class disable_systemd-coredump {
  service {'systemd-coredump':
    enable =&gt; false,
    ensure =&gt; 'stopped',
  }
}
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="service_systemd-coredump_disabled" system="urn:xccdf:fix:script:kubernetes" reboot="true" complexity="low" disruption="medium" strategy="disable">apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    systemd:
      units:
      - name: systemd-coredump.service
        enabled: false
        mask: true
      - name: systemd-coredump.socket
        enabled: false
        mask: true
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-service_systemd-coredump_disabled:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-service_systemd-coredump_disabled_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_coredump_disable_storage" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable storing core dump</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">Storage</html:code> option in <html:code xmlns:html="http://www.w3.org/1999/xhtml">[Coredump]</html:code> section
of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/systemd/coredump.conf</html:code>
can be set to <html:code xmlns:html="http://www.w3.org/1999/xhtml">none</html:code> to disable storing core dumps permanently.</description>
            <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/systemd/coredump.conf</html:code> file
does not already contain the <html:code xmlns:html="http://www.w3.org/1999/xhtml">[Coredump]</html:code> section,
the value will not be configured correctly.</warning>
            <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_SMF_EXT.1</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">A core dump includes a memory image taken at the time the operating system
terminates an application. The memory image could contain sensitive data
and is generally useful only for developers or system operators trying to
debug problems. Enabling core dumps on production systems is not recommended,
however there may be overriding operational requirements to enable advanced
debuging. Permitting temporary enablement of core dumps during such situations
should be reviewed through local needs and policy.</rationale>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="coredump_disable_storage" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="restrict">if [ -e "/etc/systemd/coredump.conf" ] ; then
    LC_ALL=C sed -i "/^\s*Storage\s*=\s*/Id" "/etc/systemd/coredump.conf"
else
    touch "/etc/systemd/coredump.conf"
fi
cp "/etc/systemd/coredump.conf" "/etc/systemd/coredump.conf.bak"
# Insert at the end of the file
printf '%s\n' "Storage=none" &gt;&gt; "/etc/systemd/coredump.conf"
# Clean up after ourselves.
rm "/etc/systemd/coredump.conf.bak"
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="coredump_disable_storage" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Disable storing core dump
  block:

    - name: Check for duplicate values
      lineinfile:
        path: /etc/systemd/coredump.conf
        create: false
        regexp: ^\s*Storage\s*=\s*
        state: absent
      check_mode: true
      changed_when: false
      register: dupes

    - name: Deduplicate values from /etc/systemd/coredump.conf
      lineinfile:
        path: /etc/systemd/coredump.conf
        create: false
        regexp: ^\s*Storage\s*=\s*
        state: absent
      when: dupes.found is defined and dupes.found &gt; 1

    - name: Insert correct line to /etc/systemd/coredump.conf
      lineinfile:
        path: /etc/systemd/coredump.conf
        create: false
        regexp: ^\s*Storage\s*=\s*
        line: Storage=none
        state: present
  tags:
    - coredump_disable_storage
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="coredump_disable_storage" system="urn:xccdf:fix:script:kubernetes">apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,%23%20%20This%20file%20is%20part%20of%20systemd.%0A%23%0A%23%20%20systemd%20is%20free%20software%3B%20you%20can%20redistribute%20it%20and/or%20modify%20it%0A%23%20%20under%20the%20terms%20of%20the%20GNU%20Lesser%20General%20Public%20License%20as%20published%20by%0A%23%20%20the%20Free%20Software%20Foundation%3B%20either%20version%202.1%20of%20the%20License%2C%20or%0A%23%20%20%28at%20your%20option%29%20any%20later%20version.%0A%23%0A%23%20Entries%20in%20this%20file%20show%20the%20compile%20time%20defaults.%0A%23%20You%20can%20change%20settings%20by%20editing%20this%20file.%0A%23%20Defaults%20can%20be%20restored%20by%20simply%20deleting%20this%20file.%0A%23%0A%23%20See%20coredump.conf%285%29%20for%20details.%0A%0A%5BCoredump%5D%0A%23Storage%3Dexternal%0A%23Compress%3Dyes%0A%23ProcessSizeMax%3D2G%0A%23ExternalSizeMax%3D2G%0A%23JournalSizeMax%3D767M%0A%23MaxUse%3D%0A%23KeepFree%3D%0AStorage%3Dnone%0AProcessSizeMax%3D0%0A
        mode: 0644
        path: /etc/systemd/coredump.conf
        overwrite: true
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-coredump_disable_storage:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-coredump_disable_storage_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_disable_users_coredumps" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable Core Dumps for All Users</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To disable core dumps for all users, add the following line to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/security/limits.conf</html:code>, or to a file within the
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/security/limits.d/</html:code> directory:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">*     hard   core    0</html:pre></description>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.2</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI04.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.1.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.17.2.1</reference>
            <reference href="https://www.cisecurity.org/controls/">1</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">13</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">2</reference>
            <reference href="https://www.cisecurity.org/controls/">7</reference>
            <reference href="https://www.cisecurity.org/controls/">8</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">A core dump includes a memory image taken at the time the operating system
terminates an application. The memory image could contain sensitive data and is generally useful
only for developers trying to debug problems.</rationale>
            <platform idref="cpe:/a:pam"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="disable_users_coredumps" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - disable_users_coredumps
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: disable core dumps with limits
  lineinfile:
    dest: /etc/security/limits.conf
    regexp: ^[^#].*core
    line: '*        hard       core      0'
    create: true
  when: '"pam" in ansible_facts.packages'
  tags:
    - disable_users_coredumps
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="disable_users_coredumps" system="urn:xccdf:fix:script:kubernetes">apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,%2A%20%20%20%20%20hard%20%20%20core%20%20%20%200
        mode: 0644
        path: /etc/security/limits.d/75-disable_users_coredumps.conf
        overwrite: true
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-disable_users_coredumps:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-disable_users_coredumps_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_coredump_disable_backtraces" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable core dump backtraces</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">ProcessSizeMax</html:code> option in <html:code xmlns:html="http://www.w3.org/1999/xhtml">[Coredump]</html:code> section
of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/systemd/coredump.conf</html:code>
specifies the maximum size in bytes of a core which will be processed.
Core dumps exceeding this size may be stored, but the backtrace will not
be generated.</description>
            <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/systemd/coredump.conf</html:code> file
does not already contain the <html:code xmlns:html="http://www.w3.org/1999/xhtml">[Coredump]</html:code> section,
the value will not be configured correctly.</warning>
            <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_SMF_EXT.1</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">A core dump includes a memory image taken at the time the operating system
terminates an application. The memory image could contain sensitive data
and is generally useful only for developers or system operators trying to
debug problems.

Enabling core dumps on production systems is not recommended,
however there may be overriding operational requirements to enable advanced
debuging. Permitting temporary enablement of core dumps during such situations
should be reviewed through local needs and policy.</rationale>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="coredump_disable_backtraces" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="restrict">if [ -e "/etc/systemd/coredump.conf" ] ; then
    LC_ALL=C sed -i "/^\s*ProcessSizeMax\s*=\s*/Id" "/etc/systemd/coredump.conf"
else
    touch "/etc/systemd/coredump.conf"
fi
cp "/etc/systemd/coredump.conf" "/etc/systemd/coredump.conf.bak"
# Insert at the end of the file
printf '%s\n' "ProcessSizeMax=0" &gt;&gt; "/etc/systemd/coredump.conf"
# Clean up after ourselves.
rm "/etc/systemd/coredump.conf.bak"
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="coredump_disable_backtraces" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Disable core dump backtraces
  block:

    - name: Check for duplicate values
      lineinfile:
        path: /etc/systemd/coredump.conf
        create: false
        regexp: ^\s*ProcessSizeMax\s*=\s*
        state: absent
      check_mode: true
      changed_when: false
      register: dupes

    - name: Deduplicate values from /etc/systemd/coredump.conf
      lineinfile:
        path: /etc/systemd/coredump.conf
        create: false
        regexp: ^\s*ProcessSizeMax\s*=\s*
        state: absent
      when: dupes.found is defined and dupes.found &gt; 1

    - name: Insert correct line to /etc/systemd/coredump.conf
      lineinfile:
        path: /etc/systemd/coredump.conf
        create: false
        regexp: ^\s*ProcessSizeMax\s*=\s*
        line: ProcessSizeMax=0
        state: present
  tags:
    - coredump_disable_backtraces
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="coredump_disable_backtraces" system="urn:xccdf:fix:script:kubernetes">apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,%23%20%20This%20file%20is%20part%20of%20systemd.%0A%23%0A%23%20%20systemd%20is%20free%20software%3B%20you%20can%20redistribute%20it%20and/or%20modify%20it%0A%23%20%20under%20the%20terms%20of%20the%20GNU%20Lesser%20General%20Public%20License%20as%20published%20by%0A%23%20%20the%20Free%20Software%20Foundation%3B%20either%20version%202.1%20of%20the%20License%2C%20or%0A%23%20%20%28at%20your%20option%29%20any%20later%20version.%0A%23%0A%23%20Entries%20in%20this%20file%20show%20the%20compile%20time%20defaults.%0A%23%20You%20can%20change%20settings%20by%20editing%20this%20file.%0A%23%20Defaults%20can%20be%20restored%20by%20simply%20deleting%20this%20file.%0A%23%0A%23%20See%20coredump.conf%285%29%20for%20details.%0A%0A%5BCoredump%5D%0A%23Storage%3Dexternal%0A%23Compress%3Dyes%0A%23ProcessSizeMax%3D2G%0A%23ExternalSizeMax%3D2G%0A%23JournalSizeMax%3D767M%0A%23MaxUse%3D%0A%23KeepFree%3D%0AStorage%3Dnone%0AProcessSizeMax%3D0%0A
        mode: 0644
        path: /etc/systemd/coredump.conf
        overwrite: true
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-coredump_disable_backtraces:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-coredump_disable_backtraces_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_sysctl_fs_suid_dumpable" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable Core Dumps for SUID programs</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To set the runtime status of the <html:code xmlns:html="http://www.w3.org/1999/xhtml">fs.suid_dumpable</html:code> kernel parameter, run the following command: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo sysctl -w fs.suid_dumpable=0</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/sysctl.d</html:code>: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">fs.suid_dumpable = 0</html:pre></description>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(4)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(c)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SI-11(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SI-11(b)</reference>
            <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R23)</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The core dump of a setuid program is more likely to contain
sensitive data, as the program itself runs with greater privileges than the
user who initiated execution of the program.  Disabling the ability for any
setuid program to write a core file decreases the risk of unauthorized access
of such data.</rationale>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_fs_suid_dumpable" system="urn:xccdf:fix:script:sh" reboot="true" complexity="low" disruption="medium" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then



#
# Set runtime for fs.suid_dumpable
#
/sbin/sysctl -q -n -w fs.suid_dumpable="0"

#
# If fs.suid_dumpable present in /etc/sysctl.conf, change value to "0"
#	else, add "fs.suid_dumpable = 0" to /etc/sysctl.conf
#
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_replace_or_append" use="legacy"/>
replace_or_append '/etc/sysctl.conf' '^fs.suid_dumpable' "0" ''

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_fs_suid_dumpable" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="medium" strategy="disable">- name: Ensure sysctl fs.suid_dumpable is set to 0
  sysctl:
    name: fs.suid_dumpable
    value: '0'
    state: present
    reload: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-SI-11(a)
    - NIST-800-53-SI-11(b)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_fs_suid_dumpable
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-sysctl_fs_suid_dumpable:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-sysctl_fs_suid_dumpable_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
        </Group>
        <Group id="xccdf_org.ssgproject.content_group_enable_execshield_settings">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Enable ExecShield</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">ExecShield describes kernel features that provide
protection against exploitation of memory corruption errors such as buffer
overflows. These features include random placement of the stack and other
memory regions, prevention of execution in memory that should only hold data,
and special handling of text buffers. These protections are enabled by default
on 32-bit systems and controlled through <html:code xmlns:html="http://www.w3.org/1999/xhtml">sysctl</html:code> variables 
<html:code xmlns:html="http://www.w3.org/1999/xhtml">kernel.exec-shield</html:code> and <html:code xmlns:html="http://www.w3.org/1999/xhtml">kernel.randomize_va_space</html:code>. On the latest
64-bit systems, <html:code xmlns:html="http://www.w3.org/1999/xhtml">kernel.exec-shield</html:code> cannot be enabled or disabled with 
<html:code xmlns:html="http://www.w3.org/1999/xhtml">sysctl</html:code>.</description>
          <Rule id="xccdf_org.ssgproject.content_rule_sysctl_kernel_kptr_restrict" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Restrict Exposed Kernel Pointer Addresses Access</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To set the runtime status of the <html:code xmlns:html="http://www.w3.org/1999/xhtml">kernel.kptr_restrict</html:code> kernel parameter, run the following command: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo sysctl -w kernel.kptr_restrict=1</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/sysctl.d</html:code>: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">kernel.kptr_restrict = 1</html:pre></description>
            <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R23)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-30</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-30(2)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-30(5)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000132-GPOS-00067</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000433-GPOS-00192</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Exposing kernel pointers (through procfs or <html:code xmlns:html="http://www.w3.org/1999/xhtml">seq_printf()</html:code>) exposes
kernel writeable structures that can contain functions pointers. If a write vulnereability occurs
in the kernel allowing a write access to any of this structure, the kernel can be compromise. This
option disallow any program withtout the CAP_SYSLOG capability from getting the kernel pointers addresses,
replacing them with 0.</rationale>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_kernel_kptr_restrict" system="urn:xccdf:fix:script:sh" reboot="true" complexity="low" disruption="medium" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then



#
# Set runtime for kernel.kptr_restrict
#
/sbin/sysctl -q -n -w kernel.kptr_restrict="1"

#
# If kernel.kptr_restrict present in /etc/sysctl.conf, change value to "1"
#	else, add "kernel.kptr_restrict = 1" to /etc/sysctl.conf
#
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_replace_or_append" use="legacy"/>
replace_or_append '/etc/sysctl.conf' '^kernel.kptr_restrict' "1" ''

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_kernel_kptr_restrict" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="medium" strategy="disable">- name: Ensure sysctl kernel.kptr_restrict is set to 1
  sysctl:
    name: kernel.kptr_restrict
    value: '1'
    state: present
    reload: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-SC-30
    - NIST-800-53-SC-30(2)
    - NIST-800-53-SC-30(5)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_kernel_kptr_restrict
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_kernel_kptr_restrict" system="urn:xccdf:fix:script:kubernetes">apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,kernel.kptr_restrict%3D1%0A
        mode: 0644
        path: /etc/sysctl.d/75-sysctl_kernel_kptr_restrict.conf
        overwrite: true
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-sysctl_kernel_kptr_restrict:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-sysctl_kernel_kptr_restrict_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_sysctl_kernel_exec_shield" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Enable ExecShield via sysctl</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">By default on Red Hat Enterprise Linux 7 64-bit systems, ExecShield is
enabled and can only be disabled if the hardware does not support
ExecShield or is disabled in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/default/grub</html:code>. For Red Hat
Enterprise Linux 7 32-bit systems, <html:code xmlns:html="http://www.w3.org/1999/xhtml">sysctl</html:code> can be used to enable
ExecShield.</description>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-002530</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(4)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(c)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-39</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">8</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000433-GPOS-00192</reference>
            <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R9)</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">ExecShield uses the segmentation feature on all x86 systems to prevent
execution in memory higher than a certain address. It writes an address as
a limit in the code segment descriptor, to control where code can be
executed, on a per-process basis. When the kernel places a process's memory
regions such as the stack and heap higher than this address, the hardware
prevents execution in that address range. This is enabled by default on the
latest Red Hat and Fedora systems if supported by the hardware.</rationale>
            <platform idref="cpe:/a:machine"/>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-sysctl_kernel_exec_shield:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-sysctl_kernel_exec_shield_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_sysctl_kernel_randomize_va_space" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Enable Randomized Layout of Virtual Address Space</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To set the runtime status of the <html:code xmlns:html="http://www.w3.org/1999/xhtml">kernel.randomize_va_space</html:code> kernel parameter, run the following command: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo sysctl -w kernel.randomize_va_space=2</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/sysctl.d</html:code>: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">kernel.randomize_va_space = 2</html:pre></description>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-002824</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(4)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(c)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-30</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-30(2)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000433-GPOS-00193</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
            <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R23)</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Address space layout randomization (ASLR) makes it more difficult for an
attacker to predict the location of attack code they have introduced into a
process's address space during an attempt at exploitation.  Additionally,
ASLR makes it more difficult for an attacker to know the location of
existing code in order to re-purpose it using return oriented programming
(ROP) techniques.</rationale>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_kernel_randomize_va_space" system="urn:xccdf:fix:script:sh" reboot="true" complexity="low" disruption="medium" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then



#
# Set runtime for kernel.randomize_va_space
#
/sbin/sysctl -q -n -w kernel.randomize_va_space="2"

#
# If kernel.randomize_va_space present in /etc/sysctl.conf, change value to "2"
#	else, add "kernel.randomize_va_space = 2" to /etc/sysctl.conf
#
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_replace_or_append" use="legacy"/>
replace_or_append '/etc/sysctl.conf' '^kernel.randomize_va_space' "2" ''

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_kernel_randomize_va_space" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="medium" strategy="disable">- name: Ensure sysctl kernel.randomize_va_space is set to 2
  sysctl:
    name: kernel.randomize_va_space
    value: '2'
    state: present
    reload: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-CM-6(a)
    - NIST-800-53-SC-30
    - NIST-800-53-SC-30(2)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_kernel_randomize_va_space
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_kernel_randomize_va_space" system="urn:xccdf:fix:script:kubernetes">apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,kernel.randomize_va_space%3D2%0A
        mode: 0644
        path: /etc/sysctl.d/75-sysctl_kernel_randomize_va_space.conf
        overwrite: true
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-sysctl_kernel_randomize_va_space:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-sysctl_kernel_randomize_va_space_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
        </Group>
        <Group id="xccdf_org.ssgproject.content_group_daemon_umask">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Daemon Umask</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The umask is a per-process setting which limits
the default permissions for creation of new files and directories.
The system includes initialization scripts which set the default umask
for system daemons.</description>
          <Value id="xccdf_org.ssgproject.content_value_var_umask_for_daemons" type="string">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">daemon umask</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Enter umask for daemons</description>
            <value selector="022">022</value>
            <value selector="027">027</value>
            <value>022</value>
          </Value>
          <Rule id="xccdf_org.ssgproject.content_rule_umask_for_daemons" selected="false" role="full" severity="unknown">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Set Daemon Umask</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The file <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/init.d/functions</html:code> includes initialization
parameters for most or all daemons started at boot time. Many daemons
on the system already individually restrict themselves to
a umask of <html:code xmlns:html="http://www.w3.org/1999/xhtml">077</html:code> in their own init scripts. By default, the umask of
<html:code xmlns:html="http://www.w3.org/1999/xhtml">022</html:code> is set which prevents creation of group- or world-writable files.
To set the umask for daemons expected by the profile, edit the following line:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml" xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2">umask <html:i><xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_umask_for_daemons" use="legacy"/></html:i></html:pre></description>
            <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="functionality">Setting the umask to too restrictive a setting can cause serious errors at
runtime.</warning>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.10.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.1.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.1.5</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.1.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.7.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.7.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.7.3.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.8.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.8.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.5</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">13</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">18</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">5</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The umask influences the permissions assigned to files created by a
process at run time. An unnecessarily permissive umask could result in files
being created with insecure permissions.</rationale>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-export export-name="oval:ssg-var_umask_for_daemons:var:1" value-id="xccdf_org.ssgproject.content_value_var_umask_for_daemons"/>
              <check-content-ref name="oval:ssg-umask_for_daemons:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-umask_for_daemons_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
        </Group>
      </Group>
      <Group id="xccdf_org.ssgproject.content_group_files">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Verify Permissions on Important Files and
Directories</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Permissions for many files on a system must be set
restrictively to ensure sensitive information is properly protected.
This section discusses important
permission restrictions which can be verified
to ensure that no harmful discrepancies have
arisen.</description>
        <Rule id="xccdf_org.ssgproject.content_rule_file_permissions_systemmap" selected="false" role="full" severity="unknown">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Verify that local System.map file (if exists) is readable only by root</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Files containing sensitive informations should be protected by restrictive
  permissions. Most of the time, there is no need that these files need to be read by any non-root user

To properly set the permissions of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/boot/System.map-*</html:code>, run the command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo chmod 0600 /boot/System.map-*</html:pre></description>
          <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R13)</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">System.map</html:code> file contains information about kernel symbols and
  can give some hints to generate local exploitation.</rationale>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-file_permissions_systemmap:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-file_permissions_systemmap_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_dir_perms_world_writable_system_owned" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure All World-Writable Directories Are Owned by a System Account</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">All directories in local partitions which are
world-writable should be owned by root or another
system account. If any world-writable directories are not
owned by a system account, this should be investigated.
Following this, the files should be deleted or assigned to an
appropriate owner.</description>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.10.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.11.1.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.11.1.5</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.11.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.1.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.2.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.6.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.7.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.7.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.7.3.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.8.2.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.8.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.5</reference>
          <reference href="https://www.cisecurity.org/controls/">12</reference>
          <reference href="https://www.cisecurity.org/controls/">13</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">16</reference>
          <reference href="https://www.cisecurity.org/controls/">18</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">5</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Allowing a user account to own a world-writable directory is
undesirable because it allows the owner of that directory to remove
or replace any files that may be placed in the directory by other
users.</rationale>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-dir_perms_world_writable_system_owned:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-dir_perms_world_writable_system_owned_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_dir_perms_world_writable_system_owned_group" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure All World-Writable Directories Are Group Owned by a System Account</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">All directories in local partitions which are
world-writable should be group owned by root or another
system account. If any world-writable directories are not
group owned by a system account, this should be investigated.
Following this, the files should be deleted or assigned to an
appropriate group.</description>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.10.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.11.1.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.11.1.5</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.11.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.1.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.2.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.6.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.7.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.7.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.7.3.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.8.2.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.8.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.5</reference>
          <reference href="https://www.cisecurity.org/controls/">12</reference>
          <reference href="https://www.cisecurity.org/controls/">13</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">16</reference>
          <reference href="https://www.cisecurity.org/controls/">18</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">5</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Allowing a user account to group own a world-writable directory is
undesirable because it allows the owner of that directory to remove
or replace any files that may be placed in the directory by other
users.</rationale>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-dir_perms_world_writable_system_owned_group:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-dir_perms_world_writable_system_owned_group_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_file_permissions_unauthorized_world_writable" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure No World-Writable Files Exist</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">It is generally a good idea to remove global (other) write
access to a file when it is discovered. However, check with
documentation for specific applications before making changes.
Also, monitor for recurring world-writable files, as these may be
symptoms of a misconfigured application or user account. Finally,
this applies to real files and not virtual files that are a part of
pseudo file systems such as <html:code xmlns:html="http://www.w3.org/1999/xhtml">sysfs</html:code> or <html:code xmlns:html="http://www.w3.org/1999/xhtml">procfs</html:code>.</description>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.10.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.11.1.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.11.1.5</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.11.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.1.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.2.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.6.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.7.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.7.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.7.3.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.8.2.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.8.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.5</reference>
          <reference href="https://www.cisecurity.org/controls/">12</reference>
          <reference href="https://www.cisecurity.org/controls/">13</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">16</reference>
          <reference href="https://www.cisecurity.org/controls/">18</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">5</reference>
          <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R40)</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Data in world-writable files can be modified by any
user on the system. In almost all circumstances, files can be
configured using a combination of user and group permissions to
support whatever legitimate access is needed without the risk
caused by world-writable files.</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_permissions_unauthorized_world_writable" system="urn:xccdf:fix:script:sh">
find / -xdev -type f -perm -002 -exec chmod o-w {} \;
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-file_permissions_unauthorized_world_writable:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-file_permissions_unauthorized_world_writable_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_no_files_unowned_by_user" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure All Files Are Owned by a User</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">If any files are not owned by a user, then the
cause of their lack of ownership should be investigated.
Following this, the files should be deleted or assigned to an
appropriate user. The following command will discover and print
any files on local partitions which do not belong to a valid user:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ df --local -P | awk {'if (NR!=1) print $6'} | sudo xargs -I '{}' find '{}' -xdev -nouser</html:pre>
To search all filesystems on a system including network mounted
filesystems the following command can be run manually for each partition:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo find PARTITION -xdev -nouser</html:pre></description>
          <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="functionality">For this rule to evaluate centralized user accounts, <html:code xmlns:html="http://www.w3.org/1999/xhtml">getent</html:code> must be working properly
so that running the command <html:pre xmlns:html="http://www.w3.org/1999/xhtml">getent passwd</html:pre> returns a list of all users in your organization.
If using the System Security Services Daemon (SSSD), <html:pre xmlns:html="http://www.w3.org/1999/xhtml">enumerate = true</html:pre> must be configured
in your organization's domain to return a complete list of users</warning>
          <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="performance">Enabling this rule will result in slower scan times depending on the size of your organization
and number of centralized users.</warning>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-002165</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.11</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.12</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.2.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.3</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.06</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.10.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.11.1.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.11.1.5</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.11.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.5.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.6.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.1.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.2.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.2.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.2.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.6.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.7.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.7.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.7.3.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.8.2.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.8.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.5</reference>
          <reference href="https://www.cisecurity.org/controls/">11</reference>
          <reference href="https://www.cisecurity.org/controls/">12</reference>
          <reference href="https://www.cisecurity.org/controls/">13</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">16</reference>
          <reference href="https://www.cisecurity.org/controls/">18</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">5</reference>
          <reference href="https://www.cisecurity.org/controls/">9</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Unowned files do not directly imply a security problem, but they are generally
a sign that something is amiss. They may
be caused by an intruder, by incorrect software installation or
draft software removal, or by failure to remove all files belonging
to a deleted account. The files should be repaired so they
will not cause problems when accounts are created in the future,
and the cause should be discovered and addressed.</rationale>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-no_files_unowned_by_user:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-no_files_unowned_by_user_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_sysctl_fs_protected_hardlinks" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Enable Kernel Parameter to Enforce DAC on Hardlinks</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To set the runtime status of the <html:code xmlns:html="http://www.w3.org/1999/xhtml">fs.protected_hardlinks</html:code> kernel parameter, run the following command: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo sysctl -w fs.protected_hardlinks=1</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/sysctl.d</html:code>: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">fs.protected_hardlinks = 1</html:pre></description>
          <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R23)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000324-GPOS-00125</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-002165</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">By enabling this kernel parameter, users can no longer create soft or hard links to
files which they do not own. Disallowing such hardlinks mitigate vulnerabilities
based on insecure file system accessed by privileged programs, avoiding an
exploitation vector exploiting unsafe use of <html:code xmlns:html="http://www.w3.org/1999/xhtml">open()</html:code> or <html:code xmlns:html="http://www.w3.org/1999/xhtml">creat()</html:code>.</rationale>
          <platform idref="cpe:/a:machine"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_fs_protected_hardlinks" system="urn:xccdf:fix:script:sh" reboot="true" complexity="low" disruption="medium" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then



#
# Set runtime for fs.protected_hardlinks
#
/sbin/sysctl -q -n -w fs.protected_hardlinks="1"

#
# If fs.protected_hardlinks present in /etc/sysctl.conf, change value to "1"
#	else, add "fs.protected_hardlinks = 1" to /etc/sysctl.conf
#
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_replace_or_append" use="legacy"/>
replace_or_append '/etc/sysctl.conf' '^fs.protected_hardlinks' "1" ''

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_fs_protected_hardlinks" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="medium" strategy="disable">- name: Ensure sysctl fs.protected_hardlinks is set to 1
  sysctl:
    name: fs.protected_hardlinks
    value: '1'
    state: present
    reload: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_fs_protected_hardlinks
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_fs_protected_hardlinks" system="urn:xccdf:fix:script:kubernetes">apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,fs.protected_hardlinks%3D1%0A
        mode: 0644
        path: /etc/sysctl.d/75-sysctl_fs_protected_hardlinks.conf
        overwrite: true
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-sysctl_fs_protected_hardlinks:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-sysctl_fs_protected_hardlinks_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_sysctl_fs_protected_symlinks" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Enable Kernel Parameter to Enforce DAC on Symlinks</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To set the runtime status of the <html:code xmlns:html="http://www.w3.org/1999/xhtml">fs.protected_symlinks</html:code> kernel parameter, run the following command: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo sysctl -w fs.protected_symlinks=1</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/sysctl.d</html:code>: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">fs.protected_symlinks = 1</html:pre></description>
          <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R23)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000324-GPOS-00125</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-002165</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">By enabling this kernel parameter, symbolic links are permitted to be followed
only when outside a sticky world-writable directory, or when the UID of the
link and follower match, or when the directory owner matches the symlink's owner.
Disallowing such symlinks helps mitigate vulnerabilities based on insecure file system
accessed by privileged programs, avoiding an exploitation vector exploiting unsafe use of
<html:code xmlns:html="http://www.w3.org/1999/xhtml">open()</html:code> or <html:code xmlns:html="http://www.w3.org/1999/xhtml">creat()</html:code>.</rationale>
          <platform idref="cpe:/a:machine"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_fs_protected_symlinks" system="urn:xccdf:fix:script:sh" reboot="true" complexity="low" disruption="medium" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then



#
# Set runtime for fs.protected_symlinks
#
/sbin/sysctl -q -n -w fs.protected_symlinks="1"

#
# If fs.protected_symlinks present in /etc/sysctl.conf, change value to "1"
#	else, add "fs.protected_symlinks = 1" to /etc/sysctl.conf
#
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_replace_or_append" use="legacy"/>
replace_or_append '/etc/sysctl.conf' '^fs.protected_symlinks' "1" ''

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_fs_protected_symlinks" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="medium" strategy="disable">- name: Ensure sysctl fs.protected_symlinks is set to 1
  sysctl:
    name: fs.protected_symlinks
    value: '1'
    state: present
    reload: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_fs_protected_symlinks
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_fs_protected_symlinks" system="urn:xccdf:fix:script:kubernetes">apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,fs.protected_symlinks%3D1%0A
        mode: 0644
        path: /etc/sysctl.d/75-sysctl_fs_protected_symlinks.conf
        overwrite: true
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-sysctl_fs_protected_symlinks:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-sysctl_fs_protected_symlinks_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_file_permissions_unauthorized_sgid" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure All SGID Executables Are Authorized</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The SGID (set group id) bit should be set only on files that were
installed via authorized means. A straightforward means of identifying
unauthorized SGID files is determine if any were not installed as part of an
RPM package, which is cryptographically verified. Investigate the origin
of any unpackaged SGID files.
This configuration check considers authorized SGID files which were installed via RPM.
It is assumed that when an individual has sudo access to install an RPM
and all packages are signed with an organizationally-recognized GPG key,
the software should be considered an approved package on the system.
Any SGID file not deployed through an RPM will be flagged for further review.</description>
          <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R37)</reference>
          <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R38)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.10.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.11.1.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.11.1.5</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.11.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.1.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.2.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.6.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.7.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.7.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.7.3.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.8.2.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.8.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.5</reference>
          <reference href="https://www.cisecurity.org/controls/">12</reference>
          <reference href="https://www.cisecurity.org/controls/">13</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">16</reference>
          <reference href="https://www.cisecurity.org/controls/">18</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">5</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Executable files with the SGID permission run with the privileges of
the owner of the file. SGID files of uncertain provenance could allow for
unprivileged users to elevate privileges. The presence of these files should be
strictly controlled on the system.</rationale>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-file_permissions_unauthorized_sgid:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-file_permissions_unauthorized_sgid_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_file_permissions_ungroupowned" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure All Files Are Owned by a Group</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">If any files are not owned by a group, then the
cause of their lack of group-ownership should be investigated.
Following this, the files should be deleted or assigned to an
appropriate group. The following command will discover and print
any files on local partitions which do not belong to a valid group:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ df --local -P | awk '{if (NR!=1) print $6}' | sudo xargs -I '{}' find '{}' -xdev -nogroup</html:pre>
To search all filesystems on a system including network mounted
filesystems the following command can be run manually for each partition:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo find PARTITION -xdev -nogroup</html:pre></description>
          <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">This rule only considers local groups.
If you have your groups defined outside <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/group</html:code>, the rule won't consider those.</warning>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-002165</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.11</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.12</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.2.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.10</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.06</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.10</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.10.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.11.1.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.11.1.5</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.11.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.1.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.2.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.18.1.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.6.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.7.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.7.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.7.3.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.8.2.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.8.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.6</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.3.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.5</reference>
          <reference href="https://www.cisecurity.org/controls/">1</reference>
          <reference href="https://www.cisecurity.org/controls/">11</reference>
          <reference href="https://www.cisecurity.org/controls/">12</reference>
          <reference href="https://www.cisecurity.org/controls/">13</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">16</reference>
          <reference href="https://www.cisecurity.org/controls/">18</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">5</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Unowned files do not directly imply a security problem, but they are generally
a sign that something is amiss. They may
be caused by an intruder, by incorrect software installation or
draft software removal, or by failure to remove all files belonging
to a deleted account. The files should be repaired so they
will not cause problems when accounts are created in the future,
and the cause should be discovered and addressed.</rationale>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-file_permissions_ungroupowned:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-file_permissions_ungroupowned_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_dir_perms_world_writable_root_owned" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure All World-Writable Directories Are Owned by root user</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">All directories in local partitions which are world-writable should be owned
by root. If any world-writable directories are not owned by root, this
should be investigated. Following this, the files should be deleted or
assigned to root user.</description>
          <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R40)</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Allowing a user account to own a world-writable directory is
undesirable because it allows the owner of that directory to remove
or replace any files that may be placed in the directory by other
users.</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="dir_perms_world_writable_root_owned" system="urn:xccdf:fix:script:sh">#!/bin/bash

find / -not -fstype afs -not -fstype ceph -not -fstype cifs -not -fstype smb3 -not -fstype smbfs -not -fstype sshfs -not -fstype ncpfs -not -fstype ncp -not -fstype nfs -not -fstype nfs4 -not -fstype gfs -not -fstype gfs2 -not -fstype glusterfs -not -fstype gpfs -not -fstype pvfs2 -not -fstype ocfs2 -not -fstype lustre -not -fstype davfs -not -fstype fuse.sshfs -type d -perm -0002 -uid +0 -exec chown root {} \;
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="dir_perms_world_writable_root_owned" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="medium" strategy="restrict">- name: Configure excluded (non local) file systems
  set_fact:
    excluded_fstypes:
      - afs
      - ceph
      - cifs
      - smb3
      - smbfs
      - sshfs
      - ncpfs
      - ncp
      - nfs
      - nfs4
      - gfs
      - gfs2
      - glusterfs
      - gpfs
      - pvfs2
      - ocfs2
      - lustre
      - davfs
      - fuse.sshfs
  tags:
    - dir_perms_world_writable_root_owned
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Create empty list of excluded paths
  set_fact:
    excluded_paths: []
  tags:
    - dir_perms_world_writable_root_owned
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Detect nonlocal file systems and add them to excluded paths
  set_fact:
    excluded_paths: '{{ excluded_paths | union([item.mount]) }}'
  loop: '{{ ansible_mounts }}'
  when: item.fstype in excluded_fstypes
  tags:
    - dir_perms_world_writable_root_owned
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Find all directories excluding non-local partitions
  find:
    paths: /
    excludes: excluded_paths
    file_type: directory
    hidden: true
    recurse: true
  register: found_dirs
  tags:
    - dir_perms_world_writable_root_owned
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Create list of world writable directories
  set_fact:
    world_writable_dirs: '{{ found_dirs.files | selectattr(''woth'') | list }}'
  tags:
    - dir_perms_world_writable_root_owned
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Change owner to root on directories which are world writable
  file:
    path: '{{ item.path }}'
    owner: root
  loop: '{{ world_writable_dirs }}'
  ignore_errors: true
  tags:
    - dir_perms_world_writable_root_owned
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-dir_perms_world_writable_root_owned:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-dir_perms_world_writable_root_owned_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_file_permissions_unauthorized_suid" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure All SUID Executables Are Authorized</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The SUID (set user id) bit should be set only on files that were
installed via authorized means. A straightforward means of identifying
unauthorized SUID files is determine if any were not installed as part of an
RPM package, which is cryptographically verified. Investigate the origin
of any unpackaged SUID files.
This configuration check considers authorized SUID files which were installed via RPM.
It is assumed that when an individual has sudo access to install an RPM
and all packages are signed with an organizationally-recognized GPG key,
the software should be considered an approved package on the system.
Any SUID file not deployed through an RPM will be flagged for further review.</description>
          <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R37)</reference>
          <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R38)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.10.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.11.1.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.11.1.5</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.11.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.1.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.2.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.6.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.7.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.7.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.7.3.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.8.2.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.8.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.5</reference>
          <reference href="https://www.cisecurity.org/controls/">12</reference>
          <reference href="https://www.cisecurity.org/controls/">13</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">16</reference>
          <reference href="https://www.cisecurity.org/controls/">18</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">5</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Executable files with the SUID permission run with the privileges of
the owner of the file. SUID files of uncertain provenance could allow for
unprivileged users to elevate privileges. The presence of these files should be
strictly controlled on the system.</rationale>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-file_permissions_unauthorized_suid:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-file_permissions_unauthorized_suid_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_dir_perms_world_writable_sticky_bits" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Verify that All World-Writable Directories Have Sticky Bits Set</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">When the so-called 'sticky bit' is set on a directory,
only the owner of a given file may remove that file from the
directory. Without the sticky bit, any user with write access to a
directory may remove any file in the directory. Setting the sticky
bit prevents users from removing each other's files. In cases where
there is no reason for a directory to be world-writable, a better
solution is to remove that permission rather than to set the sticky
bit. However, if a directory is used by a particular application,
consult that application's documentation instead of blindly
changing modes.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
To set the sticky bit on a world-writable directory <html:i xmlns:html="http://www.w3.org/1999/xhtml">DIR</html:i>, run the
following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo chmod +t <html:i>DIR</html:i></html:pre></description>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.10.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.11.1.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.11.1.5</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.11.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.1.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.2.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.6.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.7.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.7.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.7.3.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.8.2.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.8.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.5</reference>
          <reference href="https://www.cisecurity.org/controls/">12</reference>
          <reference href="https://www.cisecurity.org/controls/">13</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">16</reference>
          <reference href="https://www.cisecurity.org/controls/">18</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">5</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000138-GPOS-00069</reference>
          <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R40)</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-001090</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Failing to set the sticky bit on public directories allows unauthorized
users to delete files in the directory structure.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
The only authorized public directories are those temporary directories
supplied with the system, or those designed to be temporary file
repositories. The setting is normally reserved for directories used by the
system, by users for temporary file storage (such as <html:code xmlns:html="http://www.w3.org/1999/xhtml">/tmp</html:code>), and
for directories requiring global read/write access.</rationale>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-dir_perms_world_writable_sticky_bits:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-dir_perms_world_writable_sticky_bits_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Group id="xccdf_org.ssgproject.content_group_permissions_within_important_dirs">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Verify File Permissions Within Some Important Directories</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Some directories contain files whose confidentiality or integrity
is notably important and may also be susceptible to misconfiguration over time, particularly if
unpackaged software is installed. As such,
an argument exists to verify that files' permissions within these directories remain
configured correctly and restrictively.</description>
          <Rule id="xccdf_org.ssgproject.content_rule_dir_permissions_library_dirs" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Verify that Shared Library Directories Have Restrictive Permissions</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">System-wide shared library directories, which contain are linked to executables
during process load time or run time, are stored in the following directories
by default:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">/lib
/lib64
/usr/lib
/usr/lib64
</html:pre>
Kernel modules, which can be added to the kernel during runtime, are
stored in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/lib/modules</html:code>. All sub-directories in these directories
should not be group-writable or world-writable. If any file in these
directories is found to be group-writable or world-writable, correct
its permission with the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo chmod go-w <html:i>DIR</html:i></html:pre></description>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-001499</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">If the operating system were to allow any user to make changes to software libraries,
then those changes might be implemented without undergoing the appropriate testing
and approvals that are part of a robust change management process.

This requirement applies to operating systems with software libraries that are accessible
and configurable, as in the case of interpreted languages. Software libraries also include
privileged programs which execute with escalated privileges. Only qualified and authorized
individuals must be allowed to obtain access to information system components for purposes
of initiating changes, including upgrades and modifications.</rationale>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-dir_permissions_library_dirs:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-dir_permissions_library_dirs_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_file_permissions_binary_dirs" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Verify that System Executables Have Restrictive Permissions</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">System executables are stored in the following directories by default:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">/bin
/sbin
/usr/bin
/usr/libexec
/usr/local/bin
/usr/local/sbin
/usr/sbin</html:pre>
All files in these directories should not be group-writable or world-writable.
If any file <html:i xmlns:html="http://www.w3.org/1999/xhtml">FILE</html:i> in these directories is found
to be group-writable or world-writable, correct its permission with the
following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo chmod go-w <html:i>FILE</html:i></html:pre></description>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.10.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.1.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.1.5</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.1.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.7.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.7.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.7.3.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.8.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.8.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.5</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">13</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">18</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">5</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000259-GPOS-00100</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-001499</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">System binaries are executed by privileged users, as well as system services,
and restrictive permissions are necessary to ensure execution of these programs
cannot be co-opted.</rationale>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_permissions_binary_dirs" system="urn:xccdf:fix:script:ansible" complexity="medium" disruption="medium" strategy="restrict">- name: Read list of world and group writable system executables
  command: find /bin /usr/bin /usr/local/bin /sbin /usr/sbin /usr/local/sbin /usr/libexec
    -perm /022 -type f
  register: world_writable_library_files
  changed_when: false
  failed_when: false
  check_mode: false
  tags:
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - file_permissions_binary_dirs
    - medium_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Remove world/group writability of system executables
  file:
    path: '{{ item }}'
    mode: go-w
  with_items: '{{ world_writable_library_files.stdout_lines }}'
  when: world_writable_library_files.stdout_lines | length &gt; 0
  tags:
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - file_permissions_binary_dirs
    - medium_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-file_permissions_binary_dirs:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-file_permissions_binary_dirs_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_file_permissions_library_dirs" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Verify that Shared Library Files Have Restrictive Permissions</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">System-wide shared library files, which are linked to executables
during process load time or run time, are stored in the following directories
by default:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">/lib
/lib64
/usr/lib
/usr/lib64
</html:pre>
Kernel modules, which can be added to the kernel during runtime, are
stored in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/lib/modules</html:code>. All files in these directories
should not be group-writable or world-writable. If any file in these
directories is found to be group-writable or world-writable, correct
its permission with the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo chmod go-w <html:i>FILE</html:i></html:pre></description>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.10.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.1.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.1.5</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.1.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.7.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.7.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.7.3.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.8.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.8.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.5</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">13</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">18</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">5</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000259-GPOS-00100</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-001499</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Files from shared library directories are loaded into the address
space of processes (including privileged ones) or of the kernel itself at
runtime. Restrictive permissions are necessary to protect the integrity of the system.</rationale>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_permissions_library_dirs" system="urn:xccdf:fix:script:ansible" complexity="high" disruption="medium" strategy="restrict">- name: Read list of world and group writable files in libraries directories
  command: find /lib /lib64 /usr/lib /usr/lib64 -perm /022 -type f
  register: world_writable_library_files
  changed_when: false
  failed_when: false
  check_mode: false
  tags:
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - file_permissions_library_dirs
    - high_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Disable world/group writability to library files
  file:
    path: '{{ item }}'
    mode: go-w
  with_items: '{{ world_writable_library_files.stdout_lines }}'
  when: world_writable_library_files.stdout_lines | length &gt; 0
  tags:
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - file_permissions_library_dirs
    - high_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-file_permissions_library_dirs:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-file_permissions_library_dirs_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_file_ownership_binary_dirs" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Verify that System Executables Have Root Ownership</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">System executables are stored in the following directories by default:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">/bin
/sbin
/usr/bin
/usr/libexec
/usr/local/bin
/usr/local/sbin
/usr/sbin</html:pre>
All files in these directories should be owned by the <html:code xmlns:html="http://www.w3.org/1999/xhtml">root</html:code> user.
If any file <html:i xmlns:html="http://www.w3.org/1999/xhtml">FILE</html:i> in these directories is found
to be owned by a user other than root, correct its ownership with the
following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo chown root <html:i>FILE</html:i></html:pre></description>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.10.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.1.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.1.5</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.1.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.7.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.7.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.7.3.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.8.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.8.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.5</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">13</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">18</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">5</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000259-GPOS-00100</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-001499</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">System binaries are executed by privileged users as well as system services,
and restrictive permissions are necessary to ensure that their
execution of these programs cannot be co-opted.</rationale>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_ownership_binary_dirs" system="urn:xccdf:fix:script:ansible" complexity="medium" disruption="medium" strategy="restrict">- name: Read list of system executables without root ownership
  command: find /bin/ /usr/bin/ /usr/local/bin/ /sbin/ /usr/sbin/ /usr/local/sbin/
    /usr/libexec \! -user root
  register: no_root_system_executables
  changed_when: false
  failed_when: false
  check_mode: false
  tags:
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - file_ownership_binary_dirs
    - medium_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Set ownership to root of system executables
  file:
    path: '{{ item }}'
    owner: root
  with_items: '{{ no_root_system_executables.stdout_lines }}'
  when: no_root_system_executables.stdout_lines | length &gt; 0
  tags:
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - file_ownership_binary_dirs
    - medium_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-file_ownership_binary_dirs:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-file_ownership_binary_dirs_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_file_ownership_library_dirs" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Verify that Shared Library Files Have Root Ownership</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">System-wide shared library files, which are linked to executables
during process load time or run time, are stored in the following directories
by default:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">/lib
/lib64
/usr/lib
/usr/lib64
</html:pre>
Kernel modules, which can be added to the kernel during runtime, are also
stored in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/lib/modules</html:code>. All files in these directories should be
owned by the <html:code xmlns:html="http://www.w3.org/1999/xhtml">root</html:code> user. If the directory, or any file in these
directories, is found to be owned by a user other than root correct its
ownership with the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo chown root <html:i>FILE</html:i></html:pre></description>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.10.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.1.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.1.5</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.1.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.7.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.7.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.7.3.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.8.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.8.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.5</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">13</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">18</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">5</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000259-GPOS-00100</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-001499</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Files from shared library directories are loaded into the address
space of processes (including privileged ones) or of the kernel itself at
runtime. Proper ownership is necessary to protect the integrity of the system.</rationale>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_ownership_library_dirs" system="urn:xccdf:fix:script:sh">for LIBDIR in /usr/lib /usr/lib64 /lib /lib64
do
  if [ -d $LIBDIR ]
  then
    find -L $LIBDIR \! -user root -exec chown root {} \; 
  fi
done
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_ownership_library_dirs" system="urn:xccdf:fix:script:ansible" complexity="medium" disruption="medium" strategy="restrict">- name: Read list libraries without root ownership
  command: find -L /usr/lib /usr/lib64 /lib /lib64 \! -user root
  register: libraries_not_owned_by_root
  changed_when: false
  failed_when: false
  check_mode: false
  tags:
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - file_ownership_library_dirs
    - medium_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Set ownership of system libraries to root
  file:
    path: '{{ item }}'
    owner: root
  with_items: '{{ libraries_not_owned_by_root.stdout_lines }}'
  when: libraries_not_owned_by_root | length &gt; 0
  tags:
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - file_ownership_library_dirs
    - medium_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-file_ownership_library_dirs:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-file_ownership_library_dirs_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
        </Group>
        <Group id="xccdf_org.ssgproject.content_group_permissions_var_log_dir">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Verify Permissions on Files within /var/log Directory</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">/var/log</html:code> directory contains files with logs of error
messages in the system and should only be accessed by authorized
personnel.</description>
          <Rule id="xccdf_org.ssgproject.content_rule_file_groupowner_var_log" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Verify Group Who Owns /var/log Directory</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US"> To properly set the group owner of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/var/log</html:code>, run the command: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo chgrp root /var/log</html:pre></description>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000206-GPOS-00084</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-001314</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">/var/log</html:code> directory contains files with logs of error
messages in the system and should only be accessed by authorized
personnel.</rationale>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_groupowner_var_log" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="configure">

chgrp 0 /var/log/
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_groupowner_var_log" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: Test for existence /var/log/
  stat:
    path: /var/log/
  register: file_exists
  tags:
    - configure_strategy
    - file_groupowner_var_log
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Ensure group owner 0 on /var/log/
  file:
    path: /var/log/
    group: '0'
  when: file_exists.stat is defined and file_exists.stat.exists
  tags:
    - configure_strategy
    - file_groupowner_var_log
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-file_groupowner_var_log:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-file_groupowner_var_log_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_file_owner_var_log" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Verify User Who Owns /var/log Directory</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US"> To properly set the owner of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/var/log</html:code>, run the command: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo chown root /var/log </html:pre></description>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000206-GPOS-00084</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-001314</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">/var/log</html:code> directory contains files with logs of error
messages in the system and should only be accessed by authorized
personnel.</rationale>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_owner_var_log" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="configure">

chown 0 /var/log/
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_owner_var_log" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: Test for existence /var/log/
  stat:
    path: /var/log/
  register: file_exists
  tags:
    - configure_strategy
    - file_owner_var_log
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Ensure owner 0 on /var/log/
  file:
    path: /var/log/
    owner: '0'
  when: file_exists.stat is defined and file_exists.stat.exists
  tags:
    - configure_strategy
    - file_owner_var_log
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-file_owner_var_log:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-file_owner_var_log_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_file_groupowner_var_log_messages" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Verify Group Who Owns /var/log/messages File</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US"> To properly set the group owner of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/var/log/messages</html:code>, run the command: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo chgrp root /var/log/messages</html:pre></description>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000206-GPOS-00084</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-001314</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">/var/log/messages</html:code> file contains logs of error messages in
the system and should only be accessed by authorized personnel.</rationale>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_groupowner_var_log_messages" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="configure">

chgrp 0 /var/log/messages
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_groupowner_var_log_messages" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: Test for existence /var/log/messages
  stat:
    path: /var/log/messages
  register: file_exists
  tags:
    - configure_strategy
    - file_groupowner_var_log_messages
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Ensure group owner 0 on /var/log/messages
  file:
    path: /var/log/messages
    group: '0'
  when: file_exists.stat is defined and file_exists.stat.exists
  tags:
    - configure_strategy
    - file_groupowner_var_log_messages
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-file_groupowner_var_log_messages:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-file_groupowner_var_log_messages_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_file_permissions_var_log_messages" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Verify Permissions on /var/log/messages File</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">
To properly set the permissions of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/var/log/messages</html:code>, run the command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo chmod 0640 /var/log/messages</html:pre></description>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000206-GPOS-00084</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-001314</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">/var/log/messages</html:code> file contains logs of error messages in
the system and should only be accessed by authorized personnel.</rationale>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_permissions_var_log_messages" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="configure">

chmod 0640 /var/log/messages
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_permissions_var_log_messages" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: Test for existence /var/log/messages
  stat:
    path: /var/log/messages
  register: file_exists
  tags:
    - configure_strategy
    - file_permissions_var_log_messages
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Ensure permission 0640 on /var/log/messages
  file:
    path: /var/log/messages
    mode: '0640'
  when: file_exists.stat is defined and file_exists.stat.exists
  tags:
    - configure_strategy
    - file_permissions_var_log_messages
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-file_permissions_var_log_messages:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-file_permissions_var_log_messages_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_file_permissions_var_log" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Verify Permissions on /var/log Directory</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">
To properly set the permissions of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/var/log</html:code>, run the command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo chmod 0755 /var/log</html:pre></description>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000206-GPOS-00084</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-001314</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">/var/log</html:code> directory contains files with logs of error
messages in the system and should only be accessed by authorized
personnel.</rationale>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_permissions_var_log" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="configure">

chmod 0755 /var/log/
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_permissions_var_log" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: Test for existence /var/log/
  stat:
    path: /var/log/
  register: file_exists
  tags:
    - configure_strategy
    - file_permissions_var_log
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Ensure permission 0755 on /var/log/
  file:
    path: /var/log/
    mode: '0755'
  when: file_exists.stat is defined and file_exists.stat.exists
  tags:
    - configure_strategy
    - file_permissions_var_log
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-file_permissions_var_log:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-file_permissions_var_log_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_file_owner_var_log_messages" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Verify User Who Owns /var/log/messages File</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US"> To properly set the owner of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/var/log/messages</html:code>, run the command: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo chown root /var/log/messages </html:pre></description>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000206-GPOS-00084</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-001314</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">/var/log/messages</html:code> file contains logs of error messages in
the system and should only be accessed by authorized personnel.</rationale>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_owner_var_log_messages" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="configure">

chown 0 /var/log/messages
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_owner_var_log_messages" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: Test for existence /var/log/messages
  stat:
    path: /var/log/messages
  register: file_exists
  tags:
    - configure_strategy
    - file_owner_var_log_messages
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Ensure owner 0 on /var/log/messages
  file:
    path: /var/log/messages
    owner: '0'
  when: file_exists.stat is defined and file_exists.stat.exists
  tags:
    - configure_strategy
    - file_owner_var_log_messages
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-file_owner_var_log_messages:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-file_owner_var_log_messages_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
        </Group>
        <Group id="xccdf_org.ssgproject.content_group_permissions_important_account_files">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Verify Permissions on Files with Local Account Information and Credentials</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The default restrictive permissions for files which act as
important security databases such as <html:code xmlns:html="http://www.w3.org/1999/xhtml">passwd</html:code>, <html:code xmlns:html="http://www.w3.org/1999/xhtml">shadow</html:code>,
<html:code xmlns:html="http://www.w3.org/1999/xhtml">group</html:code>, and <html:code xmlns:html="http://www.w3.org/1999/xhtml">gshadow</html:code> files must be maintained.  Many utilities
need read access to the <html:code xmlns:html="http://www.w3.org/1999/xhtml">passwd</html:code> file in order to function properly, but
read access to the <html:code xmlns:html="http://www.w3.org/1999/xhtml">shadow</html:code> file allows malicious attacks against system
passwords, and should never be enabled.</description>
          <Rule id="xccdf_org.ssgproject.content_rule_file_owner_backup_etc_group" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Verify User Who Owns Backup group File</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US"> To properly set the owner of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/group-</html:code>, run the command: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo chown root /etc/group- </html:pre></description>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/group-</html:code> file is a backup file of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/group</html:code>, and as such,
it contains information regarding groups that are configured on the system.
Protection of this file is important for system security.</rationale>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_owner_backup_etc_group" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="configure">

chown 0 /etc/group-
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_owner_backup_etc_group" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: Test for existence /etc/group-
  stat:
    path: /etc/group-
  register: file_exists
  tags:
    - configure_strategy
    - file_owner_backup_etc_group
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Ensure owner 0 on /etc/group-
  file:
    path: /etc/group-
    owner: '0'
  when: file_exists.stat is defined and file_exists.stat.exists
  tags:
    - configure_strategy
    - file_owner_backup_etc_group
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-file_owner_backup_etc_group:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-file_owner_backup_etc_group_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_file_groupowner_backup_etc_gshadow" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Verify Group Who Owns Backup gshadow File</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US"> To properly set the group owner of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/gshadow-</html:code>, run the command: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo chgrp root /etc/gshadow-</html:pre></description>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/gshadow-</html:code> file is a backup of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/gshadow</html:code>, and as such,
it contains group password hashes. Protection of this file is critical for system security.</rationale>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_groupowner_backup_etc_gshadow" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="configure">

chgrp 0 /etc/gshadow-
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_groupowner_backup_etc_gshadow" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: Test for existence /etc/gshadow-
  stat:
    path: /etc/gshadow-
  register: file_exists
  tags:
    - configure_strategy
    - file_groupowner_backup_etc_gshadow
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Ensure group owner 0 on /etc/gshadow-
  file:
    path: /etc/gshadow-
    group: '0'
  when: file_exists.stat is defined and file_exists.stat.exists
  tags:
    - configure_strategy
    - file_groupowner_backup_etc_gshadow
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-file_groupowner_backup_etc_gshadow:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-file_groupowner_backup_etc_gshadow_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_file_groupowner_etc_passwd" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Verify Group Who Owns passwd File</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US"> To properly set the group owner of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/passwd</html:code>, run the command: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo chgrp root /etc/passwd</html:pre></description>
            <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.2.2</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</reference>
            <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-8.7.c</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.10.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.1.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.1.5</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.1.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.7.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.7.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.7.3.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.8.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.8.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.5</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">13</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">18</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">5</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/passwd</html:code> file contains information about the users that are configured on
the system. Protection of this file is critical for system security.</rationale>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_groupowner_etc_passwd" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="configure">

chgrp 0 /etc/passwd
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_groupowner_etc_passwd" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: Test for existence /etc/passwd
  stat:
    path: /etc/passwd
  register: file_exists
  tags:
    - CJIS-5.5.2.2
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.7.c
    - configure_strategy
    - file_groupowner_etc_passwd
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Ensure group owner 0 on /etc/passwd
  file:
    path: /etc/passwd
    group: '0'
  when: file_exists.stat is defined and file_exists.stat.exists
  tags:
    - CJIS-5.5.2.2
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.7.c
    - configure_strategy
    - file_groupowner_etc_passwd
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-file_groupowner_etc_passwd:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-file_groupowner_etc_passwd_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_file_groupowner_etc_gshadow" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Verify Group Who Owns gshadow File</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US"> To properly set the group owner of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/gshadow</html:code>, run the command: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo chgrp root /etc/gshadow</html:pre></description>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.10.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.1.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.1.5</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.1.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.7.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.7.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.7.3.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.8.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.8.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.5</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">13</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">18</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">5</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/gshadow</html:code> file contains group password hashes. Protection of this file
is critical for system security.</rationale>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_groupowner_etc_gshadow" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="configure">

chgrp 0 /etc/gshadow
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_groupowner_etc_gshadow" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: Test for existence /etc/gshadow
  stat:
    path: /etc/gshadow
  register: file_exists
  tags:
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - configure_strategy
    - file_groupowner_etc_gshadow
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Ensure group owner 0 on /etc/gshadow
  file:
    path: /etc/gshadow
    group: '0'
  when: file_exists.stat is defined and file_exists.stat.exists
  tags:
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - configure_strategy
    - file_groupowner_etc_gshadow
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-file_groupowner_etc_gshadow:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-file_groupowner_etc_gshadow_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_file_permissions_etc_passwd" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Verify Permissions on passwd File</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">
To properly set the permissions of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/passwd</html:code>, run the command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo chmod 0644 /etc/passwd</html:pre></description>
            <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.2.2</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</reference>
            <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-8.7.c</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.10.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.1.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.1.5</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.1.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.7.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.7.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.7.3.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.8.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.8.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.5</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">13</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">18</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">5</reference>
            <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R36)</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/passwd</html:code> file is writable by a group-owner or the
world the risk of its compromise is increased. The file contains the list of
accounts on the system and associated information, and protection of this file
is critical for system security.</rationale>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_permissions_etc_passwd" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="configure">

chmod 0644 /etc/passwd
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_permissions_etc_passwd" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: Test for existence /etc/passwd
  stat:
    path: /etc/passwd
  register: file_exists
  tags:
    - CJIS-5.5.2.2
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.7.c
    - configure_strategy
    - file_permissions_etc_passwd
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Ensure permission 0644 on /etc/passwd
  file:
    path: /etc/passwd
    mode: '0644'
  when: file_exists.stat is defined and file_exists.stat.exists
  tags:
    - CJIS-5.5.2.2
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.7.c
    - configure_strategy
    - file_permissions_etc_passwd
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-file_permissions_etc_passwd:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-file_permissions_etc_passwd_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_file_permissions_etc_shadow" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Verify Permissions on shadow File</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">
To properly set the permissions of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/shadow</html:code>, run the command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo chmod 0000 /etc/shadow</html:pre></description>
            <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R36)</reference>
            <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.2.2</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</reference>
            <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-8.7.c</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.10.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.1.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.1.5</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.1.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.7.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.7.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.7.3.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.8.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.8.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.5</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">13</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">18</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">5</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/shadow</html:code> file contains the list of local
system accounts and stores password hashes. Protection of this file is
critical for system security. Failure to give ownership of this file
to root provides the designated owner with access to sensitive information
which could weaken the system security posture.</rationale>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_permissions_etc_shadow" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="configure">

chmod 0000 /etc/shadow
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_permissions_etc_shadow" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: Test for existence /etc/shadow
  stat:
    path: /etc/shadow
  register: file_exists
  tags:
    - CJIS-5.5.2.2
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.7.c
    - configure_strategy
    - file_permissions_etc_shadow
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Ensure permission 0000 on /etc/shadow
  file:
    path: /etc/shadow
    mode: '0000'
  when: file_exists.stat is defined and file_exists.stat.exists
  tags:
    - CJIS-5.5.2.2
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.7.c
    - configure_strategy
    - file_permissions_etc_shadow
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-file_permissions_etc_shadow:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-file_permissions_etc_shadow_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_file_groupowner_etc_group" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Verify Group Who Owns group File</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US"> To properly set the group owner of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/group</html:code>, run the command: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo chgrp root /etc/group</html:pre></description>
            <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.2.2</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</reference>
            <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-8.7.c</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.10.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.1.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.1.5</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.1.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.7.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.7.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.7.3.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.8.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.8.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.5</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">13</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">18</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">5</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/group</html:code> file contains information regarding groups that are configured
on the system. Protection of this file is important for system security.</rationale>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_groupowner_etc_group" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="configure">

chgrp 0 /etc/group
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_groupowner_etc_group" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: Test for existence /etc/group
  stat:
    path: /etc/group
  register: file_exists
  tags:
    - CJIS-5.5.2.2
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.7.c
    - configure_strategy
    - file_groupowner_etc_group
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Ensure group owner 0 on /etc/group
  file:
    path: /etc/group
    group: '0'
  when: file_exists.stat is defined and file_exists.stat.exists
  tags:
    - CJIS-5.5.2.2
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.7.c
    - configure_strategy
    - file_groupowner_etc_group
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-file_groupowner_etc_group:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-file_groupowner_etc_group_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_file_owner_etc_group" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Verify User Who Owns group File</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US"> To properly set the owner of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/group</html:code>, run the command: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo chown root /etc/group </html:pre></description>
            <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.2.2</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</reference>
            <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-8.7.c</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.10.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.1.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.1.5</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.1.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.7.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.7.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.7.3.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.8.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.8.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.5</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">13</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">18</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">5</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/group</html:code> file contains information regarding groups that are configured
on the system. Protection of this file is important for system security.</rationale>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_owner_etc_group" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="configure">

chown 0 /etc/group
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_owner_etc_group" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: Test for existence /etc/group
  stat:
    path: /etc/group
  register: file_exists
  tags:
    - CJIS-5.5.2.2
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.7.c
    - configure_strategy
    - file_owner_etc_group
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Ensure owner 0 on /etc/group
  file:
    path: /etc/group
    owner: '0'
  when: file_exists.stat is defined and file_exists.stat.exists
  tags:
    - CJIS-5.5.2.2
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.7.c
    - configure_strategy
    - file_owner_etc_group
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-file_owner_etc_group:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-file_owner_etc_group_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_file_permissions_backup_etc_shadow" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Verify Permissions on Backup shadow File</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">
To properly set the permissions of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/shadow-</html:code>, run the command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo chmod 0000 /etc/shadow-</html:pre></description>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/shadow-</html:code> file is a backup file of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/shadow</html:code>, and as such,
it contains the list of local system accounts and password hashes.
Protection of this file is critical for system security.</rationale>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_permissions_backup_etc_shadow" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="configure">

chmod 0000 /etc/shadow-
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_permissions_backup_etc_shadow" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: Test for existence /etc/shadow-
  stat:
    path: /etc/shadow-
  register: file_exists
  tags:
    - configure_strategy
    - file_permissions_backup_etc_shadow
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Ensure permission 0000 on /etc/shadow-
  file:
    path: /etc/shadow-
    mode: '0000'
  when: file_exists.stat is defined and file_exists.stat.exists
  tags:
    - configure_strategy
    - file_permissions_backup_etc_shadow
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-file_permissions_backup_etc_shadow:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-file_permissions_backup_etc_shadow_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_file_permissions_etc_group" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Verify Permissions on group File</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">
To properly set the permissions of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/passwd</html:code>, run the command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo chmod 0644 /etc/passwd</html:pre></description>
            <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.2.2</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</reference>
            <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-8.7.c</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.10.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.1.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.1.5</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.1.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.7.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.7.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.7.3.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.8.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.8.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.5</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">13</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">18</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">5</reference>
            <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R36)</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/group</html:code> file contains information regarding groups that are configured
on the system. Protection of this file is important for system security.</rationale>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_permissions_etc_group" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="configure">

chmod 0644 /etc/group
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_permissions_etc_group" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: Test for existence /etc/group
  stat:
    path: /etc/group
  register: file_exists
  tags:
    - CJIS-5.5.2.2
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.7.c
    - configure_strategy
    - file_permissions_etc_group
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Ensure permission 0644 on /etc/group
  file:
    path: /etc/group
    mode: '0644'
  when: file_exists.stat is defined and file_exists.stat.exists
  tags:
    - CJIS-5.5.2.2
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.7.c
    - configure_strategy
    - file_permissions_etc_group
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-file_permissions_etc_group:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-file_permissions_etc_group_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_file_groupowner_backup_etc_group" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Verify Group Who Owns Backup group File</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US"> To properly set the group owner of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/group-</html:code>, run the command: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo chgrp root /etc/group-</html:pre></description>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/group-</html:code> file is a backup file of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/group</html:code>, and as such,
it contains information regarding groups that are configured on the system.
Protection of this file is important for system security.</rationale>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_groupowner_backup_etc_group" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="configure">

chgrp 0 /etc/group-
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_groupowner_backup_etc_group" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: Test for existence /etc/group-
  stat:
    path: /etc/group-
  register: file_exists
  tags:
    - configure_strategy
    - file_groupowner_backup_etc_group
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Ensure group owner 0 on /etc/group-
  file:
    path: /etc/group-
    group: '0'
  when: file_exists.stat is defined and file_exists.stat.exists
  tags:
    - configure_strategy
    - file_groupowner_backup_etc_group
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-file_groupowner_backup_etc_group:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-file_groupowner_backup_etc_group_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_file_owner_backup_etc_shadow" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Verify Group Who Owns Backup shadow File</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US"> To properly set the owner of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/shadow-</html:code>, run the command: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo chown root /etc/shadow- </html:pre></description>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/shadow-</html:code> file is a backup file of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/shadow</html:code>, and as such,
it contains the list of local system accounts and password hashes.
Protection of this file is critical for system security.</rationale>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_owner_backup_etc_shadow" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="configure">

chown 0 /etc/shadow-
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_owner_backup_etc_shadow" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: Test for existence /etc/shadow-
  stat:
    path: /etc/shadow-
  register: file_exists
  tags:
    - configure_strategy
    - file_owner_backup_etc_shadow
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Ensure owner 0 on /etc/shadow-
  file:
    path: /etc/shadow-
    owner: '0'
  when: file_exists.stat is defined and file_exists.stat.exists
  tags:
    - configure_strategy
    - file_owner_backup_etc_shadow
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-file_owner_backup_etc_shadow:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-file_owner_backup_etc_shadow_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_file_owner_etc_passwd" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Verify User Who Owns passwd File</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US"> To properly set the owner of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/passwd</html:code>, run the command: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo chown root /etc/passwd </html:pre></description>
            <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.2.2</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</reference>
            <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-8.7.c</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.10.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.1.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.1.5</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.1.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.7.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.7.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.7.3.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.8.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.8.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.5</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">13</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">18</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">5</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/passwd</html:code> file contains information about the users that are configured on
the system. Protection of this file is critical for system security.</rationale>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_owner_etc_passwd" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="configure">

chown 0 /etc/passwd
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_owner_etc_passwd" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: Test for existence /etc/passwd
  stat:
    path: /etc/passwd
  register: file_exists
  tags:
    - CJIS-5.5.2.2
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.7.c
    - configure_strategy
    - file_owner_etc_passwd
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Ensure owner 0 on /etc/passwd
  file:
    path: /etc/passwd
    owner: '0'
  when: file_exists.stat is defined and file_exists.stat.exists
  tags:
    - CJIS-5.5.2.2
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.7.c
    - configure_strategy
    - file_owner_etc_passwd
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-file_owner_etc_passwd:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-file_owner_etc_passwd_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_file_groupowner_backup_etc_shadow" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Verify User Who Owns Backup shadow File</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US"> To properly set the group owner of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/shadow-</html:code>, run the command: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo chgrp root /etc/shadow-</html:pre></description>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/shadow-</html:code> file is a backup file of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/shadow</html:code>, and as such,
it contains the list of local system accounts and password hashes.
Protection of this file is critical for system security.</rationale>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_groupowner_backup_etc_shadow" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="configure">

chgrp 0 /etc/shadow-
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_groupowner_backup_etc_shadow" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: Test for existence /etc/shadow-
  stat:
    path: /etc/shadow-
  register: file_exists
  tags:
    - configure_strategy
    - file_groupowner_backup_etc_shadow
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Ensure group owner 0 on /etc/shadow-
  file:
    path: /etc/shadow-
    group: '0'
  when: file_exists.stat is defined and file_exists.stat.exists
  tags:
    - configure_strategy
    - file_groupowner_backup_etc_shadow
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-file_groupowner_backup_etc_shadow:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-file_groupowner_backup_etc_shadow_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_file_permissions_backup_etc_passwd" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Verify Permissions on Backup passwd File</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">
To properly set the permissions of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/passwd-</html:code>, run the command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo chmod 0644 /etc/passwd-</html:pre></description>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/passwd-</html:code> file is a backup file of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/passwd</html:code>, and as such,
it contains information about the users that are configured on the system.
Protection of this file is critical for system security.</rationale>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_permissions_backup_etc_passwd" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="configure">

chmod 0644 /etc/passwd-
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_permissions_backup_etc_passwd" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: Test for existence /etc/passwd-
  stat:
    path: /etc/passwd-
  register: file_exists
  tags:
    - configure_strategy
    - file_permissions_backup_etc_passwd
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Ensure permission 0644 on /etc/passwd-
  file:
    path: /etc/passwd-
    mode: '0644'
  when: file_exists.stat is defined and file_exists.stat.exists
  tags:
    - configure_strategy
    - file_permissions_backup_etc_passwd
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-file_permissions_backup_etc_passwd:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-file_permissions_backup_etc_passwd_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_file_owner_backup_etc_gshadow" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Verify User Who Owns Backup gshadow File</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US"> To properly set the owner of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/gshadow-</html:code>, run the command: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo chown root /etc/gshadow- </html:pre></description>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/gshadow-</html:code> file is a backup of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/gshadow</html:code>, and as such,
it contains group password hashes. Protection of this file is critical for system security.</rationale>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_owner_backup_etc_gshadow" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="configure">

chown 0 /etc/gshadow-
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_owner_backup_etc_gshadow" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: Test for existence /etc/gshadow-
  stat:
    path: /etc/gshadow-
  register: file_exists
  tags:
    - configure_strategy
    - file_owner_backup_etc_gshadow
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Ensure owner 0 on /etc/gshadow-
  file:
    path: /etc/gshadow-
    owner: '0'
  when: file_exists.stat is defined and file_exists.stat.exists
  tags:
    - configure_strategy
    - file_owner_backup_etc_gshadow
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-file_owner_backup_etc_gshadow:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-file_owner_backup_etc_gshadow_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_file_owner_etc_gshadow" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Verify User Who Owns gshadow File</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US"> To properly set the owner of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/gshadow</html:code>, run the command: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo chown root /etc/gshadow </html:pre></description>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.10.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.1.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.1.5</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.1.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.7.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.7.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.7.3.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.8.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.8.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.5</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">13</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">18</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">5</reference>
            <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R36)</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/gshadow</html:code> file contains group password hashes. Protection of this file
is critical for system security.</rationale>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_owner_etc_gshadow" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="configure">

chown 0 /etc/gshadow
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_owner_etc_gshadow" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: Test for existence /etc/gshadow
  stat:
    path: /etc/gshadow
  register: file_exists
  tags:
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - configure_strategy
    - file_owner_etc_gshadow
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Ensure owner 0 on /etc/gshadow
  file:
    path: /etc/gshadow
    owner: '0'
  when: file_exists.stat is defined and file_exists.stat.exists
  tags:
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - configure_strategy
    - file_owner_etc_gshadow
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-file_owner_etc_gshadow:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-file_owner_etc_gshadow_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_file_permissions_backup_etc_group" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Verify Permissions on Backup group File</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">
To properly set the permissions of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/group-</html:code>, run the command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo chmod 0644 /etc/group-</html:pre></description>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/group-</html:code> file is a backup file of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/group</html:code>, and as such,
it contains information regarding groups that are configured on the system.
Protection of this file is important for system security.</rationale>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_permissions_backup_etc_group" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="configure">

chmod 0644 /etc/group-
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_permissions_backup_etc_group" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: Test for existence /etc/group-
  stat:
    path: /etc/group-
  register: file_exists
  tags:
    - configure_strategy
    - file_permissions_backup_etc_group
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Ensure permission 0644 on /etc/group-
  file:
    path: /etc/group-
    mode: '0644'
  when: file_exists.stat is defined and file_exists.stat.exists
  tags:
    - configure_strategy
    - file_permissions_backup_etc_group
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-file_permissions_backup_etc_group:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-file_permissions_backup_etc_group_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_file_permissions_etc_gshadow" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Verify Permissions on gshadow File</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">
To properly set the permissions of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/gshadow</html:code>, run the command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo chmod 0000 /etc/gshadow</html:pre></description>
            <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R36)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.10.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.1.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.1.5</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.1.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.7.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.7.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.7.3.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.8.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.8.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.5</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">13</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">18</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">5</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/gshadow</html:code> file contains group password hashes. Protection of this file
is critical for system security.</rationale>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_permissions_etc_gshadow" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="configure">

chmod 0000 /etc/gshadow
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_permissions_etc_gshadow" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: Test for existence /etc/gshadow
  stat:
    path: /etc/gshadow
  register: file_exists
  tags:
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - configure_strategy
    - file_permissions_etc_gshadow
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Ensure permission 0000 on /etc/gshadow
  file:
    path: /etc/gshadow
    mode: '0000'
  when: file_exists.stat is defined and file_exists.stat.exists
  tags:
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - configure_strategy
    - file_permissions_etc_gshadow
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-file_permissions_etc_gshadow:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-file_permissions_etc_gshadow_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_file_groupowner_etc_shadow" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Verify Group Who Owns shadow File</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US"> To properly set the group owner of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/shadow</html:code>, run the command: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo chgrp root /etc/shadow</html:pre></description>
            <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.2.2</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</reference>
            <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-8.7.c</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.10.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.1.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.1.5</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.1.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.7.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.7.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.7.3.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.8.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.8.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.5</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">13</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">18</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">5</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/shadow</html:code> file stores password hashes. Protection of this file is
critical for system security.</rationale>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_groupowner_etc_shadow" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="configure">

chgrp 0 /etc/shadow
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_groupowner_etc_shadow" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: Test for existence /etc/shadow
  stat:
    path: /etc/shadow
  register: file_exists
  tags:
    - CJIS-5.5.2.2
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.7.c
    - configure_strategy
    - file_groupowner_etc_shadow
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Ensure group owner 0 on /etc/shadow
  file:
    path: /etc/shadow
    group: '0'
  when: file_exists.stat is defined and file_exists.stat.exists
  tags:
    - CJIS-5.5.2.2
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.7.c
    - configure_strategy
    - file_groupowner_etc_shadow
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-file_groupowner_etc_shadow:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-file_groupowner_etc_shadow_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_file_owner_backup_etc_passwd" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Verify User Who Owns Backup passwd File</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US"> To properly set the owner of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/passwd-</html:code>, run the command: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo chown root /etc/passwd- </html:pre></description>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/passwd-</html:code> file is a backup file of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/passwd</html:code>, and as such,
it contains information about the users that are configured on the system.
Protection of this file is critical for system security.</rationale>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_owner_backup_etc_passwd" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="configure">

chown 0 /etc/passwd-
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_owner_backup_etc_passwd" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: Test for existence /etc/passwd-
  stat:
    path: /etc/passwd-
  register: file_exists
  tags:
    - configure_strategy
    - file_owner_backup_etc_passwd
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Ensure owner 0 on /etc/passwd-
  file:
    path: /etc/passwd-
    owner: '0'
  when: file_exists.stat is defined and file_exists.stat.exists
  tags:
    - configure_strategy
    - file_owner_backup_etc_passwd
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-file_owner_backup_etc_passwd:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-file_owner_backup_etc_passwd_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_file_groupowner_backup_etc_passwd" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Verify Group Who Owns Backup passwd File</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US"> To properly set the group owner of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/passwd-</html:code>, run the command: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo chgrp root /etc/passwd-</html:pre></description>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/passwd-</html:code> file is a backup file of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/passwd</html:code>, and as such,
it contains information about the users that are configured on the system.
Protection of this file is critical for system security.</rationale>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_groupowner_backup_etc_passwd" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="configure">

chgrp 0 /etc/passwd-
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_groupowner_backup_etc_passwd" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: Test for existence /etc/passwd-
  stat:
    path: /etc/passwd-
  register: file_exists
  tags:
    - configure_strategy
    - file_groupowner_backup_etc_passwd
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Ensure group owner 0 on /etc/passwd-
  file:
    path: /etc/passwd-
    group: '0'
  when: file_exists.stat is defined and file_exists.stat.exists
  tags:
    - configure_strategy
    - file_groupowner_backup_etc_passwd
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-file_groupowner_backup_etc_passwd:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-file_groupowner_backup_etc_passwd_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_file_permissions_backup_etc_gshadow" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Verify Permissions on Backup gshadow File</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">
To properly set the permissions of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/gshadow-</html:code>, run the command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo chmod 0000 /etc/gshadow-</html:pre></description>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/gshadow-</html:code> file is a backup of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/gshadow</html:code>, and as such,
it contains group password hashes. Protection of this file is critical for system security.</rationale>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_permissions_backup_etc_gshadow" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="configure">

chmod 0000 /etc/gshadow-
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_permissions_backup_etc_gshadow" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: Test for existence /etc/gshadow-
  stat:
    path: /etc/gshadow-
  register: file_exists
  tags:
    - configure_strategy
    - file_permissions_backup_etc_gshadow
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Ensure permission 0000 on /etc/gshadow-
  file:
    path: /etc/gshadow-
    mode: '0000'
  when: file_exists.stat is defined and file_exists.stat.exists
  tags:
    - configure_strategy
    - file_permissions_backup_etc_gshadow
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-file_permissions_backup_etc_gshadow:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-file_permissions_backup_etc_gshadow_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_file_owner_etc_shadow" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Verify User Who Owns shadow File</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US"> To properly set the owner of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/shadow</html:code>, run the command: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo chown root /etc/shadow </html:pre></description>
            <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.2.2</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</reference>
            <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-8.7.c</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.10.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.1.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.1.5</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.1.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.7.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.7.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.7.3.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.8.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.8.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.5</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">13</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">18</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">5</reference>
            <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R36)</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/shadow</html:code> file contains the list of local
system accounts and stores password hashes. Protection of this file is
critical for system security. Failure to give ownership of this file
to root provides the designated owner with access to sensitive information
which could weaken the system security posture.</rationale>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_owner_etc_shadow" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="configure">

chown 0 /etc/shadow
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_owner_etc_shadow" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: Test for existence /etc/shadow
  stat:
    path: /etc/shadow
  register: file_exists
  tags:
    - CJIS-5.5.2.2
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.7.c
    - configure_strategy
    - file_owner_etc_shadow
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Ensure owner 0 on /etc/shadow
  file:
    path: /etc/shadow
    owner: '0'
  when: file_exists.stat is defined and file_exists.stat.exists
  tags:
    - CJIS-5.5.2.2
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.7.c
    - configure_strategy
    - file_owner_etc_shadow
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-file_owner_etc_shadow:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-file_owner_etc_shadow_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
        </Group>
      </Group>
      <Group id="xccdf_org.ssgproject.content_group_permissions_local">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Verify Permissions on Important Files and
Directories Are Configured in /etc/permissions.local</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Permissions for many files on a system must be set
restrictively to ensure sensitive information is properly protected.
This section discusses the <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/permissions.local</html:code> file, where
expected permissions can be configured to be checked and fixed through
usage of the <html:code xmlns:html="http://www.w3.org/1999/xhtml">chkstat</html:code> command.</description>
      </Group>
      <Group id="xccdf_org.ssgproject.content_group_partitions">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Restrict Partition Mount Options</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">System partitions can be mounted with certain options
that limit what files on those partitions can do. These options
are set in the <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/fstab</html:code> configuration file, and can be
used to make certain types of malicious behavior more difficult.</description>
        <Value id="xccdf_org.ssgproject.content_value_var_removable_partition" type="string">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Removable Partition</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">This value is used by the checks mount_option_nodev_removable_partitions, mount_option_nodev_removable_partitions,
and mount_option_nodev_removable_partitions to ensure that the correct mount options are set on partitions mounted from
removable media such as CD-ROMs, USB keys, and floppy drives. This value should be modified to reflect any removable
partitions that are required on the local system.</description>
          <value selector="dev_cdrom">/dev/cdrom</value>
        </Value>
        <Rule id="xccdf_org.ssgproject.content_rule_mount_option_dev_shm_nodev" selected="false" role="full" severity="low">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Add nodev Option to /dev/shm</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">nodev</html:code> mount option can be used to prevent creation of device
files in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/dev/shm</html:code>. Legitimate character and block devices should
not exist within temporary directories like <html:code xmlns:html="http://www.w3.org/1999/xhtml">/dev/shm</html:code>.
Add the <html:code xmlns:html="http://www.w3.org/1999/xhtml">nodev</html:code> option to the fourth column of
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/fstab</html:code> for the line which controls mounting of
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/dev/shm</html:code>.</description>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-001764</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">MP-7</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-2</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.11</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.12</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.3</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.06</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.06</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.11.2.9</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.5.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.6.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.2.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.2.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.8.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.8.2.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.8.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.8.3.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.8.3.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
          <reference href="https://www.cisecurity.org/controls/">11</reference>
          <reference href="https://www.cisecurity.org/controls/">13</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">8</reference>
          <reference href="https://www.cisecurity.org/controls/">9</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000368-GPOS-00154</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The only legitimate location for device files is the <html:code xmlns:html="http://www.w3.org/1999/xhtml">/dev</html:code> directory
located on the root partition. The only exception to this is chroot jails.</rationale>
          <platform idref="cpe:/a:machine"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="mount_option_dev_shm_nodev" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_include_mount_options_functions" use="legacy"/>
include_mount_options_functions

function perform_remediation {
	# test "$mount_has_to_exist" = 'yes'
	if test "no" = 'yes'; then
		assert_mount_point_in_fstab /dev/shm || { echo "Not remediating, because there is no record of /dev/shm in /etc/fstab" &gt;&amp;2; return 1; }
	fi

	ensure_mount_option_in_fstab "/dev/shm" "nodev" "tmpfs" "tmpfs"

	ensure_partition_is_mounted "/dev/shm"
}

perform_remediation

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="mount_option_dev_shm_nodev" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="high" strategy="configure">- name: Check information associated to mountpoint
  command: findmnt  '/dev/shm'
  register: device_name
  failed_when: device_name.rc &gt; 1
  changed_when: false
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - low_severity
    - mount_option_dev_shm_nodev
    - no_reboot_needed

- name: Create mount_info dictionary variable
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
    - '{{ device_name.stdout_lines[0].split() | list | lower }}'
    - '{{ device_name.stdout_lines[1].split() | list }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - device_name.stdout is defined and device_name.stdout_lines is defined
    - (device_name.stdout | length &gt; 0)
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - low_severity
    - mount_option_dev_shm_nodev
    - no_reboot_needed

- name: If /dev/shm not mounted, craft mount_info manually
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
    - - target
      - source
      - fstype
      - options
    - - /dev/shm
      - tmpfs
      - tmpfs
      - defaults
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - ("" | length == 0)
    - (device_name.stdout | length == 0)
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - low_severity
    - mount_option_dev_shm_nodev
    - no_reboot_needed

- name: Make sure nodev option is part of the to /dev/shm options
  set_fact:
    mount_info: '{{ mount_info | combine( {''options'':''''~mount_info.options~'',nodev''
      }) }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - mount_info is defined and "nodev" not in mount_info.options
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - low_severity
    - mount_option_dev_shm_nodev
    - no_reboot_needed

- name: Ensure /dev/shm is mounted with nodev option
  mount:
    path: /dev/shm
    src: '{{ mount_info.source }}'
    opts: '{{ mount_info.options }}'
    state: mounted
    fstype: '{{ mount_info.fstype }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - (device_name.stdout is defined and (device_name.stdout | length &gt; 0)) or (""
      | length == 0)
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - low_severity
    - mount_option_dev_shm_nodev
    - no_reboot_needed
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-mount_option_dev_shm_nodev:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-mount_option_dev_shm_nodev_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_mount_option_nosuid_removable_partitions" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Add nosuid Option to Removable Media Partitions</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">nosuid</html:code> mount option prevents set-user-identifier (SUID)
and set-group-identifier (SGID) permissions from taking effect. These permissions
allow users to execute binaries with the same permissions as the owner and group
of the file respectively. Users should not be allowed to introduce SUID and SGID
files into the system via partitions mounted from removeable media.
Add the <html:code xmlns:html="http://www.w3.org/1999/xhtml">nosuid</html:code> option to the fourth column of
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/fstab</html:code> for the line which controls mounting of

    any removable media partitions.</description>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">MP-7</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-2</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.11</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.12</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.2.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.3</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS01.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.06</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.06</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.10.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.11.1.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.11.1.5</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.11.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.11.2.6</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.11.2.9</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.5.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.6.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.1.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.2.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.2.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.2.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.6.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.6.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.6.2.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.7.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.7.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.7.3.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.8.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.8.2.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.8.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.8.3.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.8.3.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.5</reference>
          <reference href="https://www.cisecurity.org/controls/">11</reference>
          <reference href="https://www.cisecurity.org/controls/">12</reference>
          <reference href="https://www.cisecurity.org/controls/">13</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">16</reference>
          <reference href="https://www.cisecurity.org/controls/">18</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">5</reference>
          <reference href="https://www.cisecurity.org/controls/">8</reference>
          <reference href="https://www.cisecurity.org/controls/">9</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The presence of SUID and SGID executables should be tightly controlled. Allowing
users to introduce SUID or SGID binaries from partitions mounted off of
removable media would allow them to introduce their own highly-privileged programs.</rationale>
          <platform idref="cpe:/a:machine"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="mount_option_nosuid_removable_partitions" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then


var_removable_partition="<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_removable_partition" use="legacy"/>"



device_regex="^\s*$var_removable_partition\s\+"
mount_option="nosuid"

if grep -q $device_regex /etc/fstab ; then
    previous_opts=$(grep $device_regex /etc/fstab | awk '{print $4}')
    sed -i "s|\($device_regex.*$previous_opts\)|\1,$mount_option|" /etc/fstab
else
    echo "Not remediating, because there is no record of $var_removable_partition in /etc/fstab" &gt;&amp;2
    return 1
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="mount_option_nosuid_removable_partitions" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="high" strategy="configure">- name: XCCDF Value var_removable_partition # promote to variable
  set_fact:
    var_removable_partition: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_removable_partition" use="legacy"/>
  tags:
    - always

- name: Ensure permission nosuid are set on var_removable_partition
  lineinfile:
    path: /etc/fstab
    regexp: ^\s*({{ var_removable_partition }})\s+([^\s]*)\s+([^\s]*)\s+([^\s]*)(.*)$
    backrefs: true
    line: \1 \2 \3 \4,nosuid \5
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_nosuid_removable_partitions
    - no_reboot_needed
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export export-name="oval:ssg-var_removable_partition:var:1" value-id="xccdf_org.ssgproject.content_value_var_removable_partition"/>
            <check-content-ref name="oval:ssg-mount_option_nosuid_removable_partitions:def:1" href="ssg-fedora-oval.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_mount_option_noexec_removable_partitions" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Add noexec Option to Removable Media Partitions</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">noexec</html:code> mount option prevents the direct execution of binaries
on the mounted filesystem. Preventing the direct execution of binaries from
removable media (such as a USB key) provides a defense against malicious
software that may be present on such untrusted media.
Add the <html:code xmlns:html="http://www.w3.org/1999/xhtml">noexec</html:code> option to the fourth column of
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/fstab</html:code> for the line which controls mounting of

    any removable media partitions.</description>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-000087</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">MP-7</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-2</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.11</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.12</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.2.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.3</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS01.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.06</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.06</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.11.2.6</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.11.2.9</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.5.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.6.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.2.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.2.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.6.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.6.2.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.7.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.8.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.8.2.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.8.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.8.3.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.8.3.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.1</reference>
          <reference href="https://www.cisecurity.org/controls/">11</reference>
          <reference href="https://www.cisecurity.org/controls/">12</reference>
          <reference href="https://www.cisecurity.org/controls/">13</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">16</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">8</reference>
          <reference href="https://www.cisecurity.org/controls/">9</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Allowing users to execute binaries from removable media such as USB keys exposes
the system to potential compromise.</rationale>
          <platform idref="cpe:/a:machine"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="mount_option_noexec_removable_partitions" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then


var_removable_partition="<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_removable_partition" use="legacy"/>"



device_regex="^\s*$var_removable_partition\s\+"
mount_option="noexec"

if grep -q $device_regex /etc/fstab ; then
    previous_opts=$(grep $device_regex /etc/fstab | awk '{print $4}')
    sed -i "s|\($device_regex.*$previous_opts\)|\1,$mount_option|" /etc/fstab
else
    echo "Not remediating, because there is no record of $var_removable_partition in /etc/fstab" &gt;&amp;2
    return 1
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="mount_option_noexec_removable_partitions" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="high" strategy="configure">- name: XCCDF Value var_removable_partition # promote to variable
  set_fact:
    var_removable_partition: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_removable_partition" use="legacy"/>
  tags:
    - always

- name: Ensure permission noexec are set on var_removable_partition
  lineinfile:
    path: /etc/fstab
    regexp: ^\s*({{ var_removable_partition }})\s+([^\s]*)\s+([^\s]*)\s+([^\s]*)(.*)$
    backrefs: true
    line: \1 \2 \3 \4,noexec \5
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_noexec_removable_partitions
    - no_reboot_needed
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export export-name="oval:ssg-var_removable_partition:var:1" value-id="xccdf_org.ssgproject.content_value_var_removable_partition"/>
            <check-content-ref name="oval:ssg-mount_option_noexec_removable_partitions:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-mount_option_noexec_removable_partitions_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_mount_option_var_log_noexec" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Add noexec Option to /var/log</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">noexec</html:code> mount option can be used to prevent binaries
from being executed out of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/var/log</html:code>.
Add the <html:code xmlns:html="http://www.w3.org/1999/xhtml">noexec</html:code> option to the fourth column of
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/fstab</html:code> for the line which controls mounting of
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/var/log</html:code>.</description>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">MP-7</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-2</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000368-GPOS-00154</reference>
          <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R12)</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-001764</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Allowing users to execute binaries from directories containing log files
such as <html:code xmlns:html="http://www.w3.org/1999/xhtml">/var/log</html:code> should never be necessary in normal operation and
can expose the system to potential compromise.</rationale>
          <platform idref="cpe:/a:machine"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="mount_option_var_log_noexec" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_include_mount_options_functions" use="legacy"/>
include_mount_options_functions

function perform_remediation {
	# test "$mount_has_to_exist" = 'yes'
	if test "yes" = 'yes'; then
		assert_mount_point_in_fstab /var/log || { echo "Not remediating, because there is no record of /var/log in /etc/fstab" &gt;&amp;2; return 1; }
	fi

	ensure_mount_option_in_fstab "/var/log" "noexec" "" ""

	ensure_partition_is_mounted "/var/log"
}

perform_remediation

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="mount_option_var_log_noexec" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="high" strategy="configure">- name: Check information associated to mountpoint
  command: findmnt --fstab '/var/log'
  register: device_name
  failed_when: device_name.rc &gt; 1
  changed_when: false
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_var_log_noexec
    - no_reboot_needed

- name: Create mount_info dictionary variable
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
    - '{{ device_name.stdout_lines[0].split() | list | lower }}'
    - '{{ device_name.stdout_lines[1].split() | list }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - device_name.stdout is defined and device_name.stdout_lines is defined
    - (device_name.stdout | length &gt; 0)
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_var_log_noexec
    - no_reboot_needed

- name: If /var/log not mounted, craft mount_info manually
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
    - - target
      - source
      - fstype
      - options
    - - /var/log
      - ''
      - ''
      - defaults
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - ("--fstab" | length == 0)
    - (device_name.stdout | length == 0)
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_var_log_noexec
    - no_reboot_needed

- name: Make sure noexec option is part of the to /var/log options
  set_fact:
    mount_info: '{{ mount_info | combine( {''options'':''''~mount_info.options~'',noexec''
      }) }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - mount_info is defined and "noexec" not in mount_info.options
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_var_log_noexec
    - no_reboot_needed

- name: Ensure /var/log is mounted with noexec option
  mount:
    path: /var/log
    src: '{{ mount_info.source }}'
    opts: '{{ mount_info.options }}'
    state: mounted
    fstype: '{{ mount_info.fstype }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - (device_name.stdout is defined and (device_name.stdout | length &gt; 0)) or ("--fstab"
      | length == 0)
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_var_log_noexec
    - no_reboot_needed
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="mount_option_var_log_noexec" system="urn:redhat:anaconda:pre" complexity="low" disruption="high" strategy="enable">
part /var/log --mountoptions="noexec"
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-mount_option_var_log_noexec:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-mount_option_var_log_noexec_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_mount_option_tmp_nodev" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Add nodev Option to /tmp</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">nodev</html:code> mount option can be used to prevent device files from
being created in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/tmp</html:code>. Legitimate character and block devices
should not exist within temporary directories like <html:code xmlns:html="http://www.w3.org/1999/xhtml">/tmp</html:code>.
Add the <html:code xmlns:html="http://www.w3.org/1999/xhtml">nodev</html:code> option to the fourth column of
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/fstab</html:code> for the line which controls mounting of
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/tmp</html:code>.</description>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">MP-7</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-2</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.11</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.12</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.3</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.06</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.06</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.11.2.9</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.5.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.6.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.2.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.2.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.8.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.8.2.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.8.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.8.3.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.8.3.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
          <reference href="https://www.cisecurity.org/controls/">11</reference>
          <reference href="https://www.cisecurity.org/controls/">13</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">8</reference>
          <reference href="https://www.cisecurity.org/controls/">9</reference>
          <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R12)</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000368-GPOS-00154</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-001764</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The only legitimate location for device files is the <html:code xmlns:html="http://www.w3.org/1999/xhtml">/dev</html:code> directory
located on the root partition. The only exception to this is chroot jails.</rationale>
          <platform idref="cpe:/a:machine"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="mount_option_tmp_nodev" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_include_mount_options_functions" use="legacy"/>
include_mount_options_functions

function perform_remediation {
	# test "$mount_has_to_exist" = 'yes'
	if test "yes" = 'yes'; then
		assert_mount_point_in_fstab /tmp || { echo "Not remediating, because there is no record of /tmp in /etc/fstab" &gt;&amp;2; return 1; }
	fi

	ensure_mount_option_in_fstab "/tmp" "nodev" "" ""

	ensure_partition_is_mounted "/tmp"
}

perform_remediation

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="mount_option_tmp_nodev" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="high" strategy="configure">- name: Check information associated to mountpoint
  command: findmnt --fstab '/tmp'
  register: device_name
  failed_when: device_name.rc &gt; 1
  changed_when: false
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_tmp_nodev
    - no_reboot_needed

- name: Create mount_info dictionary variable
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
    - '{{ device_name.stdout_lines[0].split() | list | lower }}'
    - '{{ device_name.stdout_lines[1].split() | list }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - device_name.stdout is defined and device_name.stdout_lines is defined
    - (device_name.stdout | length &gt; 0)
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_tmp_nodev
    - no_reboot_needed

- name: If /tmp not mounted, craft mount_info manually
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
    - - target
      - source
      - fstype
      - options
    - - /tmp
      - ''
      - ''
      - defaults
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - ("--fstab" | length == 0)
    - (device_name.stdout | length == 0)
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_tmp_nodev
    - no_reboot_needed

- name: Make sure nodev option is part of the to /tmp options
  set_fact:
    mount_info: '{{ mount_info | combine( {''options'':''''~mount_info.options~'',nodev''
      }) }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - mount_info is defined and "nodev" not in mount_info.options
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_tmp_nodev
    - no_reboot_needed

- name: Ensure /tmp is mounted with nodev option
  mount:
    path: /tmp
    src: '{{ mount_info.source }}'
    opts: '{{ mount_info.options }}'
    state: mounted
    fstype: '{{ mount_info.fstype }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - (device_name.stdout is defined and (device_name.stdout | length &gt; 0)) or ("--fstab"
      | length == 0)
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_tmp_nodev
    - no_reboot_needed
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="mount_option_tmp_nodev" system="urn:redhat:anaconda:pre" complexity="low" disruption="high" strategy="enable">
part /tmp --mountoptions="nodev"
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-mount_option_tmp_nodev:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-mount_option_tmp_nodev_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_mount_option_nodev_nonroot_local_partitions" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Add nodev Option to Non-Root Local Partitions</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">nodev</html:code> mount option prevents files from being interpreted as
character or block devices. Legitimate character and block devices should
exist only in the <html:code xmlns:html="http://www.w3.org/1999/xhtml">/dev</html:code> directory on the root partition or within
chroot jails built for system services.
Add the <html:code xmlns:html="http://www.w3.org/1999/xhtml">nodev</html:code> option to the fourth column of
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/fstab</html:code> for the line which controls mounting of

    any non-root local partitions.</description>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">MP-7</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.11</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.12</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.3</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.06</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.5.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.6.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.2.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.2.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
          <reference href="https://www.cisecurity.org/controls/">11</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">9</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000368-GPOS-00154</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
          <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R12)</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">nodev</html:code> mount option prevents files from being
interpreted as character or block devices. The only legitimate location
for device files is the <html:code xmlns:html="http://www.w3.org/1999/xhtml">/dev</html:code> directory located on the root partition.
The only exception to this is chroot jails, for which it is not advised
to set <html:code xmlns:html="http://www.w3.org/1999/xhtml">nodev</html:code> on these filesystems.</rationale>
          <platform idref="cpe:/a:machine"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="mount_option_nodev_nonroot_local_partitions" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_include_mount_options_functions" use="legacy"/>
include_mount_options_functions

MOUNT_OPTION="nodev"
# Create array of local non-root partitions
readarray -t partitions_records &lt; &lt;(findmnt --mtab --raw --evaluate | grep "^/\w" | grep "\s/dev/\w")

for partition_record in "${partitions_records[@]}"; do
    # Get all important information for fstab
    mount_point="$(echo ${partition_record} | cut -d " " -f1)"
    device="$(echo ${partition_record} | cut -d " " -f2)"
    device_type="$(echo ${partition_record} | cut -d " " -f3)"
    # device and device_type will be used only in case when the device doesn't have fstab record
    ensure_mount_option_in_fstab "$mount_point" "$MOUNT_OPTION" "$device" "$device_type"
    ensure_partition_is_mounted "$mount_point"
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="mount_option_nodev_nonroot_local_partitions" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="high" strategy="configure">- name: Ensure non-root local partitions are mounted with nodev option
  mount:
    path: '{{ item.mount }}'
    src: '{{ item.device }}'
    opts: '{{ item.options }},nodev'
    state: mounted
    fstype: '{{ item.fstype }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - item.mount is match('/\w')
    - item.options is not search('nodev')
  with_items:
    - '{{ ansible_facts.mounts }}'
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_nodev_nonroot_local_partitions
    - no_reboot_needed
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-mount_option_nodev_nonroot_local_partitions:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-mount_option_nodev_nonroot_local_partitions_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_mount_option_var_log_audit_nodev" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Add nodev Option to /var/log/audit</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">nodev</html:code> mount option can be used to prevent device files from
being created in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/var/log/audit</html:code>.
Legitimate character and block devices should exist only in
the <html:code xmlns:html="http://www.w3.org/1999/xhtml">/dev</html:code> directory on the root partition or within chroot
jails built for system services.
Add the <html:code xmlns:html="http://www.w3.org/1999/xhtml">nodev</html:code> option to the fourth column of
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/fstab</html:code> for the line which controls mounting of
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/var/log/audit</html:code>.</description>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">MP-7</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-2</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000368-GPOS-00154</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-001764</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The only legitimate location for device files is the <html:code xmlns:html="http://www.w3.org/1999/xhtml">/dev</html:code> directory
located on the root partition. The only exception to this is chroot jails.</rationale>
          <platform idref="cpe:/a:machine"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="mount_option_var_log_audit_nodev" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_include_mount_options_functions" use="legacy"/>
include_mount_options_functions

function perform_remediation {
	# test "$mount_has_to_exist" = 'yes'
	if test "yes" = 'yes'; then
		assert_mount_point_in_fstab /var/log/audit || { echo "Not remediating, because there is no record of /var/log/audit in /etc/fstab" &gt;&amp;2; return 1; }
	fi

	ensure_mount_option_in_fstab "/var/log/audit" "nodev" "" ""

	ensure_partition_is_mounted "/var/log/audit"
}

perform_remediation

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="mount_option_var_log_audit_nodev" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="high" strategy="configure">- name: Check information associated to mountpoint
  command: findmnt --fstab '/var/log/audit'
  register: device_name
  failed_when: device_name.rc &gt; 1
  changed_when: false
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_var_log_audit_nodev
    - no_reboot_needed

- name: Create mount_info dictionary variable
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
    - '{{ device_name.stdout_lines[0].split() | list | lower }}'
    - '{{ device_name.stdout_lines[1].split() | list }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - device_name.stdout is defined and device_name.stdout_lines is defined
    - (device_name.stdout | length &gt; 0)
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_var_log_audit_nodev
    - no_reboot_needed

- name: If /var/log/audit not mounted, craft mount_info manually
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
    - - target
      - source
      - fstype
      - options
    - - /var/log/audit
      - ''
      - ''
      - defaults
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - ("--fstab" | length == 0)
    - (device_name.stdout | length == 0)
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_var_log_audit_nodev
    - no_reboot_needed

- name: Make sure nodev option is part of the to /var/log/audit options
  set_fact:
    mount_info: '{{ mount_info | combine( {''options'':''''~mount_info.options~'',nodev''
      }) }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - mount_info is defined and "nodev" not in mount_info.options
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_var_log_audit_nodev
    - no_reboot_needed

- name: Ensure /var/log/audit is mounted with nodev option
  mount:
    path: /var/log/audit
    src: '{{ mount_info.source }}'
    opts: '{{ mount_info.options }}'
    state: mounted
    fstype: '{{ mount_info.fstype }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - (device_name.stdout is defined and (device_name.stdout | length &gt; 0)) or ("--fstab"
      | length == 0)
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_var_log_audit_nodev
    - no_reboot_needed
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="mount_option_var_log_audit_nodev" system="urn:redhat:anaconda:pre" complexity="low" disruption="high" strategy="enable">
part /var/log/audit --mountoptions="nodev"
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-mount_option_var_log_audit_nodev:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-mount_option_var_log_audit_nodev_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_mount_option_boot_noauto" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Add noauto Option to /boot</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">noauto</html:code> mount option is used to prevent automatic mounting of th
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/boot</html:code> partition. 
Add the <html:code xmlns:html="http://www.w3.org/1999/xhtml">noauto</html:code> option to the fourth column of
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/fstab</html:code> for the line which controls mounting of
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/boot</html:code>.</description>
          <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">Although contents of the <html:code xmlns:html="http://www.w3.org/1999/xhtml">/boot</html:code> partition should not be needed
during normal system operation, they might need to be accessible during
system maintenance and upgrades. Make sure that applying this rule will
not break upgrade or maintenance processes affecting the system.</warning>
          <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R12)</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">/boot</html:code> partition contains the kernel and the bootloader. Access
to the partition after the boot process finishes should not be needed. Files
contained within this partition can be analysed and gained information can
be used for exploit creation.</rationale>
          <platform idref="cpe:/a:machine"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="mount_option_boot_noauto" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_include_mount_options_functions" use="legacy"/>
include_mount_options_functions

function perform_remediation {
	# test "$mount_has_to_exist" = 'yes'
	if test "yes" = 'yes'; then
		assert_mount_point_in_fstab /boot || { echo "Not remediating, because there is no record of /boot in /etc/fstab" &gt;&amp;2; return 1; }
	fi

	ensure_mount_option_in_fstab "/boot" "noauto" "" ""

	ensure_partition_is_mounted "/boot"
}

perform_remediation

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="mount_option_boot_noauto" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="high" strategy="configure">- name: Check information associated to mountpoint
  command: findmnt --fstab '/boot'
  register: device_name
  failed_when: device_name.rc &gt; 1
  changed_when: false
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_boot_noauto
    - no_reboot_needed

- name: Create mount_info dictionary variable
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
    - '{{ device_name.stdout_lines[0].split() | list | lower }}'
    - '{{ device_name.stdout_lines[1].split() | list }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - device_name.stdout is defined and device_name.stdout_lines is defined
    - (device_name.stdout | length &gt; 0)
  tags:
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_boot_noauto
    - no_reboot_needed

- name: If /boot not mounted, craft mount_info manually
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
    - - target
      - source
      - fstype
      - options
    - - /boot
      - ''
      - ''
      - defaults
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - ("--fstab" | length == 0)
    - (device_name.stdout | length == 0)
  tags:
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_boot_noauto
    - no_reboot_needed

- name: Make sure noauto option is part of the to /boot options
  set_fact:
    mount_info: '{{ mount_info | combine( {''options'':''''~mount_info.options~'',noauto''
      }) }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - mount_info is defined and "noauto" not in mount_info.options
  tags:
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_boot_noauto
    - no_reboot_needed

- name: Ensure /boot is mounted with noauto option
  mount:
    path: /boot
    src: '{{ mount_info.source }}'
    opts: '{{ mount_info.options }}'
    state: mounted
    fstype: '{{ mount_info.fstype }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - (device_name.stdout is defined and (device_name.stdout | length &gt; 0)) or ("--fstab"
      | length == 0)
  tags:
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_boot_noauto
    - no_reboot_needed
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="mount_option_boot_noauto" system="urn:redhat:anaconda:pre" complexity="low" disruption="high" strategy="enable">
part /boot --mountoptions="noauto"
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-mount_option_boot_noauto:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-mount_option_boot_noauto_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_mount_option_opt_nosuid" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Add nosuid Option to /opt</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">nosuid</html:code> mount option can be used to prevent
execution of setuid programs in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/opt</html:code>. The SUID and SGID permissions
should not be required in this directory.
Add the <html:code xmlns:html="http://www.w3.org/1999/xhtml">nosuid</html:code> option to the fourth column of
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/fstab</html:code> for the line which controls mounting of
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/opt</html:code>.</description>
          <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R12)</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The presence of SUID and SGID executables should be tightly controlled. The
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/opt</html:code> directory contains additional software packages. Users should
not be able to execute SUID or SGID binaries from this directory.</rationale>
          <platform idref="cpe:/a:machine"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="mount_option_opt_nosuid" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_include_mount_options_functions" use="legacy"/>
include_mount_options_functions

function perform_remediation {
	# test "$mount_has_to_exist" = 'yes'
	if test "yes" = 'yes'; then
		assert_mount_point_in_fstab /opt || { echo "Not remediating, because there is no record of /opt in /etc/fstab" &gt;&amp;2; return 1; }
	fi

	ensure_mount_option_in_fstab "/opt" "nosuid" "" ""

	ensure_partition_is_mounted "/opt"
}

perform_remediation

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="mount_option_opt_nosuid" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="high" strategy="configure">- name: Check information associated to mountpoint
  command: findmnt --fstab '/opt'
  register: device_name
  failed_when: device_name.rc &gt; 1
  changed_when: false
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_opt_nosuid
    - no_reboot_needed

- name: Create mount_info dictionary variable
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
    - '{{ device_name.stdout_lines[0].split() | list | lower }}'
    - '{{ device_name.stdout_lines[1].split() | list }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - device_name.stdout is defined and device_name.stdout_lines is defined
    - (device_name.stdout | length &gt; 0)
  tags:
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_opt_nosuid
    - no_reboot_needed

- name: If /opt not mounted, craft mount_info manually
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
    - - target
      - source
      - fstype
      - options
    - - /opt
      - ''
      - ''
      - defaults
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - ("--fstab" | length == 0)
    - (device_name.stdout | length == 0)
  tags:
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_opt_nosuid
    - no_reboot_needed

- name: Make sure nosuid option is part of the to /opt options
  set_fact:
    mount_info: '{{ mount_info | combine( {''options'':''''~mount_info.options~'',nosuid''
      }) }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - mount_info is defined and "nosuid" not in mount_info.options
  tags:
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_opt_nosuid
    - no_reboot_needed

- name: Ensure /opt is mounted with nosuid option
  mount:
    path: /opt
    src: '{{ mount_info.source }}'
    opts: '{{ mount_info.options }}'
    state: mounted
    fstype: '{{ mount_info.fstype }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - (device_name.stdout is defined and (device_name.stdout | length &gt; 0)) or ("--fstab"
      | length == 0)
  tags:
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_opt_nosuid
    - no_reboot_needed
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="mount_option_opt_nosuid" system="urn:redhat:anaconda:pre" complexity="low" disruption="high" strategy="enable">
part /opt --mountoptions="nosuid"
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-mount_option_opt_nosuid:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-mount_option_opt_nosuid_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_mount_option_boot_nosuid" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Add nosuid Option to /boot</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">nosuid</html:code> mount option can be used to prevent
execution of setuid programs in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/boot</html:code>. The SUID and SGID permissions
should not be required on the boot partition.
Add the <html:code xmlns:html="http://www.w3.org/1999/xhtml">nosuid</html:code> option to the fourth column of
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/fstab</html:code> for the line which controls mounting of
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/boot</html:code>.</description>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">MP-7</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-2</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000368-GPOS-00154</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
          <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R12)</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The presence of SUID and SGID executables should be tightly controlled. Users
should not be able to execute SUID or SGID binaries from boot partitions.</rationale>
          <platform idref="cpe:/a:machine"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="mount_option_boot_nosuid" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_include_mount_options_functions" use="legacy"/>
include_mount_options_functions

function perform_remediation {
	# test "$mount_has_to_exist" = 'yes'
	if test "yes" = 'yes'; then
		assert_mount_point_in_fstab /boot || { echo "Not remediating, because there is no record of /boot in /etc/fstab" &gt;&amp;2; return 1; }
	fi

	ensure_mount_option_in_fstab "/boot" "nosuid" "" ""

	ensure_partition_is_mounted "/boot"
}

perform_remediation

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="mount_option_boot_nosuid" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="high" strategy="configure">- name: Check information associated to mountpoint
  command: findmnt --fstab '/boot'
  register: device_name
  failed_when: device_name.rc &gt; 1
  changed_when: false
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_boot_nosuid
    - no_reboot_needed

- name: Create mount_info dictionary variable
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
    - '{{ device_name.stdout_lines[0].split() | list | lower }}'
    - '{{ device_name.stdout_lines[1].split() | list }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - device_name.stdout is defined and device_name.stdout_lines is defined
    - (device_name.stdout | length &gt; 0)
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_boot_nosuid
    - no_reboot_needed

- name: If /boot not mounted, craft mount_info manually
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
    - - target
      - source
      - fstype
      - options
    - - /boot
      - ''
      - ''
      - defaults
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - ("--fstab" | length == 0)
    - (device_name.stdout | length == 0)
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_boot_nosuid
    - no_reboot_needed

- name: Make sure nosuid option is part of the to /boot options
  set_fact:
    mount_info: '{{ mount_info | combine( {''options'':''''~mount_info.options~'',nosuid''
      }) }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - mount_info is defined and "nosuid" not in mount_info.options
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_boot_nosuid
    - no_reboot_needed

- name: Ensure /boot is mounted with nosuid option
  mount:
    path: /boot
    src: '{{ mount_info.source }}'
    opts: '{{ mount_info.options }}'
    state: mounted
    fstype: '{{ mount_info.fstype }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - (device_name.stdout is defined and (device_name.stdout | length &gt; 0)) or ("--fstab"
      | length == 0)
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_boot_nosuid
    - no_reboot_needed
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="mount_option_boot_nosuid" system="urn:redhat:anaconda:pre" complexity="low" disruption="high" strategy="enable">
part /boot --mountoptions="nosuid"
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-mount_option_boot_nosuid:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-mount_option_boot_nosuid_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_mount_option_tmp_nosuid" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Add nosuid Option to /tmp</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">nosuid</html:code> mount option can be used to prevent
execution of setuid programs in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/tmp</html:code>. The SUID and SGID permissions
should not be required in these world-writable directories.
Add the <html:code xmlns:html="http://www.w3.org/1999/xhtml">nosuid</html:code> option to the fourth column of
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/fstab</html:code> for the line which controls mounting of
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/tmp</html:code>.</description>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">MP-7</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-2</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.11</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.12</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.3</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.06</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.06</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.11.2.9</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.5.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.6.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.2.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.2.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.8.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.8.2.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.8.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.8.3.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.8.3.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
          <reference href="https://www.cisecurity.org/controls/">11</reference>
          <reference href="https://www.cisecurity.org/controls/">13</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">8</reference>
          <reference href="https://www.cisecurity.org/controls/">9</reference>
          <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R12)</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000368-GPOS-00154</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-001764</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The presence of SUID and SGID executables should be tightly controlled. Users
should not be able to execute SUID or SGID binaries from temporary storage partitions.</rationale>
          <platform idref="cpe:/a:machine"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="mount_option_tmp_nosuid" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_include_mount_options_functions" use="legacy"/>
include_mount_options_functions

function perform_remediation {
	# test "$mount_has_to_exist" = 'yes'
	if test "yes" = 'yes'; then
		assert_mount_point_in_fstab /tmp || { echo "Not remediating, because there is no record of /tmp in /etc/fstab" &gt;&amp;2; return 1; }
	fi

	ensure_mount_option_in_fstab "/tmp" "nosuid" "" ""

	ensure_partition_is_mounted "/tmp"
}

perform_remediation

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="mount_option_tmp_nosuid" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="high" strategy="configure">- name: Check information associated to mountpoint
  command: findmnt --fstab '/tmp'
  register: device_name
  failed_when: device_name.rc &gt; 1
  changed_when: false
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_tmp_nosuid
    - no_reboot_needed

- name: Create mount_info dictionary variable
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
    - '{{ device_name.stdout_lines[0].split() | list | lower }}'
    - '{{ device_name.stdout_lines[1].split() | list }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - device_name.stdout is defined and device_name.stdout_lines is defined
    - (device_name.stdout | length &gt; 0)
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_tmp_nosuid
    - no_reboot_needed

- name: If /tmp not mounted, craft mount_info manually
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
    - - target
      - source
      - fstype
      - options
    - - /tmp
      - ''
      - ''
      - defaults
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - ("--fstab" | length == 0)
    - (device_name.stdout | length == 0)
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_tmp_nosuid
    - no_reboot_needed

- name: Make sure nosuid option is part of the to /tmp options
  set_fact:
    mount_info: '{{ mount_info | combine( {''options'':''''~mount_info.options~'',nosuid''
      }) }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - mount_info is defined and "nosuid" not in mount_info.options
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_tmp_nosuid
    - no_reboot_needed

- name: Ensure /tmp is mounted with nosuid option
  mount:
    path: /tmp
    src: '{{ mount_info.source }}'
    opts: '{{ mount_info.options }}'
    state: mounted
    fstype: '{{ mount_info.fstype }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - (device_name.stdout is defined and (device_name.stdout | length &gt; 0)) or ("--fstab"
      | length == 0)
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_tmp_nosuid
    - no_reboot_needed
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="mount_option_tmp_nosuid" system="urn:redhat:anaconda:pre" complexity="low" disruption="high" strategy="enable">
part /tmp --mountoptions="nosuid"
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-mount_option_tmp_nosuid:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-mount_option_tmp_nosuid_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_mount_option_var_log_audit_noexec" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Add noexec Option to /var/log/audit</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">noexec</html:code> mount option can be used to prevent binaries
from being executed out of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/var/log/audit</html:code>.
Add the <html:code xmlns:html="http://www.w3.org/1999/xhtml">noexec</html:code> option to the fourth column of
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/fstab</html:code> for the line which controls mounting of
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/var/log/audit</html:code>.</description>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">MP-7</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-2</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000368-GPOS-00154</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-001764</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Allowing users to execute binaries from directories containing audit log files
such as <html:code xmlns:html="http://www.w3.org/1999/xhtml">/var/log/audit</html:code> should never be necessary in normal operation and
can expose the system to potential compromise.</rationale>
          <platform idref="cpe:/a:machine"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="mount_option_var_log_audit_noexec" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_include_mount_options_functions" use="legacy"/>
include_mount_options_functions

function perform_remediation {
	# test "$mount_has_to_exist" = 'yes'
	if test "yes" = 'yes'; then
		assert_mount_point_in_fstab /var/log/audit || { echo "Not remediating, because there is no record of /var/log/audit in /etc/fstab" &gt;&amp;2; return 1; }
	fi

	ensure_mount_option_in_fstab "/var/log/audit" "noexec" "" ""

	ensure_partition_is_mounted "/var/log/audit"
}

perform_remediation

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="mount_option_var_log_audit_noexec" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="high" strategy="configure">- name: Check information associated to mountpoint
  command: findmnt --fstab '/var/log/audit'
  register: device_name
  failed_when: device_name.rc &gt; 1
  changed_when: false
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_var_log_audit_noexec
    - no_reboot_needed

- name: Create mount_info dictionary variable
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
    - '{{ device_name.stdout_lines[0].split() | list | lower }}'
    - '{{ device_name.stdout_lines[1].split() | list }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - device_name.stdout is defined and device_name.stdout_lines is defined
    - (device_name.stdout | length &gt; 0)
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_var_log_audit_noexec
    - no_reboot_needed

- name: If /var/log/audit not mounted, craft mount_info manually
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
    - - target
      - source
      - fstype
      - options
    - - /var/log/audit
      - ''
      - ''
      - defaults
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - ("--fstab" | length == 0)
    - (device_name.stdout | length == 0)
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_var_log_audit_noexec
    - no_reboot_needed

- name: Make sure noexec option is part of the to /var/log/audit options
  set_fact:
    mount_info: '{{ mount_info | combine( {''options'':''''~mount_info.options~'',noexec''
      }) }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - mount_info is defined and "noexec" not in mount_info.options
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_var_log_audit_noexec
    - no_reboot_needed

- name: Ensure /var/log/audit is mounted with noexec option
  mount:
    path: /var/log/audit
    src: '{{ mount_info.source }}'
    opts: '{{ mount_info.options }}'
    state: mounted
    fstype: '{{ mount_info.fstype }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - (device_name.stdout is defined and (device_name.stdout | length &gt; 0)) or ("--fstab"
      | length == 0)
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_var_log_audit_noexec
    - no_reboot_needed
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="mount_option_var_log_audit_noexec" system="urn:redhat:anaconda:pre" complexity="low" disruption="high" strategy="enable">
part /var/log/audit --mountoptions="noexec"
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-mount_option_var_log_audit_noexec:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-mount_option_var_log_audit_noexec_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_mount_option_dev_shm_nosuid" selected="false" role="full" severity="low">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Add nosuid Option to /dev/shm</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">nosuid</html:code> mount option can be used to prevent execution
of setuid programs in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/dev/shm</html:code>.  The SUID and SGID permissions should not
be required in these world-writable directories.
Add the <html:code xmlns:html="http://www.w3.org/1999/xhtml">nosuid</html:code> option to the fourth column of
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/fstab</html:code> for the line which controls mounting of
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/dev/shm</html:code>.</description>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-001764</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">MP-7</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-2</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.11</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.12</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.3</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.06</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.06</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.11.2.9</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.5.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.6.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.2.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.2.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.8.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.8.2.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.8.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.8.3.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.8.3.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
          <reference href="https://www.cisecurity.org/controls/">11</reference>
          <reference href="https://www.cisecurity.org/controls/">13</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">8</reference>
          <reference href="https://www.cisecurity.org/controls/">9</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000368-GPOS-00154</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The presence of SUID and SGID executables should be tightly controlled. Users
should not be able to execute SUID or SGID binaries from temporary storage partitions.</rationale>
          <platform idref="cpe:/a:machine"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="mount_option_dev_shm_nosuid" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_include_mount_options_functions" use="legacy"/>
include_mount_options_functions

function perform_remediation {
	# test "$mount_has_to_exist" = 'yes'
	if test "no" = 'yes'; then
		assert_mount_point_in_fstab /dev/shm || { echo "Not remediating, because there is no record of /dev/shm in /etc/fstab" &gt;&amp;2; return 1; }
	fi

	ensure_mount_option_in_fstab "/dev/shm" "nosuid" "tmpfs" "tmpfs"

	ensure_partition_is_mounted "/dev/shm"
}

perform_remediation

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="mount_option_dev_shm_nosuid" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="high" strategy="configure">- name: Check information associated to mountpoint
  command: findmnt  '/dev/shm'
  register: device_name
  failed_when: device_name.rc &gt; 1
  changed_when: false
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - low_severity
    - mount_option_dev_shm_nosuid
    - no_reboot_needed

- name: Create mount_info dictionary variable
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
    - '{{ device_name.stdout_lines[0].split() | list | lower }}'
    - '{{ device_name.stdout_lines[1].split() | list }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - device_name.stdout is defined and device_name.stdout_lines is defined
    - (device_name.stdout | length &gt; 0)
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - low_severity
    - mount_option_dev_shm_nosuid
    - no_reboot_needed

- name: If /dev/shm not mounted, craft mount_info manually
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
    - - target
      - source
      - fstype
      - options
    - - /dev/shm
      - tmpfs
      - tmpfs
      - defaults
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - ("" | length == 0)
    - (device_name.stdout | length == 0)
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - low_severity
    - mount_option_dev_shm_nosuid
    - no_reboot_needed

- name: Make sure nosuid option is part of the to /dev/shm options
  set_fact:
    mount_info: '{{ mount_info | combine( {''options'':''''~mount_info.options~'',nosuid''
      }) }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - mount_info is defined and "nosuid" not in mount_info.options
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - low_severity
    - mount_option_dev_shm_nosuid
    - no_reboot_needed

- name: Ensure /dev/shm is mounted with nosuid option
  mount:
    path: /dev/shm
    src: '{{ mount_info.source }}'
    opts: '{{ mount_info.options }}'
    state: mounted
    fstype: '{{ mount_info.fstype }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - (device_name.stdout is defined and (device_name.stdout | length &gt; 0)) or (""
      | length == 0)
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - low_severity
    - mount_option_dev_shm_nosuid
    - no_reboot_needed
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-mount_option_dev_shm_nosuid:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-mount_option_dev_shm_nosuid_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_mount_option_tmp_noexec" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Add noexec Option to /tmp</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">noexec</html:code> mount option can be used to prevent binaries
from being executed out of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/tmp</html:code>.
Add the <html:code xmlns:html="http://www.w3.org/1999/xhtml">noexec</html:code> option to the fourth column of
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/fstab</html:code> for the line which controls mounting of
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/tmp</html:code>.</description>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">MP-7</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-2</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.11</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.12</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.3</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.06</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.06</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.11.2.9</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.5.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.6.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.2.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.2.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.8.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.8.2.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.8.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.8.3.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.8.3.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
          <reference href="https://www.cisecurity.org/controls/">11</reference>
          <reference href="https://www.cisecurity.org/controls/">13</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">8</reference>
          <reference href="https://www.cisecurity.org/controls/">9</reference>
          <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R12)</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000368-GPOS-00154</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-001764</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Allowing users to execute binaries from world-writable directories
such as <html:code xmlns:html="http://www.w3.org/1999/xhtml">/tmp</html:code> should never be necessary in normal operation and
can expose the system to potential compromise.</rationale>
          <platform idref="cpe:/a:machine"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="mount_option_tmp_noexec" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_include_mount_options_functions" use="legacy"/>
include_mount_options_functions

function perform_remediation {
	# test "$mount_has_to_exist" = 'yes'
	if test "yes" = 'yes'; then
		assert_mount_point_in_fstab /tmp || { echo "Not remediating, because there is no record of /tmp in /etc/fstab" &gt;&amp;2; return 1; }
	fi

	ensure_mount_option_in_fstab "/tmp" "noexec" "" ""

	ensure_partition_is_mounted "/tmp"
}

perform_remediation

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="mount_option_tmp_noexec" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="high" strategy="configure">- name: Check information associated to mountpoint
  command: findmnt --fstab '/tmp'
  register: device_name
  failed_when: device_name.rc &gt; 1
  changed_when: false
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_tmp_noexec
    - no_reboot_needed

- name: Create mount_info dictionary variable
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
    - '{{ device_name.stdout_lines[0].split() | list | lower }}'
    - '{{ device_name.stdout_lines[1].split() | list }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - device_name.stdout is defined and device_name.stdout_lines is defined
    - (device_name.stdout | length &gt; 0)
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_tmp_noexec
    - no_reboot_needed

- name: If /tmp not mounted, craft mount_info manually
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
    - - target
      - source
      - fstype
      - options
    - - /tmp
      - ''
      - ''
      - defaults
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - ("--fstab" | length == 0)
    - (device_name.stdout | length == 0)
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_tmp_noexec
    - no_reboot_needed

- name: Make sure noexec option is part of the to /tmp options
  set_fact:
    mount_info: '{{ mount_info | combine( {''options'':''''~mount_info.options~'',noexec''
      }) }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - mount_info is defined and "noexec" not in mount_info.options
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_tmp_noexec
    - no_reboot_needed

- name: Ensure /tmp is mounted with noexec option
  mount:
    path: /tmp
    src: '{{ mount_info.source }}'
    opts: '{{ mount_info.options }}'
    state: mounted
    fstype: '{{ mount_info.fstype }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - (device_name.stdout is defined and (device_name.stdout | length &gt; 0)) or ("--fstab"
      | length == 0)
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_tmp_noexec
    - no_reboot_needed
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="mount_option_tmp_noexec" system="urn:redhat:anaconda:pre" complexity="low" disruption="high" strategy="enable">
part /tmp --mountoptions="noexec"
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-mount_option_tmp_noexec:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-mount_option_tmp_noexec_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_mount_option_nodev_removable_partitions" selected="false" role="full" severity="low">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Add nodev Option to Removable Media Partitions</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">nodev</html:code> mount option prevents files from being
interpreted as character or block devices.
Legitimate character and block devices should exist only in
the <html:code xmlns:html="http://www.w3.org/1999/xhtml">/dev</html:code> directory on the root partition or within chroot
jails built for system services.
Add the <html:code xmlns:html="http://www.w3.org/1999/xhtml">nodev</html:code> option to the fourth column of
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/fstab</html:code> for the line which controls mounting of

    any removable media partitions.</description>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">MP-7</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-2</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.11</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.12</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.2.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.3</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS01.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.06</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.06</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.11.2.6</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.11.2.9</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.5.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.6.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.2.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.2.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.6.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.6.2.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.7.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.8.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.8.2.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.8.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.8.3.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.8.3.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.1</reference>
          <reference href="https://www.cisecurity.org/controls/">11</reference>
          <reference href="https://www.cisecurity.org/controls/">12</reference>
          <reference href="https://www.cisecurity.org/controls/">13</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">16</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">8</reference>
          <reference href="https://www.cisecurity.org/controls/">9</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The only legitimate location for device files is the <html:code xmlns:html="http://www.w3.org/1999/xhtml">/dev</html:code> directory
located on the root partition. An exception to this is chroot jails, and it is
not advised to set <html:code xmlns:html="http://www.w3.org/1999/xhtml">nodev</html:code> on partitions which contain their root
filesystems.</rationale>
          <platform idref="cpe:/a:machine"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="mount_option_nodev_removable_partitions" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then


var_removable_partition="<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_removable_partition" use="legacy"/>"



device_regex="^\s*$var_removable_partition\s\+"
mount_option="nodev"

if grep -q $device_regex /etc/fstab ; then
    previous_opts=$(grep $device_regex /etc/fstab | awk '{print $4}')
    sed -i "s|\($device_regex.*$previous_opts\)|\1,$mount_option|" /etc/fstab
else
    echo "Not remediating, because there is no record of $var_removable_partition in /etc/fstab" &gt;&amp;2
    return 1
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="mount_option_nodev_removable_partitions" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="high" strategy="configure">- name: XCCDF Value var_removable_partition # promote to variable
  set_fact:
    var_removable_partition: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_removable_partition" use="legacy"/>
  tags:
    - always

- name: Ensure permission nodev are set on var_removable_partition
  lineinfile:
    path: /etc/fstab
    regexp: ^\s*({{ var_removable_partition }})\s+([^\s]*)\s+([^\s]*)\s+([^\s]*)(.*)$
    backrefs: true
    line: \1 \2 \3 \4,nodev \5
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - low_severity
    - mount_option_nodev_removable_partitions
    - no_reboot_needed
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export export-name="oval:ssg-var_removable_partition:var:1" value-id="xccdf_org.ssgproject.content_value_var_removable_partition"/>
            <check-content-ref name="oval:ssg-mount_option_nodev_removable_partitions:def:1" href="ssg-fedora-oval.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_mount_option_var_nosuid" selected="false" role="full" severity="unknown">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Add nosuid Option to /var</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">nosuid</html:code> mount option can be used to prevent
execution of setuid programs in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/var</html:code>. The SUID and SGID permissions
should not be required for this directory.
Add the <html:code xmlns:html="http://www.w3.org/1999/xhtml">nosuid</html:code> option to the fourth column of
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/fstab</html:code> for the line which controls mounting of
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/var</html:code>.</description>
          <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R12)</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The presence of SUID and SGID executables should be tightly controlled.</rationale>
          <platform idref="cpe:/a:machine"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="mount_option_var_nosuid" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_include_mount_options_functions" use="legacy"/>
include_mount_options_functions

function perform_remediation {
	# test "$mount_has_to_exist" = 'yes'
	if test "yes" = 'yes'; then
		assert_mount_point_in_fstab /var || { echo "Not remediating, because there is no record of /var in /etc/fstab" &gt;&amp;2; return 1; }
	fi

	ensure_mount_option_in_fstab "/var" "nosuid" "" ""

	ensure_partition_is_mounted "/var"
}

perform_remediation

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="mount_option_var_nosuid" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="high" strategy="configure">- name: Check information associated to mountpoint
  command: findmnt --fstab '/var'
  register: device_name
  failed_when: device_name.rc &gt; 1
  changed_when: false
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - configure_strategy
    - high_disruption
    - low_complexity
    - mount_option_var_nosuid
    - no_reboot_needed
    - unknown_severity

- name: Create mount_info dictionary variable
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
    - '{{ device_name.stdout_lines[0].split() | list | lower }}'
    - '{{ device_name.stdout_lines[1].split() | list }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - device_name.stdout is defined and device_name.stdout_lines is defined
    - (device_name.stdout | length &gt; 0)
  tags:
    - configure_strategy
    - high_disruption
    - low_complexity
    - mount_option_var_nosuid
    - no_reboot_needed
    - unknown_severity

- name: If /var not mounted, craft mount_info manually
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
    - - target
      - source
      - fstype
      - options
    - - /var
      - ''
      - ''
      - defaults
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - ("--fstab" | length == 0)
    - (device_name.stdout | length == 0)
  tags:
    - configure_strategy
    - high_disruption
    - low_complexity
    - mount_option_var_nosuid
    - no_reboot_needed
    - unknown_severity

- name: Make sure nosuid option is part of the to /var options
  set_fact:
    mount_info: '{{ mount_info | combine( {''options'':''''~mount_info.options~'',nosuid''
      }) }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - mount_info is defined and "nosuid" not in mount_info.options
  tags:
    - configure_strategy
    - high_disruption
    - low_complexity
    - mount_option_var_nosuid
    - no_reboot_needed
    - unknown_severity

- name: Ensure /var is mounted with nosuid option
  mount:
    path: /var
    src: '{{ mount_info.source }}'
    opts: '{{ mount_info.options }}'
    state: mounted
    fstype: '{{ mount_info.fstype }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - (device_name.stdout is defined and (device_name.stdout | length &gt; 0)) or ("--fstab"
      | length == 0)
  tags:
    - configure_strategy
    - high_disruption
    - low_complexity
    - mount_option_var_nosuid
    - no_reboot_needed
    - unknown_severity
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="mount_option_var_nosuid" system="urn:redhat:anaconda:pre" complexity="low" disruption="high" strategy="enable">
part /var --mountoptions="nosuid"
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-mount_option_var_nosuid:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-mount_option_var_nosuid_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_mount_option_var_log_nodev" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Add nodev Option to /var/log</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">nodev</html:code> mount option can be used to prevent device files from
being created in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/var/log</html:code>.
Legitimate character and block devices should exist only in
the <html:code xmlns:html="http://www.w3.org/1999/xhtml">/dev</html:code> directory on the root partition or within chroot
jails built for system services.
Add the <html:code xmlns:html="http://www.w3.org/1999/xhtml">nodev</html:code> option to the fourth column of
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/fstab</html:code> for the line which controls mounting of
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/var/log</html:code>.</description>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">MP-7</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-2</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000368-GPOS-00154</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-001764</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The only legitimate location for device files is the <html:code xmlns:html="http://www.w3.org/1999/xhtml">/dev</html:code> directory
located on the root partition. The only exception to this is chroot jails.</rationale>
          <platform idref="cpe:/a:machine"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="mount_option_var_log_nodev" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_include_mount_options_functions" use="legacy"/>
include_mount_options_functions

function perform_remediation {
	# test "$mount_has_to_exist" = 'yes'
	if test "yes" = 'yes'; then
		assert_mount_point_in_fstab /var/log || { echo "Not remediating, because there is no record of /var/log in /etc/fstab" &gt;&amp;2; return 1; }
	fi

	ensure_mount_option_in_fstab "/var/log" "nodev" "" ""

	ensure_partition_is_mounted "/var/log"
}

perform_remediation

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="mount_option_var_log_nodev" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="high" strategy="configure">- name: Check information associated to mountpoint
  command: findmnt --fstab '/var/log'
  register: device_name
  failed_when: device_name.rc &gt; 1
  changed_when: false
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_var_log_nodev
    - no_reboot_needed

- name: Create mount_info dictionary variable
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
    - '{{ device_name.stdout_lines[0].split() | list | lower }}'
    - '{{ device_name.stdout_lines[1].split() | list }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - device_name.stdout is defined and device_name.stdout_lines is defined
    - (device_name.stdout | length &gt; 0)
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_var_log_nodev
    - no_reboot_needed

- name: If /var/log not mounted, craft mount_info manually
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
    - - target
      - source
      - fstype
      - options
    - - /var/log
      - ''
      - ''
      - defaults
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - ("--fstab" | length == 0)
    - (device_name.stdout | length == 0)
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_var_log_nodev
    - no_reboot_needed

- name: Make sure nodev option is part of the to /var/log options
  set_fact:
    mount_info: '{{ mount_info | combine( {''options'':''''~mount_info.options~'',nodev''
      }) }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - mount_info is defined and "nodev" not in mount_info.options
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_var_log_nodev
    - no_reboot_needed

- name: Ensure /var/log is mounted with nodev option
  mount:
    path: /var/log
    src: '{{ mount_info.source }}'
    opts: '{{ mount_info.options }}'
    state: mounted
    fstype: '{{ mount_info.fstype }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - (device_name.stdout is defined and (device_name.stdout | length &gt; 0)) or ("--fstab"
      | length == 0)
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_var_log_nodev
    - no_reboot_needed
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="mount_option_var_log_nodev" system="urn:redhat:anaconda:pre" complexity="low" disruption="high" strategy="enable">
part /var/log --mountoptions="nodev"
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-mount_option_var_log_nodev:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-mount_option_var_log_nodev_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_mount_option_var_nodev" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Add nodev Option to /var</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">nodev</html:code> mount option can be used to prevent device files from
being created in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/var</html:code>.
Legitimate character and block devices should exist only in
the <html:code xmlns:html="http://www.w3.org/1999/xhtml">/dev</html:code> directory on the root partition or within chroot
jails built for system services.
Add the <html:code xmlns:html="http://www.w3.org/1999/xhtml">nodev</html:code> option to the fourth column of
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/fstab</html:code> for the line which controls mounting of
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/var</html:code>.</description>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">MP-7</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-2</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000368-GPOS-00154</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The only legitimate location for device files is the <html:code xmlns:html="http://www.w3.org/1999/xhtml">/dev</html:code> directory
located on the root partition. The only exception to this is chroot jails.</rationale>
          <platform idref="cpe:/a:machine"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="mount_option_var_nodev" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_include_mount_options_functions" use="legacy"/>
include_mount_options_functions

function perform_remediation {
	# test "$mount_has_to_exist" = 'yes'
	if test "yes" = 'yes'; then
		assert_mount_point_in_fstab /var || { echo "Not remediating, because there is no record of /var in /etc/fstab" &gt;&amp;2; return 1; }
	fi

	ensure_mount_option_in_fstab "/var" "nodev" "" ""

	ensure_partition_is_mounted "/var"
}

perform_remediation

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="mount_option_var_nodev" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="high" strategy="configure">- name: Check information associated to mountpoint
  command: findmnt --fstab '/var'
  register: device_name
  failed_when: device_name.rc &gt; 1
  changed_when: false
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_var_nodev
    - no_reboot_needed

- name: Create mount_info dictionary variable
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
    - '{{ device_name.stdout_lines[0].split() | list | lower }}'
    - '{{ device_name.stdout_lines[1].split() | list }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - device_name.stdout is defined and device_name.stdout_lines is defined
    - (device_name.stdout | length &gt; 0)
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_var_nodev
    - no_reboot_needed

- name: If /var not mounted, craft mount_info manually
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
    - - target
      - source
      - fstype
      - options
    - - /var
      - ''
      - ''
      - defaults
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - ("--fstab" | length == 0)
    - (device_name.stdout | length == 0)
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_var_nodev
    - no_reboot_needed

- name: Make sure nodev option is part of the to /var options
  set_fact:
    mount_info: '{{ mount_info | combine( {''options'':''''~mount_info.options~'',nodev''
      }) }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - mount_info is defined and "nodev" not in mount_info.options
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_var_nodev
    - no_reboot_needed

- name: Ensure /var is mounted with nodev option
  mount:
    path: /var
    src: '{{ mount_info.source }}'
    opts: '{{ mount_info.options }}'
    state: mounted
    fstype: '{{ mount_info.fstype }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - (device_name.stdout is defined and (device_name.stdout | length &gt; 0)) or ("--fstab"
      | length == 0)
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_var_nodev
    - no_reboot_needed
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="mount_option_var_nodev" system="urn:redhat:anaconda:pre" complexity="low" disruption="high" strategy="enable">
part /var --mountoptions="nodev"
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-mount_option_var_nodev:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-mount_option_var_nodev_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_mount_option_boot_noexec" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Add noexec Option to /boot</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">noexec</html:code> mount option can be used to prevent binaries from being
executed out of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/boot</html:code>. 
Add the <html:code xmlns:html="http://www.w3.org/1999/xhtml">noexec</html:code> option to the fourth column of
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/fstab</html:code> for the line which controls mounting of
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/boot</html:code>.</description>
          <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R12)</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">/boot</html:code> partition contains the kernel and the bootloader. No
binaries should be executed from this partition after the booting process
finishes.</rationale>
          <platform idref="cpe:/a:machine"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="mount_option_boot_noexec" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_include_mount_options_functions" use="legacy"/>
include_mount_options_functions

function perform_remediation {
	# test "$mount_has_to_exist" = 'yes'
	if test "yes" = 'yes'; then
		assert_mount_point_in_fstab /boot || { echo "Not remediating, because there is no record of /boot in /etc/fstab" &gt;&amp;2; return 1; }
	fi

	ensure_mount_option_in_fstab "/boot" "noexec" "" ""

	ensure_partition_is_mounted "/boot"
}

perform_remediation

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="mount_option_boot_noexec" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="high" strategy="configure">- name: Check information associated to mountpoint
  command: findmnt --fstab '/boot'
  register: device_name
  failed_when: device_name.rc &gt; 1
  changed_when: false
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_boot_noexec
    - no_reboot_needed

- name: Create mount_info dictionary variable
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
    - '{{ device_name.stdout_lines[0].split() | list | lower }}'
    - '{{ device_name.stdout_lines[1].split() | list }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - device_name.stdout is defined and device_name.stdout_lines is defined
    - (device_name.stdout | length &gt; 0)
  tags:
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_boot_noexec
    - no_reboot_needed

- name: If /boot not mounted, craft mount_info manually
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
    - - target
      - source
      - fstype
      - options
    - - /boot
      - ''
      - ''
      - defaults
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - ("--fstab" | length == 0)
    - (device_name.stdout | length == 0)
  tags:
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_boot_noexec
    - no_reboot_needed

- name: Make sure noexec option is part of the to /boot options
  set_fact:
    mount_info: '{{ mount_info | combine( {''options'':''''~mount_info.options~'',noexec''
      }) }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - mount_info is defined and "noexec" not in mount_info.options
  tags:
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_boot_noexec
    - no_reboot_needed

- name: Ensure /boot is mounted with noexec option
  mount:
    path: /boot
    src: '{{ mount_info.source }}'
    opts: '{{ mount_info.options }}'
    state: mounted
    fstype: '{{ mount_info.fstype }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - (device_name.stdout is defined and (device_name.stdout | length &gt; 0)) or ("--fstab"
      | length == 0)
  tags:
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_boot_noexec
    - no_reboot_needed
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="mount_option_boot_noexec" system="urn:redhat:anaconda:pre" complexity="low" disruption="high" strategy="enable">
part /boot --mountoptions="noexec"
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-mount_option_boot_noexec:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-mount_option_boot_noexec_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_mount_option_home_noexec" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Add noexec Option to /home</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">noexec</html:code> mount option can be used to prevent binaries from being
executed out of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/home</html:code>. 
Add the <html:code xmlns:html="http://www.w3.org/1999/xhtml">noexec</html:code> option to the fourth column of
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/fstab</html:code> for the line which controls mounting of
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/home</html:code>.</description>
          <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R12)</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">/home</html:code> directory contains data of individual users. Binaries in
this directory should not be considered as trusted and users should not be
able to execute them.</rationale>
          <platform idref="cpe:/a:machine"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="mount_option_home_noexec" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_include_mount_options_functions" use="legacy"/>
include_mount_options_functions

function perform_remediation {
	# test "$mount_has_to_exist" = 'yes'
	if test "yes" = 'yes'; then
		assert_mount_point_in_fstab /home || { echo "Not remediating, because there is no record of /home in /etc/fstab" &gt;&amp;2; return 1; }
	fi

	ensure_mount_option_in_fstab "/home" "noexec" "" ""

	ensure_partition_is_mounted "/home"
}

perform_remediation

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="mount_option_home_noexec" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="high" strategy="configure">- name: Check information associated to mountpoint
  command: findmnt --fstab '/home'
  register: device_name
  failed_when: device_name.rc &gt; 1
  changed_when: false
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_home_noexec
    - no_reboot_needed

- name: Create mount_info dictionary variable
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
    - '{{ device_name.stdout_lines[0].split() | list | lower }}'
    - '{{ device_name.stdout_lines[1].split() | list }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - device_name.stdout is defined and device_name.stdout_lines is defined
    - (device_name.stdout | length &gt; 0)
  tags:
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_home_noexec
    - no_reboot_needed

- name: If /home not mounted, craft mount_info manually
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
    - - target
      - source
      - fstype
      - options
    - - /home
      - ''
      - ''
      - defaults
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - ("--fstab" | length == 0)
    - (device_name.stdout | length == 0)
  tags:
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_home_noexec
    - no_reboot_needed

- name: Make sure noexec option is part of the to /home options
  set_fact:
    mount_info: '{{ mount_info | combine( {''options'':''''~mount_info.options~'',noexec''
      }) }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - mount_info is defined and "noexec" not in mount_info.options
  tags:
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_home_noexec
    - no_reboot_needed

- name: Ensure /home is mounted with noexec option
  mount:
    path: /home
    src: '{{ mount_info.source }}'
    opts: '{{ mount_info.options }}'
    state: mounted
    fstype: '{{ mount_info.fstype }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - (device_name.stdout is defined and (device_name.stdout | length &gt; 0)) or ("--fstab"
      | length == 0)
  tags:
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_home_noexec
    - no_reboot_needed
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="mount_option_home_noexec" system="urn:redhat:anaconda:pre" complexity="low" disruption="high" strategy="enable">
part /home --mountoptions="noexec"
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-mount_option_home_noexec:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-mount_option_home_noexec_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_mount_option_var_noexec" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Add noexec Option to /var</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">noexec</html:code> mount option can be used to prevent binaries from being
executed out of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/var</html:code>. 
Add the <html:code xmlns:html="http://www.w3.org/1999/xhtml">noexec</html:code> option to the fourth column of
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/fstab</html:code> for the line which controls mounting of
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/var</html:code>.</description>
          <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R12)</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">/var</html:code> directory contains variable system data such as logs,
mails and caches. No binaries should be executed from this directory.</rationale>
          <platform idref="cpe:/a:machine"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="mount_option_var_noexec" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_include_mount_options_functions" use="legacy"/>
include_mount_options_functions

function perform_remediation {
	# test "$mount_has_to_exist" = 'yes'
	if test "yes" = 'yes'; then
		assert_mount_point_in_fstab /var || { echo "Not remediating, because there is no record of /var in /etc/fstab" &gt;&amp;2; return 1; }
	fi

	ensure_mount_option_in_fstab "/var" "noexec" "" ""

	ensure_partition_is_mounted "/var"
}

perform_remediation

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="mount_option_var_noexec" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="high" strategy="configure">- name: Check information associated to mountpoint
  command: findmnt --fstab '/var'
  register: device_name
  failed_when: device_name.rc &gt; 1
  changed_when: false
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_var_noexec
    - no_reboot_needed

- name: Create mount_info dictionary variable
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
    - '{{ device_name.stdout_lines[0].split() | list | lower }}'
    - '{{ device_name.stdout_lines[1].split() | list }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - device_name.stdout is defined and device_name.stdout_lines is defined
    - (device_name.stdout | length &gt; 0)
  tags:
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_var_noexec
    - no_reboot_needed

- name: If /var not mounted, craft mount_info manually
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
    - - target
      - source
      - fstype
      - options
    - - /var
      - ''
      - ''
      - defaults
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - ("--fstab" | length == 0)
    - (device_name.stdout | length == 0)
  tags:
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_var_noexec
    - no_reboot_needed

- name: Make sure noexec option is part of the to /var options
  set_fact:
    mount_info: '{{ mount_info | combine( {''options'':''''~mount_info.options~'',noexec''
      }) }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - mount_info is defined and "noexec" not in mount_info.options
  tags:
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_var_noexec
    - no_reboot_needed

- name: Ensure /var is mounted with noexec option
  mount:
    path: /var
    src: '{{ mount_info.source }}'
    opts: '{{ mount_info.options }}'
    state: mounted
    fstype: '{{ mount_info.fstype }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - (device_name.stdout is defined and (device_name.stdout | length &gt; 0)) or ("--fstab"
      | length == 0)
  tags:
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_var_noexec
    - no_reboot_needed
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="mount_option_var_noexec" system="urn:redhat:anaconda:pre" complexity="low" disruption="high" strategy="enable">
part /var --mountoptions="noexec"
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-mount_option_var_noexec:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-mount_option_var_noexec_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_mount_option_boot_nodev" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Add nodev Option to /boot</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">nodev</html:code> mount option can be used to prevent device files from
being created in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/boot</html:code>.
Legitimate character and block devices should exist only in
the <html:code xmlns:html="http://www.w3.org/1999/xhtml">/dev</html:code> directory on the root partition or within chroot
jails built for system services.
Add the <html:code xmlns:html="http://www.w3.org/1999/xhtml">nodev</html:code> option to the fourth column of
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/fstab</html:code> for the line which controls mounting of
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/boot</html:code>.</description>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">MP-7</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-2</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000368-GPOS-00154</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The only legitimate location for device files is the <html:code xmlns:html="http://www.w3.org/1999/xhtml">/dev</html:code> directory
located on the root partition. The only exception to this is chroot jails.</rationale>
          <platform idref="cpe:/a:machine"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="mount_option_boot_nodev" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_include_mount_options_functions" use="legacy"/>
include_mount_options_functions

function perform_remediation {
	# test "$mount_has_to_exist" = 'yes'
	if test "yes" = 'yes'; then
		assert_mount_point_in_fstab /boot || { echo "Not remediating, because there is no record of /boot in /etc/fstab" &gt;&amp;2; return 1; }
	fi

	ensure_mount_option_in_fstab "/boot" "nodev" "" ""

	ensure_partition_is_mounted "/boot"
}

perform_remediation

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="mount_option_boot_nodev" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="high" strategy="configure">- name: Check information associated to mountpoint
  command: findmnt --fstab '/boot'
  register: device_name
  failed_when: device_name.rc &gt; 1
  changed_when: false
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_boot_nodev
    - no_reboot_needed

- name: Create mount_info dictionary variable
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
    - '{{ device_name.stdout_lines[0].split() | list | lower }}'
    - '{{ device_name.stdout_lines[1].split() | list }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - device_name.stdout is defined and device_name.stdout_lines is defined
    - (device_name.stdout | length &gt; 0)
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_boot_nodev
    - no_reboot_needed

- name: If /boot not mounted, craft mount_info manually
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
    - - target
      - source
      - fstype
      - options
    - - /boot
      - ''
      - ''
      - defaults
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - ("--fstab" | length == 0)
    - (device_name.stdout | length == 0)
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_boot_nodev
    - no_reboot_needed

- name: Make sure nodev option is part of the to /boot options
  set_fact:
    mount_info: '{{ mount_info | combine( {''options'':''''~mount_info.options~'',nodev''
      }) }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - mount_info is defined and "nodev" not in mount_info.options
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_boot_nodev
    - no_reboot_needed

- name: Ensure /boot is mounted with nodev option
  mount:
    path: /boot
    src: '{{ mount_info.source }}'
    opts: '{{ mount_info.options }}'
    state: mounted
    fstype: '{{ mount_info.fstype }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - (device_name.stdout is defined and (device_name.stdout | length &gt; 0)) or ("--fstab"
      | length == 0)
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_boot_nodev
    - no_reboot_needed
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="mount_option_boot_nodev" system="urn:redhat:anaconda:pre" complexity="low" disruption="high" strategy="enable">
part /boot --mountoptions="nodev"
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-mount_option_boot_nodev:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-mount_option_boot_nodev_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_mount_option_srv_nosuid" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Add nosuid Option to /srv</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">nosuid</html:code> mount option can be used to prevent
execution of setuid programs in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/srv</html:code>. The SUID and SGID permissions
should not be required in this directory.
Add the <html:code xmlns:html="http://www.w3.org/1999/xhtml">nosuid</html:code> option to the fourth column of
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/fstab</html:code> for the line which controls mounting of
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/srv</html:code>.</description>
          <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R12)</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The presence of SUID and SGID executables should be tightly controlled. The
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/srv</html:code> directory contains files served by various network services such as FTP. Users should
not be able to execute SUID or SGID binaries from this directory.</rationale>
          <platform idref="cpe:/a:machine"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="mount_option_srv_nosuid" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_include_mount_options_functions" use="legacy"/>
include_mount_options_functions

function perform_remediation {
	# test "$mount_has_to_exist" = 'yes'
	if test "yes" = 'yes'; then
		assert_mount_point_in_fstab /srv || { echo "Not remediating, because there is no record of /srv in /etc/fstab" &gt;&amp;2; return 1; }
	fi

	ensure_mount_option_in_fstab "/srv" "nosuid" "" ""

	ensure_partition_is_mounted "/srv"
}

perform_remediation

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="mount_option_srv_nosuid" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="high" strategy="configure">- name: Check information associated to mountpoint
  command: findmnt --fstab '/srv'
  register: device_name
  failed_when: device_name.rc &gt; 1
  changed_when: false
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_srv_nosuid
    - no_reboot_needed

- name: Create mount_info dictionary variable
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
    - '{{ device_name.stdout_lines[0].split() | list | lower }}'
    - '{{ device_name.stdout_lines[1].split() | list }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - device_name.stdout is defined and device_name.stdout_lines is defined
    - (device_name.stdout | length &gt; 0)
  tags:
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_srv_nosuid
    - no_reboot_needed

- name: If /srv not mounted, craft mount_info manually
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
    - - target
      - source
      - fstype
      - options
    - - /srv
      - ''
      - ''
      - defaults
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - ("--fstab" | length == 0)
    - (device_name.stdout | length == 0)
  tags:
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_srv_nosuid
    - no_reboot_needed

- name: Make sure nosuid option is part of the to /srv options
  set_fact:
    mount_info: '{{ mount_info | combine( {''options'':''''~mount_info.options~'',nosuid''
      }) }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - mount_info is defined and "nosuid" not in mount_info.options
  tags:
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_srv_nosuid
    - no_reboot_needed

- name: Ensure /srv is mounted with nosuid option
  mount:
    path: /srv
    src: '{{ mount_info.source }}'
    opts: '{{ mount_info.options }}'
    state: mounted
    fstype: '{{ mount_info.fstype }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - (device_name.stdout is defined and (device_name.stdout | length &gt; 0)) or ("--fstab"
      | length == 0)
  tags:
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_srv_nosuid
    - no_reboot_needed
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="mount_option_srv_nosuid" system="urn:redhat:anaconda:pre" complexity="low" disruption="high" strategy="enable">
part /srv --mountoptions="nosuid"
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-mount_option_srv_nosuid:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-mount_option_srv_nosuid_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_mount_option_dev_shm_noexec" selected="false" role="full" severity="low">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Add noexec Option to /dev/shm</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">noexec</html:code> mount option can be used to prevent binaries
from being executed out of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/dev/shm</html:code>.
It can be dangerous to allow the execution of binaries
from world-writable temporary storage directories such as <html:code xmlns:html="http://www.w3.org/1999/xhtml">/dev/shm</html:code>.
Add the <html:code xmlns:html="http://www.w3.org/1999/xhtml">noexec</html:code> option to the fourth column of
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/fstab</html:code> for the line which controls mounting of
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/dev/shm</html:code>.</description>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-001764</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">MP-7</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-2</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.11</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.12</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.3</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.06</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.06</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.11.2.9</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.5.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.6.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.2.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.2.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.8.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.8.2.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.8.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.8.3.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.8.3.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
          <reference href="https://www.cisecurity.org/controls/">11</reference>
          <reference href="https://www.cisecurity.org/controls/">13</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">8</reference>
          <reference href="https://www.cisecurity.org/controls/">9</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000368-GPOS-00154</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Allowing users to execute binaries from world-writable directories
such as <html:code xmlns:html="http://www.w3.org/1999/xhtml">/dev/shm</html:code> can expose the system to potential compromise.</rationale>
          <platform idref="cpe:/a:machine"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="mount_option_dev_shm_noexec" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_include_mount_options_functions" use="legacy"/>
include_mount_options_functions

function perform_remediation {
	# test "$mount_has_to_exist" = 'yes'
	if test "no" = 'yes'; then
		assert_mount_point_in_fstab /dev/shm || { echo "Not remediating, because there is no record of /dev/shm in /etc/fstab" &gt;&amp;2; return 1; }
	fi

	ensure_mount_option_in_fstab "/dev/shm" "noexec" "tmpfs" "tmpfs"

	ensure_partition_is_mounted "/dev/shm"
}

perform_remediation

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="mount_option_dev_shm_noexec" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="high" strategy="configure">- name: Check information associated to mountpoint
  command: findmnt  '/dev/shm'
  register: device_name
  failed_when: device_name.rc &gt; 1
  changed_when: false
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - low_severity
    - mount_option_dev_shm_noexec
    - no_reboot_needed

- name: Create mount_info dictionary variable
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
    - '{{ device_name.stdout_lines[0].split() | list | lower }}'
    - '{{ device_name.stdout_lines[1].split() | list }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - device_name.stdout is defined and device_name.stdout_lines is defined
    - (device_name.stdout | length &gt; 0)
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - low_severity
    - mount_option_dev_shm_noexec
    - no_reboot_needed

- name: If /dev/shm not mounted, craft mount_info manually
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
    - - target
      - source
      - fstype
      - options
    - - /dev/shm
      - tmpfs
      - tmpfs
      - defaults
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - ("" | length == 0)
    - (device_name.stdout | length == 0)
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - low_severity
    - mount_option_dev_shm_noexec
    - no_reboot_needed

- name: Make sure noexec option is part of the to /dev/shm options
  set_fact:
    mount_info: '{{ mount_info | combine( {''options'':''''~mount_info.options~'',noexec''
      }) }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - mount_info is defined and "noexec" not in mount_info.options
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - low_severity
    - mount_option_dev_shm_noexec
    - no_reboot_needed

- name: Ensure /dev/shm is mounted with noexec option
  mount:
    path: /dev/shm
    src: '{{ mount_info.source }}'
    opts: '{{ mount_info.options }}'
    state: mounted
    fstype: '{{ mount_info.fstype }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - (device_name.stdout is defined and (device_name.stdout | length &gt; 0)) or (""
      | length == 0)
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - low_severity
    - mount_option_dev_shm_noexec
    - no_reboot_needed
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-mount_option_dev_shm_noexec:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-mount_option_dev_shm_noexec_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_mount_option_var_log_nosuid" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Add nosuid Option to /var/log</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">nosuid</html:code> mount option can be used to prevent
execution of setuid programs in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/var/log</html:code>. The SUID and SGID permissions
should not be required in directories containing log files.
Add the <html:code xmlns:html="http://www.w3.org/1999/xhtml">nosuid</html:code> option to the fourth column of
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/fstab</html:code> for the line which controls mounting of
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/var/log</html:code>.</description>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">MP-7</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-2</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000368-GPOS-00154</reference>
          <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R12)</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-001764</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The presence of SUID and SGID executables should be tightly controlled. Users
should not be able to execute SUID or SGID binaries from partitions
designated for log files.</rationale>
          <platform idref="cpe:/a:machine"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="mount_option_var_log_nosuid" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_include_mount_options_functions" use="legacy"/>
include_mount_options_functions

function perform_remediation {
	# test "$mount_has_to_exist" = 'yes'
	if test "yes" = 'yes'; then
		assert_mount_point_in_fstab /var/log || { echo "Not remediating, because there is no record of /var/log in /etc/fstab" &gt;&amp;2; return 1; }
	fi

	ensure_mount_option_in_fstab "/var/log" "nosuid" "" ""

	ensure_partition_is_mounted "/var/log"
}

perform_remediation

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="mount_option_var_log_nosuid" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="high" strategy="configure">- name: Check information associated to mountpoint
  command: findmnt --fstab '/var/log'
  register: device_name
  failed_when: device_name.rc &gt; 1
  changed_when: false
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_var_log_nosuid
    - no_reboot_needed

- name: Create mount_info dictionary variable
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
    - '{{ device_name.stdout_lines[0].split() | list | lower }}'
    - '{{ device_name.stdout_lines[1].split() | list }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - device_name.stdout is defined and device_name.stdout_lines is defined
    - (device_name.stdout | length &gt; 0)
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_var_log_nosuid
    - no_reboot_needed

- name: If /var/log not mounted, craft mount_info manually
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
    - - target
      - source
      - fstype
      - options
    - - /var/log
      - ''
      - ''
      - defaults
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - ("--fstab" | length == 0)
    - (device_name.stdout | length == 0)
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_var_log_nosuid
    - no_reboot_needed

- name: Make sure nosuid option is part of the to /var/log options
  set_fact:
    mount_info: '{{ mount_info | combine( {''options'':''''~mount_info.options~'',nosuid''
      }) }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - mount_info is defined and "nosuid" not in mount_info.options
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_var_log_nosuid
    - no_reboot_needed

- name: Ensure /var/log is mounted with nosuid option
  mount:
    path: /var/log
    src: '{{ mount_info.source }}'
    opts: '{{ mount_info.options }}'
    state: mounted
    fstype: '{{ mount_info.fstype }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - (device_name.stdout is defined and (device_name.stdout | length &gt; 0)) or ("--fstab"
      | length == 0)
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_var_log_nosuid
    - no_reboot_needed
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="mount_option_var_log_nosuid" system="urn:redhat:anaconda:pre" complexity="low" disruption="high" strategy="enable">
part /var/log --mountoptions="nosuid"
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-mount_option_var_log_nosuid:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-mount_option_var_log_nosuid_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_mount_option_var_log_audit_nosuid" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Add nosuid Option to /var/log/audit</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">nosuid</html:code> mount option can be used to prevent
execution of setuid programs in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/var/log/audit</html:code>. The SUID and SGID permissions
should not be required in directories containing audit log files.
Add the <html:code xmlns:html="http://www.w3.org/1999/xhtml">nosuid</html:code> option to the fourth column of
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/fstab</html:code> for the line which controls mounting of
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/var/log/audit</html:code>.</description>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">MP-7</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-2</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000368-GPOS-00154</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-001764</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The presence of SUID and SGID executables should be tightly controlled. Users
should not be able to execute SUID or SGID binaries from partitions
designated for audit log files.</rationale>
          <platform idref="cpe:/a:machine"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="mount_option_var_log_audit_nosuid" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_include_mount_options_functions" use="legacy"/>
include_mount_options_functions

function perform_remediation {
	# test "$mount_has_to_exist" = 'yes'
	if test "yes" = 'yes'; then
		assert_mount_point_in_fstab /var/log/audit || { echo "Not remediating, because there is no record of /var/log/audit in /etc/fstab" &gt;&amp;2; return 1; }
	fi

	ensure_mount_option_in_fstab "/var/log/audit" "nosuid" "" ""

	ensure_partition_is_mounted "/var/log/audit"
}

perform_remediation

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="mount_option_var_log_audit_nosuid" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="high" strategy="configure">- name: Check information associated to mountpoint
  command: findmnt --fstab '/var/log/audit'
  register: device_name
  failed_when: device_name.rc &gt; 1
  changed_when: false
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_var_log_audit_nosuid
    - no_reboot_needed

- name: Create mount_info dictionary variable
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
    - '{{ device_name.stdout_lines[0].split() | list | lower }}'
    - '{{ device_name.stdout_lines[1].split() | list }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - device_name.stdout is defined and device_name.stdout_lines is defined
    - (device_name.stdout | length &gt; 0)
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_var_log_audit_nosuid
    - no_reboot_needed

- name: If /var/log/audit not mounted, craft mount_info manually
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
    - - target
      - source
      - fstype
      - options
    - - /var/log/audit
      - ''
      - ''
      - defaults
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - ("--fstab" | length == 0)
    - (device_name.stdout | length == 0)
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_var_log_audit_nosuid
    - no_reboot_needed

- name: Make sure nosuid option is part of the to /var/log/audit options
  set_fact:
    mount_info: '{{ mount_info | combine( {''options'':''''~mount_info.options~'',nosuid''
      }) }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - mount_info is defined and "nosuid" not in mount_info.options
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_var_log_audit_nosuid
    - no_reboot_needed

- name: Ensure /var/log/audit is mounted with nosuid option
  mount:
    path: /var/log/audit
    src: '{{ mount_info.source }}'
    opts: '{{ mount_info.options }}'
    state: mounted
    fstype: '{{ mount_info.fstype }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - (device_name.stdout is defined and (device_name.stdout | length &gt; 0)) or ("--fstab"
      | length == 0)
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_var_log_audit_nosuid
    - no_reboot_needed
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="mount_option_var_log_audit_nosuid" system="urn:redhat:anaconda:pre" complexity="low" disruption="high" strategy="enable">
part /var/log/audit --mountoptions="nosuid"
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-mount_option_var_log_audit_nosuid:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-mount_option_var_log_audit_nosuid_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_mount_option_var_tmp_bind" selected="false" role="full" severity="unknown">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Bind Mount /var/tmp To /tmp</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">/var/tmp</html:code> directory is a world-writable directory. Bind-mount
it to <html:code xmlns:html="http://www.w3.org/1999/xhtml">/tmp</html:code> in order to consolidate temporary storage into one
location protected by the same techniques as <html:code xmlns:html="http://www.w3.org/1999/xhtml">/tmp</html:code>. To do so, edit
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/fstab</html:code> and add the following line:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">/tmp     /var/tmp     none     rw,nodev,noexec,nosuid,bind     0 0</html:pre>
See the <html:code xmlns:html="http://www.w3.org/1999/xhtml">mount(8)</html:code> man page for further explanation of bind mounting.</description>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">MP-7</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.11</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.12</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.3</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.06</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.5.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.6.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.2.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.2.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
          <reference href="https://www.cisecurity.org/controls/">11</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">9</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Having multiple locations for temporary storage is not required. Unless absolutely
necessary to meet requirements, the storage location <html:code xmlns:html="http://www.w3.org/1999/xhtml">/var/tmp</html:code> should be bind mounted to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/tmp</html:code> and thus share the same protections.</rationale>
          <platform idref="cpe:/a:machine"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="mount_option_var_tmp_bind" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then



# Delete particular /etc/fstab's row if /var/tmp is already configured to
# represent a mount point (for some device or filesystem other than /tmp)
if grep -q -P '.*\/var\/tmp.*' /etc/fstab
then
  sed -i '/.*\/var\/tmp.*/d' /etc/fstab
fi
umount /var/tmp

# Bind-mount /var/tmp to /tmp via /etc/fstab (preserving the /etc/fstab form)
printf "%-24s%-24s%-8s%-32s%-3s\n" "/tmp" "/var/tmp" "none" "rw,nodev,noexec,nosuid,bind" "0 0" &gt;&gt; /etc/fstab

mkdir -p /var/tmp
mount -B /tmp /var/tmp

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="mount_option_var_tmp_bind" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="high" strategy="configure">- name: Check information associated to mountpoint
  command: findmnt --fstab '/var/tmp'
  register: device_name
  failed_when: device_name.rc &gt; 1
  changed_when: false
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - mount_option_var_tmp_bind
    - no_reboot_needed
    - unknown_severity

- name: Create mount_info dictionary variable
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
    - '{{ device_name.stdout_lines[0].split() | list | lower }}'
    - '{{ device_name.stdout_lines[1].split() | list }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - device_name.stdout is defined and device_name.stdout_lines is defined
    - (device_name.stdout | length &gt; 0)
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - mount_option_var_tmp_bind
    - no_reboot_needed
    - unknown_severity

- name: If /var/tmp not mounted, craft mount_info manually
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
    - - target
      - source
      - fstype
      - options
    - - /var/tmp
      - ''
      - ''
      - defaults
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - ("--fstab" | length == 0)
    - (device_name.stdout | length == 0)
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - mount_option_var_tmp_bind
    - no_reboot_needed
    - unknown_severity

- name: Make sure bind option is part of the to /var/tmp options
  set_fact:
    mount_info: '{{ mount_info | combine( {''options'':''''~mount_info.options~'',bind''
      }) }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - mount_info is defined and "bind" not in mount_info.options
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - mount_option_var_tmp_bind
    - no_reboot_needed
    - unknown_severity

- name: Ensure /var/tmp is mounted with bind option
  mount:
    path: /var/tmp
    src: '{{ mount_info.source }}'
    opts: '{{ mount_info.options }}'
    state: mounted
    fstype: '{{ mount_info.fstype }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - (device_name.stdout is defined and (device_name.stdout | length &gt; 0)) or ("--fstab"
      | length == 0)
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - mount_option_var_tmp_bind
    - no_reboot_needed
    - unknown_severity
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="mount_option_var_tmp_bind" system="urn:redhat:anaconda:pre" complexity="low" disruption="high" strategy="enable">
part /var/tmp --mountoptions="bind"
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-mount_option_var_tmp_bind:def:1" href="ssg-fedora-oval.xml"/>
          </check>
        </Rule>
      </Group>
    </Group>
    <Group id="xccdf_org.ssgproject.content_group_logging">
      <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Configure Syslog</title>
      <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The syslog service has been the default Unix logging mechanism for
many years. It has a number of downsides, including inconsistent log format,
lack of authentication for received messages, and lack of authentication,
encryption, or reliable transport for messages sent over a network. However,
due to its long history, syslog is a de facto standard which is supported by
almost all Unix applications.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
In Fedora, rsyslog has replaced ksyslogd as the
syslog daemon of choice, and it includes some additional security features
such as reliable, connection-oriented (i.e. TCP) transmission of logs, the
option to log to database formats, and the encryption of log data en route to
a central logging server.
This section discusses how to configure rsyslog for
best effect, and how to use tools provided with the system to maintain and
monitor logs.</description>
      <platform idref="cpe:/a:machine"/>
      <Rule id="xccdf_org.ssgproject.content_rule_package_rsyslog-gnutls_installed" selected="false" role="full" severity="medium">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure rsyslog-gnutls is installed</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">TLS protocol support for rsyslog is installed.
The <html:code xmlns:html="http://www.w3.org/1999/xhtml">rsyslog-gnutls</html:code> package can be installed with the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">
$ sudo dnf install rsyslog-gnutls</html:pre></description>
        <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FTP_ITC_EXT.1.1</reference>
        <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
        <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000120-GPOS-00061</reference>
        <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R43)</reference>
        <reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</reference>
        <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The rsyslog-gnutls package provides Transport Layer Security (TLS) support
for the rsyslog daemon, which enables secure remote logging.</rationale>
        <platform idref="cpe:/a:machine"/>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_rsyslog-gnutls_installed" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="enable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

if ! rpm -q --quiet "rsyslog-gnutls" ; then
    dnf install -y "rsyslog-gnutls"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_rsyslog-gnutls_installed" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="enable">- name: Ensure rsyslog-gnutls is installed
  package:
    name: rsyslog-gnutls
    state: present
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - enable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - package_rsyslog-gnutls_installed
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_rsyslog-gnutls_installed" system="urn:xccdf:fix:script:puppet" complexity="low" disruption="low" strategy="enable">include install_rsyslog-gnutls

class install_rsyslog-gnutls {
  package { 'rsyslog-gnutls':
    ensure =&gt; 'installed',
  }
}
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_rsyslog-gnutls_installed" system="urn:redhat:anaconda:pre" complexity="low" disruption="low" strategy="enable">
package --add=rsyslog-gnutls
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_rsyslog-gnutls_installed" system="urn:redhat:osbuild:blueprint">
[[packages]]
name = "rsyslog-gnutls"
version = "*"
</fix>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref name="oval:ssg-package_rsyslog-gnutls_installed:def:1" href="ssg-fedora-oval.xml"/>
        </check>
        <check system="http://scap.nist.gov/schema/ocil/2">
          <check-content-ref name="ocil:ssg-package_rsyslog-gnutls_installed_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
        </check>
      </Rule>
      <Rule id="xccdf_org.ssgproject.content_rule_package_rsyslog_installed" selected="false" role="full" severity="medium">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure rsyslog is Installed</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Rsyslog is installed by default. The <html:code xmlns:html="http://www.w3.org/1999/xhtml">rsyslog</html:code> package can be installed with the following command: <html:pre xmlns:html="http://www.w3.org/1999/xhtml"> $ sudo dnf install rsyslog</html:pre></description>
        <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R5)</reference>
        <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">NT28(R46)</reference>
        <reference href="https://public.cyber.mil/stigs/cci/">CCI-001311</reference>
        <reference href="https://public.cyber.mil/stigs/cci/">CCI-001312</reference>
        <reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(ii)</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.12.4.1</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.12.4.2</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.12.4.3</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.12.4.4</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.12.7.1</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
        <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
        <reference href="https://www.cisecurity.org/controls/">1</reference>
        <reference href="https://www.cisecurity.org/controls/">14</reference>
        <reference href="https://www.cisecurity.org/controls/">15</reference>
        <reference href="https://www.cisecurity.org/controls/">16</reference>
        <reference href="https://www.cisecurity.org/controls/">3</reference>
        <reference href="https://www.cisecurity.org/controls/">5</reference>
        <reference href="https://www.cisecurity.org/controls/">6</reference>
        <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000479-GPOS-00224</reference>
        <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000051-GPOS-00024</reference>
        <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
        <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The rsyslog package provides the rsyslog daemon, which provides
system logging services.</rationale>
        <platform idref="cpe:/a:machine"/>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_rsyslog_installed" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="enable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

if ! rpm -q --quiet "rsyslog" ; then
    dnf install -y "rsyslog"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_rsyslog_installed" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="enable">- name: Ensure rsyslog is installed
  package:
    name: rsyslog
    state: present
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-CM-6(a)
    - enable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - package_rsyslog_installed
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_rsyslog_installed" system="urn:xccdf:fix:script:puppet" complexity="low" disruption="low" strategy="enable">include install_rsyslog

class install_rsyslog {
  package { 'rsyslog':
    ensure =&gt; 'installed',
  }
}
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_rsyslog_installed" system="urn:redhat:anaconda:pre" complexity="low" disruption="low" strategy="enable">
package --add=rsyslog
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_rsyslog_installed" system="urn:redhat:osbuild:blueprint">
[[packages]]
name = "rsyslog"
version = "*"
</fix>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref name="oval:ssg-package_rsyslog_installed:def:1" href="ssg-fedora-oval.xml"/>
        </check>
        <check system="http://scap.nist.gov/schema/ocil/2">
          <check-content-ref name="ocil:ssg-package_rsyslog_installed_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
        </check>
      </Rule>
      <Rule id="xccdf_org.ssgproject.content_rule_service_rsyslog_enabled" selected="false" role="full" severity="medium">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Enable rsyslog Service</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">rsyslog</html:code> service provides syslog-style logging by default on Fedora.

The <html:code xmlns:html="http://www.w3.org/1999/xhtml">rsyslog</html:code> service can be enabled with the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo systemctl enable rsyslog.service</html:pre></description>
        <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R5)</reference>
        <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">NT28(R46)</reference>
        <reference href="https://public.cyber.mil/stigs/cci/">CCI-001311</reference>
        <reference href="https://public.cyber.mil/stigs/cci/">CCI-001312</reference>
        <reference href="https://public.cyber.mil/stigs/cci/">CCI-001557</reference>
        <reference href="https://public.cyber.mil/stigs/cci/">CCI-001851</reference>
        <reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(ii)</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.12.1.3</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.12.4.1</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.12.4.2</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.12.4.3</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.12.4.4</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.12.7.1</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.14.2.7</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.15.2.1</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.15.2.2</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.17.2.1</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-4(1)</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-4</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.2</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.2.6.7</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO10.01</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO10.03</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO10.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO10.05</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
        <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
        <reference href="https://www.isaca.org/resources/cobit">BAI04.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
        <reference href="https://www.isaca.org/resources/cobit">MEA01.01</reference>
        <reference href="https://www.isaca.org/resources/cobit">MEA01.02</reference>
        <reference href="https://www.isaca.org/resources/cobit">MEA01.03</reference>
        <reference href="https://www.isaca.org/resources/cobit">MEA01.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">MEA01.05</reference>
        <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
        <reference href="https://www.cisecurity.org/controls/">1</reference>
        <reference href="https://www.cisecurity.org/controls/">12</reference>
        <reference href="https://www.cisecurity.org/controls/">13</reference>
        <reference href="https://www.cisecurity.org/controls/">14</reference>
        <reference href="https://www.cisecurity.org/controls/">15</reference>
        <reference href="https://www.cisecurity.org/controls/">16</reference>
        <reference href="https://www.cisecurity.org/controls/">2</reference>
        <reference href="https://www.cisecurity.org/controls/">3</reference>
        <reference href="https://www.cisecurity.org/controls/">5</reference>
        <reference href="https://www.cisecurity.org/controls/">6</reference>
        <reference href="https://www.cisecurity.org/controls/">7</reference>
        <reference href="https://www.cisecurity.org/controls/">8</reference>
        <reference href="https://www.cisecurity.org/controls/">9</reference>
        <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
        <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">rsyslog</html:code> service must be running in order to provide
logging services, which are essential to system administration.</rationale>
        <platform idref="cpe:/a:machine"/>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="service_rsyslog_enabled" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="enable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

SYSTEMCTL_EXEC='/usr/bin/systemctl'
"$SYSTEMCTL_EXEC" unmask 'rsyslog.service'
"$SYSTEMCTL_EXEC" start 'rsyslog.service'
"$SYSTEMCTL_EXEC" enable 'rsyslog.service'

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="service_rsyslog_enabled" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="enable">- name: Enable service rsyslog
  block:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: Enable service rsyslog
      service:
        name: rsyslog
        enabled: 'yes'
        state: started
        masked: 'no'
      when:
        - '"rsyslog" in ansible_facts.packages'
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AU-4(1)
    - NIST-800-53-CM-6(a)
    - enable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - service_rsyslog_enabled
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="service_rsyslog_enabled" system="urn:xccdf:fix:script:puppet" complexity="low" disruption="low" strategy="enable">include enable_rsyslog

class enable_rsyslog {
  service {'rsyslog':
    enable =&gt; true,
    ensure =&gt; 'running',
  }
}
</fix>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref name="oval:ssg-service_rsyslog_enabled:def:1" href="ssg-fedora-oval.xml"/>
        </check>
        <check system="http://scap.nist.gov/schema/ocil/2">
          <check-content-ref name="ocil:ssg-service_rsyslog_enabled_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
        </check>
      </Rule>
      <Rule id="xccdf_org.ssgproject.content_rule_disable_logwatch_for_logserver" selected="false" role="full" severity="unknown">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable Logwatch on Clients if a Logserver Exists</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Does your site have a central logserver which has been configured to report
on logs received from all systems? If so:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo rm /etc/cron.daily/0logwatch</html:pre>
If no logserver exists, it will be necessary for each system to run
Logwatch individually. Using a central logserver provides the security and
reliability benefits discussed earlier, and also makes monitoring logs
easier and less time-intensive for administrators.</description>
        <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US"/>
        <platform idref="cpe:/a:machine"/>
      </Rule>
      <Group id="xccdf_org.ssgproject.content_group_rsyslog_accepting_remote_messages">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Configure rsyslogd to Accept Remote Messages If Acting as a Log Server</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">By default, <html:code xmlns:html="http://www.w3.org/1999/xhtml">rsyslog</html:code> does not listen over the network
for log messages. If needed, modules can be enabled to allow
the rsyslog daemon to receive messages from other systems and for the system
thus to act as a log server.
If the system is not a log server, then lines concerning these modules
should remain commented out.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/></description>
        <platform idref="cpe:/a:machine"/>
        <Rule id="xccdf_org.ssgproject.content_rule_package_syslogng_installed" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure syslog-ng is Installed</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">syslog-ng can be installed in replacement of rsyslog.
The <html:code xmlns:html="http://www.w3.org/1999/xhtml">syslog-ng-core</html:code> package can be installed with the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">
$ sudo dnf install syslog-ng-core</html:pre></description>
          <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R46)</reference>
          <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R5)</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-001311</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-001312</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.4.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.4.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.4.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.4.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.7.1</reference>
          <reference href="https://www.cisecurity.org/controls/">1</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">16</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">5</reference>
          <reference href="https://www.cisecurity.org/controls/">6</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The syslog-ng-core package provides the syslog-ng daemon, which provides
system logging services.</rationale>
          <platform idref="cpe:/a:machine"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_syslogng_installed" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="enable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

if ! rpm -q --quiet "syslogng" ; then
    dnf install -y "syslogng"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_syslogng_installed" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="enable">- name: Ensure syslogng is installed
  package:
    name: syslogng
    state: present
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-CM-6(a)
    - enable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - package_syslogng_installed
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_syslogng_installed" system="urn:xccdf:fix:script:puppet" complexity="low" disruption="low" strategy="enable">include install_syslogng

class install_syslogng {
  package { 'syslogng':
    ensure =&gt; 'installed',
  }
}
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_syslogng_installed" system="urn:redhat:anaconda:pre" complexity="low" disruption="low" strategy="enable">
package --add=syslogng
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_syslogng_installed" system="urn:redhat:osbuild:blueprint">
[[packages]]
name = "syslogng"
version = "*"
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-package_syslogng_installed:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-package_syslogng_installed_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_service_syslogng_enabled" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Enable syslog-ng Service</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">syslog-ng</html:code> service (in replacement of rsyslog) provides syslog-style logging by default on Debian.

The <html:code xmlns:html="http://www.w3.org/1999/xhtml">syslog-ng</html:code> service can be enabled with the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo systemctl enable syslog-ng.service</html:pre></description>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-001311</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-001312</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-001557</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-001851</reference>
          <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R46)</reference>
          <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R5)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-4(1)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.2.6.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI04.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.1.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.4.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.4.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.4.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.4.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.7.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.2.7</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.15.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.15.2.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.17.2.1</reference>
          <reference href="https://www.cisecurity.org/controls/">1</reference>
          <reference href="https://www.cisecurity.org/controls/">12</reference>
          <reference href="https://www.cisecurity.org/controls/">13</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">16</reference>
          <reference href="https://www.cisecurity.org/controls/">2</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">5</reference>
          <reference href="https://www.cisecurity.org/controls/">6</reference>
          <reference href="https://www.cisecurity.org/controls/">7</reference>
          <reference href="https://www.cisecurity.org/controls/">8</reference>
          <reference href="https://www.cisecurity.org/controls/">9</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">syslog-ng</html:code> service must be running in order to provide
logging services, which are essential to system administration.</rationale>
          <platform idref="cpe:/a:machine"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="service_syslogng_enabled" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="enable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

SYSTEMCTL_EXEC='/usr/bin/systemctl'
"$SYSTEMCTL_EXEC" unmask 'syslogng.service'
"$SYSTEMCTL_EXEC" start 'syslogng.service'
"$SYSTEMCTL_EXEC" enable 'syslogng.service'

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="service_syslogng_enabled" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="enable">- name: Enable service syslogng
  block:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: Enable service syslogng
      service:
        name: syslogng
        enabled: 'yes'
        state: started
        masked: 'no'
      when:
        - '"syslogng" in ansible_facts.packages'
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AU-4(1)
    - NIST-800-53-CM-6(a)
    - enable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - service_syslogng_enabled
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="service_syslogng_enabled" system="urn:xccdf:fix:script:puppet" complexity="low" disruption="low" strategy="enable">include enable_syslogng

class enable_syslogng {
  service {'syslogng':
    enable =&gt; true,
    ensure =&gt; 'running',
  }
}
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-service_syslogng_enabled:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-service_syslogng_enabled_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_rsyslog_accept_remote_messages_tcp" selected="false" role="full" severity="unknown">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Enable rsyslog to Accept Messages via TCP, if Acting As Log Server</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">rsyslog</html:code> daemon should not accept remote messages
unless the system acts as a log server.
If the system needs to act as a central log server, add the following lines to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/rsyslog.conf</html:code> to enable reception of messages over TCP:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ModLoad imtcp
$InputTCPServerRun 514</html:pre></description>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-6(3)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-6(4)</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.4.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.4.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.4.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.4.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.7.1</reference>
          <reference href="https://www.cisecurity.org/controls/">1</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">16</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">5</reference>
          <reference href="https://www.cisecurity.org/controls/">6</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">If the system needs to act as a log server, this ensures that it can receive
messages over a reliable TCP connection.</rationale>
          <platform idref="cpe:/a:machine"/>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_rsyslog_accept_remote_messages_udp" selected="false" role="full" severity="unknown">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Enable rsyslog to Accept Messages via UDP, if Acting As Log Server</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">rsyslog</html:code> daemon should not accept remote messages
unless the system acts as a log server.
If the system needs to act as a central log server, add the following lines to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/rsyslog.conf</html:code> to enable reception of messages over UDP:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ModLoad imudp
$UDPServerRun 514</html:pre></description>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-6(3)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-6(4)</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.4.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.4.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.4.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.4.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.7.1</reference>
          <reference href="https://www.cisecurity.org/controls/">1</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">16</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">5</reference>
          <reference href="https://www.cisecurity.org/controls/">6</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Many devices, such as switches, routers, and other Unix-like systems, may only support
the traditional syslog transmission over UDP. If the system must act as a log server,
this enables it to receive their messages as well.</rationale>
          <platform idref="cpe:/a:machine"/>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_rsyslog_nolisten" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">rsyslog</html:code> daemon should not accept remote messages
unless the system acts as a log server.
To ensure that it is not listening on the network, ensure the following lines are
<html:i xmlns:html="http://www.w3.org/1999/xhtml">not</html:i> found in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/rsyslog.conf</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ModLoad imtcp
$InputTCPServerRun <html:i>port</html:i>
$ModLoad imudp
$UDPServerRun <html:i>port</html:i>
$ModLoad imrelp
$InputRELPServerRun <html:i>port</html:i></html:pre></description>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-000318</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-000368</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-001812</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-001813</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-001814</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.AM-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-5</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.3.3</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS01.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.10.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.11.1.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.11.1.5</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.11.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.4.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.4.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.4.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.4.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.5.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.6.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.7.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.1.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.2.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.2.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.2.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.2.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.6.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.7.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.7.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.7.3.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.8.2.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.8.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.5</reference>
          <reference href="https://www.cisecurity.org/controls/">1</reference>
          <reference href="https://www.cisecurity.org/controls/">11</reference>
          <reference href="https://www.cisecurity.org/controls/">12</reference>
          <reference href="https://www.cisecurity.org/controls/">13</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">16</reference>
          <reference href="https://www.cisecurity.org/controls/">18</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">4</reference>
          <reference href="https://www.cisecurity.org/controls/">5</reference>
          <reference href="https://www.cisecurity.org/controls/">6</reference>
          <reference href="https://www.cisecurity.org/controls/">8</reference>
          <reference href="https://www.cisecurity.org/controls/">9</reference>
          <reference href="">0988</reference>
          <reference href="">1405</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Any process which receives messages from the network incurs some risk
of receiving malicious messages. This risk can be eliminated for
rsyslog by configuring it not to listen on the network.</rationale>
          <platform idref="cpe:/a:machine"/>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-rsyslog_nolisten:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-rsyslog_nolisten_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
      </Group>
      <Group id="xccdf_org.ssgproject.content_group_log_rotation">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure All Logs are Rotated by logrotate</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">
Edit the file <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/logrotate.d/syslog</html:code>. Find the first

line, which should look like this (wrapped for clarity):
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">/var/log/messages /var/log/secure /var/log/maillog /var/log/spooler \
  /var/log/boot.log /var/log/cron {</html:pre>
Edit this line so that it contains a one-space-separated
listing of each log file referenced in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/rsyslog.conf</html:code>.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
All logs in use on a system must be rotated regularly, or the
log files will consume disk space over time, eventually interfering
with system operation. The file <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/logrotate.d/syslog</html:code> is the
configuration file used by the <html:code xmlns:html="http://www.w3.org/1999/xhtml">logrotate</html:code> program to maintain all
log files written by <html:code xmlns:html="http://www.w3.org/1999/xhtml">syslog</html:code>. By default, it rotates logs weekly and
stores four archival copies of each log. These settings can be
modified by editing <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/logrotate.conf</html:code>, but the defaults are
sufficient for purposes of this guide.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Note that <html:code xmlns:html="http://www.w3.org/1999/xhtml">logrotate</html:code> is run nightly by the cron job
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/cron.daily/logrotate</html:code>. If particularly active logs need to be
rotated more often than once a day, some other mechanism must be
used.</description>
        <platform idref="cpe:/a:machine"/>
        <Rule id="xccdf_org.ssgproject.content_rule_ensure_logrotate_activated" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure Logrotate Runs Periodically</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">logrotate</html:code> utility allows for the automatic rotation of
log files.  The frequency of rotation is specified in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/logrotate.conf</html:code>,
which triggers a cron task.  To configure logrotate to run daily, add or correct
the following line in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/logrotate.conf</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml"># rotate log files <html:i>frequency</html:i>
daily</html:pre></description>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
          <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.4.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.4.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.4.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.4.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.7.1</reference>
          <reference href="https://www.cisecurity.org/controls/">1</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">16</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">5</reference>
          <reference href="https://www.cisecurity.org/controls/">6</reference>
          <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R43)</reference>
          <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">NT12(R18)</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Log files that are not properly rotated run the risk of growing so large
that they fill up the /var/log partition. Valuable logging information could be lost
if the /var/log partition becomes full.</rationale>
          <platform idref="cpe:/a:machine"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="ensure_logrotate_activated" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

LOGROTATE_CONF_FILE="/etc/logrotate.conf"
CRON_DAILY_LOGROTATE_FILE="/etc/cron.daily/logrotate"

# daily rotation is configured
grep -q "^daily$" $LOGROTATE_CONF_FILE|| echo "daily" &gt;&gt; $LOGROTATE_CONF_FILE

# remove any line configuring weekly, monthly or yearly rotation
sed -i '/^\s*\(weekly\|monthly\|yearly\).*$/d' $LOGROTATE_CONF_FILE

# configure cron.daily if not already
if ! grep -q "^[[:space:]]*/usr/sbin/logrotate[[:alnum:][:blank:][:punct:]]*$LOGROTATE_CONF_FILE$" $CRON_DAILY_LOGROTATE_FILE; then
	echo "#!/bin/sh" &gt; $CRON_DAILY_LOGROTATE_FILE
	echo "/usr/sbin/logrotate $LOGROTATE_CONF_FILE" &gt;&gt; $CRON_DAILY_LOGROTATE_FILE
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="ensure_logrotate_activated" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: Configure daily log rotation in /etc/logrotate.conf
  lineinfile:
    create: true
    dest: /etc/logrotate.conf
    regexp: ^daily$
    line: daily
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.7
    - configure_strategy
    - ensure_logrotate_activated
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Make sure daily log rotation setting is not overriden in /etc/logrotate.conf
  lineinfile:
    create: false
    dest: /etc/logrotate.conf
    regexp: ^[\s]*(weekly|monthly|yearly)$
    state: absent
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.7
    - configure_strategy
    - ensure_logrotate_activated
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Configure cron.daily if not already
  block:

    - name: Add shebang
      lineinfile:
        path: /etc/cron.daily/logrotate
        line: '#!/bin/sh'
        insertbefore: BOF
        create: true

    - name: Add logrotate call
      lineinfile:
        path: /etc/cron.daily/logrotate
        line: /usr/sbin/logrotate /etc/logrotate.conf
        regexp: ^[\s]*/usr/sbin/logrotate[\s\S]*/etc/logrotate.conf$
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.7
    - configure_strategy
    - ensure_logrotate_activated
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="ensure_logrotate_activated" system="urn:xccdf:fix:script:kubernetes" reboot="true" complexity="low" disruption="low" strategy="restrict">apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,%23%20see%20%22man%20logrotate%22%20for%20details%0A%23%20rotate%20log%20files%20daily%0Adaily%0A%0A%23%20keep%204%20weeks%20worth%20of%20backlogs%0Arotate%2030%0A%0A%23%20create%20new%20%28empty%29%20log%20files%20after%20rotating%20old%20ones%0Acreate%0A%0A%23%20use%20date%20as%20a%20suffix%20of%20the%20rotated%20file%0Adateext%0A%0A%23%20uncomment%20this%20if%20you%20want%20your%20log%20files%20compressed%0A%23compress%0A%0A%23%20RPM%20packages%20drop%20log%20rotation%20information%20into%20this%20directory%0Ainclude%20/etc/logrotate.d%0A%0A%23%20system-specific%20logs%20may%20be%20also%20be%20configured%20here.
        mode: 0644
        path: /etc/logrotate.conf
        overwrite: true
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-ensure_logrotate_activated:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-ensure_logrotate_activated_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
      </Group>
      <Group id="xccdf_org.ssgproject.content_group_rsyslog_sending_messages">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Rsyslog Logs Sent To Remote Host</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">If system logs are to be useful in detecting malicious
activities, it is necessary to send logs to a remote server. An
intruder who has compromised the root account on a system may
delete the log entries which indicate that the system was attacked
before they are seen by an administrator.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
However, it is recommended that logs be stored on the local
host in addition to being sent to the loghost, especially if
<html:code xmlns:html="http://www.w3.org/1999/xhtml">rsyslog</html:code> has been configured to use the UDP protocol to send
messages over a network. UDP does not guarantee reliable delivery,
and moderately busy sites will lose log messages occasionally,
especially in periods of high traffic which may be the result of an
attack. In addition, remote <html:code xmlns:html="http://www.w3.org/1999/xhtml">rsyslog</html:code> messages are not
authenticated in any way by default, so it is easy for an attacker to
introduce spurious messages to the central log server. Also, some
problems cause loss of network connectivity, which will prevent the
sending of messages to the central server. For all of these reasons, it is
better to store log messages both centrally and on each host, so
that they can be correlated if necessary.</description>
        <platform idref="cpe:/a:machine"/>
        <Value id="xccdf_org.ssgproject.content_value_rsyslog_remote_loghost_address" type="string" interactive="true">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Remote Log Server</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Specify an URI or IP address of a remote host where the log messages will be sent and stored.</description>
          <value>logcollector</value>
        </Value>
        <Rule id="xccdf_org.ssgproject.content_rule_rsyslog_remote_tls" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Configure TLS for rsyslog remote logging</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Configure <html:code xmlns:html="http://www.w3.org/1999/xhtml">rsyslog</html:code> to use Transport Layer
Security (TLS) support for logging to remote server
for the Forwarding Output Module in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/rsyslog.conf</html:code>
using action. You can use the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">echo 'action(type="omfwd" protocol="tcp" Target="&lt;remote system&gt;" port="6514"
    StreamDriver="gtls" StreamDriverMode="1" StreamDriverAuthMode="x509/name" streamdriver.CheckExtendedKeyPurpose="on")' &gt;&gt; /etc/rsyslog.conf
</html:pre>
Replace the <html:code xmlns:html="http://www.w3.org/1999/xhtml">&lt;remote system&gt;</html:code> in the above command with an IP address or a host name of the remote logging server.</description>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-9(3)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FCS_TLSC_EXT.1</reference>
          <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FTP_ITC_EXT.1.1</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000120-GPOS-00061</reference>
          <reference href="">0988</reference>
          <reference href="">1405</reference>
          <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R43)</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">For protection of data being logged, the connection to the
remote logging server needs to be authenticated and encrypted.</rationale>
          <platform idref="cpe:/a:machine"/>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-rsyslog_remote_tls:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-rsyslog_remote_tls_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_rsyslog_remote_loghost" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure Logs Sent To Remote Host</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To configure rsyslog to send logs to a remote log server,
open <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/rsyslog.conf</html:code> and read and understand the last section of the file,
which describes the multiple directives necessary to activate remote
logging.
Along with these other directives, the system can be configured
to forward its logs to a particular log server by
adding or correcting one of the following lines,
substituting <html:code xmlns:html="http://www.w3.org/1999/xhtml" xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2"><html:i><xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_rsyslog_remote_loghost_address" use="legacy"/></html:i></html:code> appropriately.
The choice of protocol depends on the environment of the system;
although TCP and RELP provide more reliable message delivery,
they may not be supported in all environments.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
To use UDP for log message delivery:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml" xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2">*.* @<html:i><xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_rsyslog_remote_loghost_address" use="legacy"/></html:i></html:pre>
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
To use TCP for log message delivery:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml" xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2">*.* @@<html:i><xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_rsyslog_remote_loghost_address" use="legacy"/></html:i></html:pre>
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
To use RELP for log message delivery:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml" xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2">*.* :omrelp:<html:i><xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_rsyslog_remote_loghost_address" use="legacy"/></html:i></html:pre>
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
There must be a resolvable DNS CNAME or Alias record set to "<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_rsyslog_remote_loghost_address" use="legacy"/>" for logs to be sent correctly to the centralized logging utility.</description>
          <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R7)</reference>
          <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">NT28(R43)</reference>
          <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">NT12(R5)</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-001348</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-000136</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-001851</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(B)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(6)(ii)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(8)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(2)(iii)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.314(a)(2)(i)(C)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.314(a)(2)(iii)</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.1.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.4.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.4.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.4.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.4.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.7.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.17.2.1</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-4(1)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-9(2)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
          <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000479-GPOS-00224</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000342-GPOS-00133</reference>
          <reference href="">SRG-OS-000032-VMM-000130</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI04.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
          <reference href="https://www.cisecurity.org/controls/">1</reference>
          <reference href="https://www.cisecurity.org/controls/">13</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">16</reference>
          <reference href="https://www.cisecurity.org/controls/">2</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">5</reference>
          <reference href="https://www.cisecurity.org/controls/">6</reference>
          <reference href="">0988</reference>
          <reference href="">1405</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">A log server (loghost) receives syslog messages from one or more
systems. This data can be used as an additional log source in the event a
system is compromised and its local logs are suspect. Forwarding log messages
to a remote loghost also provides system administrators with a centralized
place to view the status of multiple hosts within the enterprise.</rationale>
          <platform idref="cpe:/a:machine"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="rsyslog_remote_loghost" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then


rsyslog_remote_loghost_address="<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_rsyslog_remote_loghost_address" use="legacy"/>"
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_replace_or_append" use="legacy"/>
replace_or_append '/etc/rsyslog.conf' '^\*\.\*' "@@$rsyslog_remote_loghost_address" '' '%s %s'

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="rsyslog_remote_loghost" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: XCCDF Value rsyslog_remote_loghost_address # promote to variable
  set_fact:
    rsyslog_remote_loghost_address: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_rsyslog_remote_loghost_address" use="legacy"/>
  tags:
    - always

- name: Set rsyslog remote loghost
  lineinfile:
    dest: /etc/rsyslog.conf
    regexp: ^\*\.\*
    line: '*.* @@{{ rsyslog_remote_loghost_address }}'
    create: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AU-4(1)
    - NIST-800-53-AU-9(2)
    - NIST-800-53-CM-6(a)
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - rsyslog_remote_loghost
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-rsyslog_remote_loghost:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-rsyslog_remote_loghost_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_rsyslog_remote_tls_cacert" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Configure CA certificate for rsyslog remote logging</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Configure CA certificate for <html:code xmlns:html="http://www.w3.org/1999/xhtml">rsyslog</html:code> logging
to remote server using Transport Layer Security (TLS)
using correct path for the <html:code xmlns:html="http://www.w3.org/1999/xhtml">DefaultNetstreamDriverCAFile</html:code>
global option in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/rsyslog.conf</html:code>, for example with the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">echo 'global(DefaultNetstreamDriverCAFile="/etc/pki/tls/cert.pem")' &gt;&gt; /etc/rsyslog.conf</html:pre>
Replace the <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/pki/tls/cert.pem</html:code> in the above command with the path to the file with CA certificate generated for the purpose of remote logging.</description>
          <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FCS_TLSC_EXT.1</reference>
          <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FTP_ITC_EXT.1.1</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
          <reference href="">0988</reference>
          <reference href="">1405</reference>
          <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R43)</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The CA certificate needs to be set or <html:code xmlns:html="http://www.w3.org/1999/xhtml">rsyslog.service</html:code>
fails to start with
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">error: ca certificate is not set, cannot continue</html:pre></rationale>
          <platform idref="cpe:/a:machine"/>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-rsyslog_remote_tls_cacert:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-rsyslog_remote_tls_cacert_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
      </Group>
      <Group id="xccdf_org.ssgproject.content_group_ensure_rsyslog_log_file_configuration">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure Proper Configuration of Log Files</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The file <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/rsyslog.conf</html:code> controls where log message are written.
These are controlled by lines called <html:i xmlns:html="http://www.w3.org/1999/xhtml">rules</html:i>, which consist of a
<html:i xmlns:html="http://www.w3.org/1999/xhtml">selector</html:i> and an <html:i xmlns:html="http://www.w3.org/1999/xhtml">action</html:i>.
These rules are often customized depending on the role of the system, the
requirements of the environment, and whatever may enable
the administrator to most effectively make use of log data.
The default rules in Fedora are:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">*.info;mail.none;authpriv.none;cron.none                /var/log/messages
authpriv.*                                              /var/log/secure
mail.*                                                  -/var/log/maillog
cron.*                                                  /var/log/cron
*.emerg                                                 *
uucp,news.crit                                          /var/log/spooler
local7.*                                                /var/log/boot.log</html:pre>
See the man page <html:code xmlns:html="http://www.w3.org/1999/xhtml">rsyslog.conf(5)</html:code> for more information.
<html:i xmlns:html="http://www.w3.org/1999/xhtml">Note that the <html:code>rsyslog</html:code> daemon can be configured to use a timestamp format that
some log processing programs may not understand. If this occurs,
edit the file <html:code>/etc/rsyslog.conf</html:code> and add or edit the following line:</html:i>
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat</html:pre></description>
        <platform idref="cpe:/a:machine"/>
        <Value id="xccdf_org.ssgproject.content_value_file_groupowner_logfiles_value" type="string">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">group who owns log files</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Specify group owner of all logfiles specified in
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/rsyslog.conf.</html:code></description>
          <value>root</value>
          <value selector="adm">adm</value>
          <value selector="root">root</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_file_owner_logfiles_value" type="string">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">User who owns log files</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Specify user owner of all logfiles specified in
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/rsyslog.conf</html:code>.</description>
          <value>root</value>
          <value selector="adm">adm</value>
          <value selector="root">root</value>
          <value selector="syslog">syslog</value>
        </Value>
        <Rule id="xccdf_org.ssgproject.content_rule_rsyslog_files_ownership" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure Log Files Are Owned By Appropriate User</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The owner of all log files written by
<html:code xmlns:html="http://www.w3.org/1999/xhtml">rsyslog</html:code> should be <html:code xmlns:html="http://www.w3.org/1999/xhtml" xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2"><xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_file_owner_logfiles_value" use="legacy"/></html:code>.
These log files are determined by the second part of each Rule line in
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/rsyslog.conf</html:code> and typically all appear in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/var/log</html:code>.
For each log file <html:i xmlns:html="http://www.w3.org/1999/xhtml">LOGFILE</html:i> referenced in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/rsyslog.conf</html:code>,
run the following command to inspect the file's owner:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ ls -l <html:i>LOGFILE</html:i></html:pre>
If the owner is not <html:code xmlns:html="http://www.w3.org/1999/xhtml" xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2"><xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_file_owner_logfiles_value" use="legacy"/></html:code>, run the following command to
correct this:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml" xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2">$ sudo chown <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_file_owner_logfiles_value" use="legacy"/> <html:i>LOGFILE</html:i></html:pre></description>
          <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R46)</reference>
          <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R5)</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-001314</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</reference>
          <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.5.1</reference>
          <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.5.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.10.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.11.1.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.11.1.5</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.11.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.1.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.2.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.6.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.7.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.7.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.7.3.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.8.2.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.8.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.5</reference>
          <reference href="https://www.cisecurity.org/controls/">12</reference>
          <reference href="https://www.cisecurity.org/controls/">13</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">16</reference>
          <reference href="https://www.cisecurity.org/controls/">18</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">5</reference>
          <reference href="">0988</reference>
          <reference href="">1405</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The log files generated by rsyslog contain valuable information regarding system
configuration, user authentication, and other such information. Log files should be
protected from unauthorized access.</rationale>
          <platform idref="cpe:/a:machine"/>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-rsyslog_files_ownership:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-rsyslog_files_ownership_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_rsyslog_cron_logging" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure cron Is Logging To Rsyslog</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Cron logging must be implemented to spot intrusions or trace
cron job status. If <html:code xmlns:html="http://www.w3.org/1999/xhtml">cron</html:code> is not logging to <html:code xmlns:html="http://www.w3.org/1999/xhtml">rsyslog</html:code>, it
can be implemented by adding the following to the <html:i xmlns:html="http://www.w3.org/1999/xhtml">RULES</html:i> section of
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/rsyslog.conf</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">cron.*                                                  /var/log/cron</html:pre></description>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
          <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.2.6.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.4.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.4.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.4.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.4.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.7.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.15.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.15.2.2</reference>
          <reference href="https://www.cisecurity.org/controls/">1</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">16</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">5</reference>
          <reference href="https://www.cisecurity.org/controls/">6</reference>
          <reference href="">0988</reference>
          <reference href="">1405</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Cron logging can be used to trace the successful or unsuccessful execution
of cron jobs. It can also be used to spot intrusions into the use of the cron
facility by unauthorized and malicious users.</rationale>
          <platform idref="cpe:/a:machine"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="rsyslog_cron_logging" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

if ! grep -s "^\s*cron\.\*\s*/var/log/cron$" /etc/rsyslog.conf /etc/rsyslog.d/*.conf; then
	mkdir -p /etc/rsyslog.d
	echo "cron.*	/var/log/cron" &gt;&gt; /etc/rsyslog.d/cron.conf
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-rsyslog_cron_logging:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-rsyslog_cron_logging_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_rsyslog_files_groupownership" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure Log Files Are Owned By Appropriate Group</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The group-owner of all log files written by
<html:code xmlns:html="http://www.w3.org/1999/xhtml">rsyslog</html:code> should be <html:code xmlns:html="http://www.w3.org/1999/xhtml" xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2"><xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_file_groupowner_logfiles_value" use="legacy"/></html:code>.
These log files are determined by the second part of each Rule line in
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/rsyslog.conf</html:code> and typically all appear in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/var/log</html:code>.
For each log file <html:i xmlns:html="http://www.w3.org/1999/xhtml">LOGFILE</html:i> referenced in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/rsyslog.conf</html:code>,
run the following command to inspect the file's group owner:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ ls -l <html:i>LOGFILE</html:i></html:pre>
If the owner is not <html:code xmlns:html="http://www.w3.org/1999/xhtml" xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2"><xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_file_groupowner_logfiles_value" use="legacy"/></html:code>, run the following command to
correct this:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml" xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2">$ sudo chgrp <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_file_groupowner_logfiles_value" use="legacy"/> <html:i>LOGFILE</html:i></html:pre></description>
          <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R46)</reference>
          <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R5)</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-001314</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</reference>
          <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.5.1</reference>
          <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.5.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.10.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.11.1.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.11.1.5</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.11.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.1.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.2.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.6.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.7.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.7.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.7.3.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.8.2.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.8.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.5</reference>
          <reference href="https://www.cisecurity.org/controls/">12</reference>
          <reference href="https://www.cisecurity.org/controls/">13</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">16</reference>
          <reference href="https://www.cisecurity.org/controls/">18</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">5</reference>
          <reference href="">0988</reference>
          <reference href="">1405</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The log files generated by rsyslog contain valuable information regarding system
configuration, user authentication, and other such information. Log files should be
protected from unauthorized access.</rationale>
          <platform idref="cpe:/a:machine"/>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-rsyslog_files_groupownership:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-rsyslog_files_groupownership_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_rsyslog_files_permissions" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure System Log Files Have Correct Permissions</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The file permissions for all log files written by <html:code xmlns:html="http://www.w3.org/1999/xhtml">rsyslog</html:code> should
be set to 600, or more restrictive. These log files are determined by the
second part of each Rule line in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/rsyslog.conf</html:code> and typically
all appear in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/var/log</html:code>. For each log file <html:i xmlns:html="http://www.w3.org/1999/xhtml">LOGFILE</html:i>
referenced in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/rsyslog.conf</html:code>, run the following command to
inspect the file's permissions:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ ls -l <html:i>LOGFILE</html:i></html:pre>
If the permissions are not 600 or more restrictive, run the following
command to correct this:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo chmod 0600 <html:i>LOGFILE</html:i></html:pre>"</description>
          <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R36)</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-001314</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</reference>
          <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.5.1</reference>
          <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.5.2</reference>
          <reference href="">0988</reference>
          <reference href="">1405</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Log files can contain valuable information regarding system
configuration. If the system log files are not protected unauthorized
users could change the logged data, eliminating their forensic value.</rationale>
          <platform idref="cpe:/a:machine"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="rsyslog_files_permissions" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

# List of log file paths to be inspected for correct permissions
# * Primarily inspect log file paths listed in /etc/rsyslog.conf
RSYSLOG_ETC_CONFIG="/etc/rsyslog.conf"
# * And also the log file paths listed after rsyslog's $IncludeConfig directive
#   (store the result into array for the case there's shell glob used as value of IncludeConfig)
readarray -t RSYSLOG_INCLUDE_CONFIG &lt; &lt;(grep -e "\$IncludeConfig[[:space:]]\+[^[:space:];]\+" /etc/rsyslog.conf | cut -d ' ' -f 2)
readarray -t RSYSLOG_INCLUDE &lt; &lt;(awk '/)/{f=0} /include\(/{f=1} f{nf=gensub("^(include\\(|\\s*)file=\"(\\S+)\".*","\\2",1); if($0!=nf){print nf}}' /etc/rsyslog.conf)

# Declare an array to hold the final list of different log file paths
declare -a LOG_FILE_PATHS

# Browse each file selected above as containing paths of log files
# ('/etc/rsyslog.conf' and '/etc/rsyslog.d/*.conf' in the default configuration)
for LOG_FILE in "${RSYSLOG_ETC_CONFIG}" "${RSYSLOG_INCLUDE_CONFIG[@]}" "${RSYSLOG_INCLUDE[@]}"
do
	# From each of these files extract just particular log file path(s), thus:
	# * Ignore lines starting with space (' '), comment ('#"), or variable syntax ('$') characters,
	# * Ignore empty lines,
	# * Strip quotes and closing brackets from paths.
	# * Ignore paths that match /dev|/etc.*\.conf, as those are paths, but likely not log files
	# * From the remaining valid rows select only fields constituting a log file path
	# Text file column is understood to represent a log file path if and only if all of the following are met:
	# * it contains at least one slash '/' character,
	# * it is preceded by space
	# * it doesn't contain space (' '), colon (':'), and semicolon (';') characters
	# Search log file for path(s) only in case it exists!
	if [[ -f "${LOG_FILE}" ]]
	then
		NORMALIZED_CONFIG_FILE_LINES=$(sed -e "/^[[:space:]|#|$]/d" "${LOG_FILE}")
		LINES_WITH_PATHS=$(grep '[^/]*\s\+\S*/\S\+' &lt;&lt;&lt; "${NORMALIZED_CONFIG_FILE_LINES}")
		FILTERED_PATHS=$(sed -e 's/[^\/]*[[:space:]]*\([^:;[:space:]]*\)/\1/g' &lt;&lt;&lt; "${LINES_WITH_PATHS}")
		CLEANED_PATHS=$(sed -e "s/[\"')]//g; /\\/etc.*\.conf/d; /\\/dev\\//d" &lt;&lt;&lt; "${FILTERED_PATHS}")
		MATCHED_ITEMS=$(sed -e "/^$/d" &lt;&lt;&lt; "${CLEANED_PATHS}")
		# Since above sed command might return more than one item (delimited by newline), split the particular
		# matches entries into new array specific for this log file
		readarray -t ARRAY_FOR_LOG_FILE &lt;&lt;&lt; "$MATCHED_ITEMS"
		# Concatenate the two arrays - previous content of $LOG_FILE_PATHS array with
		# items from newly created array for this log file
		LOG_FILE_PATHS+=("${ARRAY_FOR_LOG_FILE[@]}")
		# Delete the temporary array
		unset ARRAY_FOR_LOG_FILE
	fi
done

for LOG_FILE_PATH in "${LOG_FILE_PATHS[@]}"
do
	# Sanity check - if particular $LOG_FILE_PATH is empty string, skip it from further processing
	if [ -z "$LOG_FILE_PATH" ]
	then
		continue
	fi

	# Also for each log file check if its permissions differ from 600. If so, correct them
	if [ -f "$LOG_FILE_PATH" ] &amp;&amp; [ "$(/usr/bin/stat -c %a "$LOG_FILE_PATH")" -ne 600 ]
	then
		/bin/chmod 600 "$LOG_FILE_PATH"
	fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-rsyslog_files_permissions:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-rsyslog_files_permissions_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
      </Group>
      <Group id="xccdf_org.ssgproject.content_group_configure_logwatch_on_logserver">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Configure Logwatch on the Central Log Server</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Is this system the central log server? If so, edit the file <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/logwatch/conf/logwatch.conf</html:code> as shown below.</description>
        <platform idref="cpe:/a:machine"/>
        <Rule id="xccdf_org.ssgproject.content_rule_logwatch_configured_splithosts" selected="false" role="full" severity="unknown">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Configure Logwatch SplitHosts Line</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">If <html:code xmlns:html="http://www.w3.org/1999/xhtml">SplitHosts</html:code> is set, Logwatch will separate entries by hostname.
This makes the report longer but significantly more usable. If it is not
set, then Logwatch will not report which host generated a given log entry,
and that information is almost always necessary
<html:pre xmlns:html="http://www.w3.org/1999/xhtml"> SplitHosts = yes </html:pre></description>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US"/>
          <platform idref="cpe:/a:machine"/>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-logwatch_configured_splithosts:def:1" href="ssg-fedora-oval.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_logwatch_configured_hostlimit" selected="false" role="full" severity="unknown">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Configure Logwatch HostLimit Line</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">On a central logserver, you want Logwatch to summarize all syslog entries,
including those which did not originate on the logserver itself. The
<html:code xmlns:html="http://www.w3.org/1999/xhtml">HostLimit</html:code> setting tells Logwatch to report on all hosts, not just
the one on which it is running.
<html:pre xmlns:html="http://www.w3.org/1999/xhtml"> HostLimit = no </html:pre></description>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US"/>
          <platform idref="cpe:/a:machine"/>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-logwatch_configured_hostlimit:def:1" href="ssg-fedora-oval.xml"/>
          </check>
        </Rule>
      </Group>
    </Group>
    <Group id="xccdf_org.ssgproject.content_group_network">
      <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Network Configuration and Firewalls</title>
      <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Most systems must be connected to a network of some
sort, and this brings with it the substantial risk of network
attack. This section discusses the security impact of decisions
about networking which must be made when configuring a system.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
This section also discusses firewalls, network access
controls, and other network security frameworks, which allow
system-level rules to be written that can limit an attackers' ability
to connect to your system. These rules can specify that network
traffic should be allowed or denied from certain IP addresses,
hosts, and networks. The rules can also specify which of the
system's network services are available to particular hosts or
networks.</description>
      <Rule id="xccdf_org.ssgproject.content_rule_network_sniffer_disabled" selected="false" role="full" severity="medium">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure System is Not Acting as a Network Sniffer</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The system should not be acting as a network sniffer, which can
capture all traffic on the network to which it is connected. Run the following
to determine if any interface is running in promiscuous mode:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ ip link | grep PROMISC</html:pre>
Promiscuous mode of an interface can be disabled with the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo ip link set dev <html:code>device_name</html:code> multicast off promisc off</html:pre></description>
        <reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(2)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">MA-3</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.DP-5</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.AM-1</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.MA-1</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
        <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.11</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.12</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.6</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.2</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.3</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.4</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.5</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.7</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.8</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.4</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.7</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.3</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.4</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.5</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.6</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.7</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.2</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.3</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.3.4</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO11.06</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO12.06</reference>
        <reference href="https://www.isaca.org/resources/cobit">BAI03.10</reference>
        <reference href="https://www.isaca.org/resources/cobit">BAI09.01</reference>
        <reference href="https://www.isaca.org/resources/cobit">BAI09.02</reference>
        <reference href="https://www.isaca.org/resources/cobit">BAI09.03</reference>
        <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
        <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
        <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
        <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS01.05</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS04.05</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS06.06</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.11.1.2</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.11.2.4</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.11.2.5</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.11.2.6</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.12.1.2</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.12.5.1</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.12.6.2</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.14.2.2</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.14.2.3</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.14.2.4</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.16.1.6</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.8.1.1</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.8.1.2</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
        <reference href="https://www.cisecurity.org/controls/">1</reference>
        <reference href="https://www.cisecurity.org/controls/">11</reference>
        <reference href="https://www.cisecurity.org/controls/">14</reference>
        <reference href="https://www.cisecurity.org/controls/">3</reference>
        <reference href="https://www.cisecurity.org/controls/">9</reference>
        <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Network interfaces in promiscuous mode allow for the capture of all network traffic
visible to the system. If unauthorized individuals can access these applications, it
may allow them to collect information such as logon IDs, passwords, and key exchanges
between systems.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
If the system is being used to perform a network troubleshooting function, the use of these
tools must be documented with the Information Systems Security Manager (ISSM) and restricted
to only authorized personnel.</rationale>
        <platform idref="cpe:/a:machine"/>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref name="oval:ssg-network_sniffer_disabled:def:1" href="ssg-fedora-oval.xml"/>
        </check>
        <check system="http://scap.nist.gov/schema/ocil/2">
          <check-content-ref name="ocil:ssg-network_sniffer_disabled_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
        </check>
      </Rule>
      <Rule id="xccdf_org.ssgproject.content_rule_network_disable_zeroconf" selected="false" role="full" severity="unknown">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable Zeroconf Networking</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Zeroconf networking allows the system to assign itself an IP
address and engage in IP communication without a statically-assigned address or
even a DHCP server. Automatic address assignment via Zeroconf (or DHCP) is not
recommended. To disable Zeroconf automatic route assignment in the 169.254.0.0
subnet, add or correct the following line in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/sysconfig/network</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">NOZEROCONF=yes</html:pre></description>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.11</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.12</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.6</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.2</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.3</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.4</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.5</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.7</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.3</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.4</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.5</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.6</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.7</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.2</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.3</reference>
        <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
        <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
        <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
        <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS06.06</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.12.1.2</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.12.5.1</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.12.6.2</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.14.2.2</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.14.2.3</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.14.2.4</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
        <reference href="https://www.cisecurity.org/controls/">11</reference>
        <reference href="https://www.cisecurity.org/controls/">14</reference>
        <reference href="https://www.cisecurity.org/controls/">3</reference>
        <reference href="https://www.cisecurity.org/controls/">9</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
        <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Zeroconf addresses are in the network 169.254.0.0. The networking
scripts add entries to the system's routing table for these addresses. Zeroconf
address assignment commonly occurs when the system is configured to use DHCP
but fails to receive an address assignment from the DHCP server.</rationale>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref name="oval:ssg-network_disable_zeroconf:def:1" href="ssg-fedora-oval.xml"/>
        </check>
      </Rule>
      <Rule id="xccdf_org.ssgproject.content_rule_network_nmcli_permissions" selected="false" role="full" severity="medium">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Prevent non-Privileged Users from Modifying Network Interfaces using nmcli</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">By default, non-privileged users are given permissions to modify networking
interfaces and configurations using the <html:code xmlns:html="http://www.w3.org/1999/xhtml">nmcli</html:code> command. Non-privileged
users should not be making configuration changes to network configurations. To
ensure that non-privileged users do not have permissions to make changes to the
network configuration using <html:code xmlns:html="http://www.w3.org/1999/xhtml">nmcli</html:code>, create the following configuration in
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/polkit-1/localauthority/20-org.d/10-nm-harden-access.pkla</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">
[Disable General User Access to NetworkManager]
Identity=default
Action=org.freedesktop.NetworkManager.*
ResultAny=no
ResultInactive=no
ResultActive=auth_admin
</html:pre></description>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.16</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-18(4)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
        <reference href="">0418</reference>
        <reference href="">1055</reference>
        <reference href="">1402</reference>
        <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Allowing non-privileged users to make changes to network settings can allow
untrusted access, prevent system availability, and/or can lead to a compromise or
attack.</rationale>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="network_nmcli_permissions" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="restrict">
printf "[Disable General User Access to NetworkManager]\nIdentity=default\nAction=org.freedesktop.NetworkManager.*\nResultAny=no\nResultInactive=no\nResultActive=auth_admin\n" &gt; /etc/polkit-1/localauthority/20-org.d/10-nm-harden-access.pkla
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="network_nmcli_permissions" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Ensure non-privileged users do not have access to nmcli
  ini_file:
    path: /etc/polkit-1/localauthority/20-org.d/10-nm-harden-access.pkla
    section: Disable General User Access to NetworkManager
    option: '{{ item.option }}'
    value: '{{ item.value }}'
    no_extra_spaces: true
    create: true
  loop:
    - option: Identity
      value: default
    - option: Action
      value: org.freedesktop.NetworkManager.*
    - option: ResultAny
      value: 'no'
    - option: ResultInactive
      value: 'no'
    - option: ResultActive
      value: auth_admin
  tags:
    - NIST-800-171-3.1.16
    - NIST-800-53-AC-18(4)
    - NIST-800-53-CM-6(a)
    - low_complexity
    - low_disruption
    - medium_severity
    - network_nmcli_permissions
    - no_reboot_needed
    - restrict_strategy
</fix>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref name="oval:ssg-network_nmcli_permissions:def:1" href="ssg-fedora-oval.xml"/>
        </check>
        <check system="http://scap.nist.gov/schema/ocil/2">
          <check-content-ref name="ocil:ssg-network_nmcli_permissions_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
        </check>
      </Rule>
      <Group id="xccdf_org.ssgproject.content_group_network-uncommon">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Uncommon Network Protocols</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The system includes support for several network protocols which are not commonly used.
Although security vulnerabilities in kernel networking code are not frequently discovered,
the consequences can be dramatic. Ensuring uncommon network protocols are disabled
reduces the system's risk to attacks targeted at its implementation of those protocols.</description>
        <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">Although these protocols are not commonly used, avoid disruption
in your network environment by ensuring they are not needed
prior to disabling them.</warning>
        <platform idref="cpe:/a:machine"/>
        <Rule id="xccdf_org.ssgproject.content_rule_kernel_module_rds_disabled" selected="false" role="full" severity="low">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable RDS Support</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The Reliable Datagram Sockets (RDS) protocol is a transport
layer protocol designed to provide reliable high-bandwidth,
low-latency communications between nodes in a cluster.

To configure the system to prevent the <html:code xmlns:html="http://www.w3.org/1999/xhtml">rds</html:code>
kernel module from being loaded, add the following line to a file in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/modprobe.d</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">install rds /bin/true</html:pre></description>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.11</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.12</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.3</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.06</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.5.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.6.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.2.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.2.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
          <reference href="https://www.cisecurity.org/controls/">11</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">9</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disabling RDS protects
the system against exploitation of any flaws in its implementation.</rationale>
          <platform idref="cpe:/a:machine"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="kernel_module_rds_disabled" system="urn:xccdf:fix:script:sh" reboot="true" complexity="low" disruption="medium" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

if LC_ALL=C grep -q -m 1 "^install rds" /etc/modprobe.d/rds.conf ; then
	sed -i 's/^install rds.*/install rds /bin/true/g' /etc/modprobe.d/rds.conf
else
	echo -e "\n# Disable per security requirements" &gt;&gt; /etc/modprobe.d/rds.conf
	echo "install rds /bin/true" &gt;&gt; /etc/modprobe.d/rds.conf
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="kernel_module_rds_disabled" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="medium" strategy="disable">- name: Ensure kernel module 'rds' is disabled
  lineinfile:
    create: true
    dest: /etc/modprobe.d/rds.conf
    regexp: rds
    line: install rds /bin/true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - disable_strategy
    - kernel_module_rds_disabled
    - low_complexity
    - low_severity
    - medium_disruption
    - reboot_required
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-kernel_module_rds_disabled:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-kernel_module_rds_disabled_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_kernel_module_firewire-core_disabled" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable IEEE 1394 (FireWire) Support</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The IEEE 1394 (FireWire) is a serial bus standard for
high-speed real-time communication.

To configure the system to prevent the <html:code xmlns:html="http://www.w3.org/1999/xhtml">firewire-core</html:code>
kernel module from being loaded, add the following line to a file in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/modprobe.d</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">install firewire-core /bin/true</html:pre></description>
          <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_SMF_EXT.1</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000095-GPOS-00049</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-000381</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disabling FireWire protects the system against exploitation of any
flaws in its implementation.</rationale>
          <platform idref="cpe:/a:machine"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="kernel_module_firewire-core_disabled" system="urn:xccdf:fix:script:sh" reboot="true" complexity="low" disruption="medium" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

if LC_ALL=C grep -q -m 1 "^install firewire-core" /etc/modprobe.d/firewire-core.conf ; then
	sed -i 's/^install firewire-core.*/install firewire-core /bin/true/g' /etc/modprobe.d/firewire-core.conf
else
	echo -e "\n# Disable per security requirements" &gt;&gt; /etc/modprobe.d/firewire-core.conf
	echo "install firewire-core /bin/true" &gt;&gt; /etc/modprobe.d/firewire-core.conf
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="kernel_module_firewire-core_disabled" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="medium" strategy="disable">- name: Ensure kernel module 'firewire-core' is disabled
  lineinfile:
    create: true
    dest: /etc/modprobe.d/firewire-core.conf
    regexp: firewire-core
    line: install firewire-core /bin/true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - disable_strategy
    - kernel_module_firewire-core_disabled
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="kernel_module_firewire-core_disabled" system="urn:xccdf:fix:script:kubernetes">apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,install%20firewire-core%20/bin/true%0A
        mode: 0644
        path: /etc/modprobe.d/75-kernel_module_firewire-core_disabled.conf
        overwrite: true
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-kernel_module_firewire-core_disabled:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-kernel_module_firewire-core_disabled_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_kernel_module_tipc_disabled" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable TIPC Support</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The Transparent Inter-Process Communication (TIPC) protocol
is designed to provide communications between nodes in a
cluster.

To configure the system to prevent the <html:code xmlns:html="http://www.w3.org/1999/xhtml">tipc</html:code>
kernel module from being loaded, add the following line to a file in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/modprobe.d</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">install tipc /bin/true</html:pre></description>
          <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">This configuration baseline was created to deploy the base operating system for general purpose
workloads. When the operating system is configured for certain purposes, such as
a node in High Performance Computing cluster, it is expected that
the <html:code xmlns:html="http://www.w3.org/1999/xhtml">tipc</html:code> kernel module will be loaded.</warning>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.11</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.12</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.3</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.06</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.5.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.6.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.2.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.2.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
          <reference href="https://www.cisecurity.org/controls/">11</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">9</reference>
          <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_SMF_EXT.1</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000095-GPOS-00049</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-000381</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disabling TIPC protects
the system against exploitation of any flaws in its implementation.</rationale>
          <platform idref="cpe:/a:machine"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="kernel_module_tipc_disabled" system="urn:xccdf:fix:script:sh" reboot="true" complexity="low" disruption="medium" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

if LC_ALL=C grep -q -m 1 "^install tipc" /etc/modprobe.d/tipc.conf ; then
	sed -i 's/^install tipc.*/install tipc /bin/true/g' /etc/modprobe.d/tipc.conf
else
	echo -e "\n# Disable per security requirements" &gt;&gt; /etc/modprobe.d/tipc.conf
	echo "install tipc /bin/true" &gt;&gt; /etc/modprobe.d/tipc.conf
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="kernel_module_tipc_disabled" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="medium" strategy="disable">- name: Ensure kernel module 'tipc' is disabled
  lineinfile:
    create: true
    dest: /etc/modprobe.d/tipc.conf
    regexp: tipc
    line: install tipc /bin/true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - disable_strategy
    - kernel_module_tipc_disabled
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="kernel_module_tipc_disabled" system="urn:xccdf:fix:script:kubernetes">apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,install%20tipc%20/bin/true%0A
        mode: 0644
        path: /etc/modprobe.d/75-kernel_module_tipc_disabled.conf
        overwrite: true
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-kernel_module_tipc_disabled:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-kernel_module_tipc_disabled_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_kernel_module_dccp_disabled" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable DCCP Support</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The Datagram Congestion Control Protocol (DCCP) is a
relatively new transport layer protocol, designed to support
streaming media and telephony.

To configure the system to prevent the <html:code xmlns:html="http://www.w3.org/1999/xhtml">dccp</html:code>
kernel module from being loaded, add the following line to a file in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/modprobe.d</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">install dccp /bin/true</html:pre></description>
          <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.10.1</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.4.6</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-001958</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.11</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.12</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.3</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.06</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.5.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.6.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.2.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.2.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
          <reference href="https://www.cisecurity.org/controls/">11</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">9</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000096-GPOS-00050</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000378-GPOS-00163</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disabling DCCP protects
the system against exploitation of any flaws in its implementation.</rationale>
          <platform idref="cpe:/a:machine"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="kernel_module_dccp_disabled" system="urn:xccdf:fix:script:sh" reboot="true" complexity="low" disruption="medium" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

if LC_ALL=C grep -q -m 1 "^install dccp" /etc/modprobe.d/dccp.conf ; then
	sed -i 's/^install dccp.*/install dccp /bin/true/g' /etc/modprobe.d/dccp.conf
else
	echo -e "\n# Disable per security requirements" &gt;&gt; /etc/modprobe.d/dccp.conf
	echo "install dccp /bin/true" &gt;&gt; /etc/modprobe.d/dccp.conf
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="kernel_module_dccp_disabled" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="medium" strategy="disable">- name: Ensure kernel module 'dccp' is disabled
  lineinfile:
    create: true
    dest: /etc/modprobe.d/dccp.conf
    regexp: dccp
    line: install dccp /bin/true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.10.1
    - NIST-800-171-3.4.6
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - disable_strategy
    - kernel_module_dccp_disabled
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-kernel_module_dccp_disabled:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-kernel_module_dccp_disabled_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_kernel_module_atm_disabled" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable ATM Support</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The Asynchronous Transfer Mode (ATM) is a protocol operating on
network, data link, and physical layers, based on virtual circuits
and virtual paths.

To configure the system to prevent the <html:code xmlns:html="http://www.w3.org/1999/xhtml">atm</html:code>
kernel module from being loaded, add the following line to a file in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/modprobe.d</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">install atm /bin/true</html:pre></description>
          <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_SMF_EXT.1</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000095-GPOS-00049</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-000381</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disabling ATM protects the system against exploitation of any
flaws in its implementation.</rationale>
          <platform idref="cpe:/a:machine"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="kernel_module_atm_disabled" system="urn:xccdf:fix:script:sh" reboot="true" complexity="low" disruption="medium" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

if LC_ALL=C grep -q -m 1 "^install atm" /etc/modprobe.d/atm.conf ; then
	sed -i 's/^install atm.*/install atm /bin/true/g' /etc/modprobe.d/atm.conf
else
	echo -e "\n# Disable per security requirements" &gt;&gt; /etc/modprobe.d/atm.conf
	echo "install atm /bin/true" &gt;&gt; /etc/modprobe.d/atm.conf
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="kernel_module_atm_disabled" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="medium" strategy="disable">- name: Ensure kernel module 'atm' is disabled
  lineinfile:
    create: true
    dest: /etc/modprobe.d/atm.conf
    regexp: atm
    line: install atm /bin/true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - disable_strategy
    - kernel_module_atm_disabled
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="kernel_module_atm_disabled" system="urn:xccdf:fix:script:kubernetes">apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,install%20atm%20/bin/true%0A
        mode: 0644
        path: /etc/modprobe.d/75-kernel_module_atm_disabled.conf
        overwrite: true
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-kernel_module_atm_disabled:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-kernel_module_atm_disabled_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_kernel_module_can_disabled" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable CAN Support</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The Controller Area Network (CAN) is a serial communications
protocol which was initially developed for automotive and
is now also used in marine, industrial, and medical applications.

To configure the system to prevent the <html:code xmlns:html="http://www.w3.org/1999/xhtml">can</html:code>
kernel module from being loaded, add the following line to a file in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/modprobe.d</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">install can /bin/true</html:pre></description>
          <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_SMF_EXT.1</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000095-GPOS-00049</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-000381</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disabling CAN protects the system against exploitation of any
flaws in its implementation.</rationale>
          <platform idref="cpe:/a:machine"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="kernel_module_can_disabled" system="urn:xccdf:fix:script:sh" reboot="true" complexity="low" disruption="medium" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

if LC_ALL=C grep -q -m 1 "^install can" /etc/modprobe.d/can.conf ; then
	sed -i 's/^install can.*/install can /bin/true/g' /etc/modprobe.d/can.conf
else
	echo -e "\n# Disable per security requirements" &gt;&gt; /etc/modprobe.d/can.conf
	echo "install can /bin/true" &gt;&gt; /etc/modprobe.d/can.conf
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="kernel_module_can_disabled" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="medium" strategy="disable">- name: Ensure kernel module 'can' is disabled
  lineinfile:
    create: true
    dest: /etc/modprobe.d/can.conf
    regexp: can
    line: install can /bin/true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - disable_strategy
    - kernel_module_can_disabled
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="kernel_module_can_disabled" system="urn:xccdf:fix:script:kubernetes">apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,install%20can%20/bin/true%0A
        mode: 0644
        path: /etc/modprobe.d/75-kernel_module_can_disabled.conf
        overwrite: true
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-kernel_module_can_disabled:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-kernel_module_can_disabled_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
      </Group>
      <Group id="xccdf_org.ssgproject.content_group_network-wireless">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Wireless Networking</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Wireless networking, such as 802.11
(WiFi) and Bluetooth, can present a security risk to sensitive or
classified systems and networks. Wireless networking hardware is
much more likely to be included in laptop or portable systems than
in desktops or servers. 
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Removal of hardware provides the greatest assurance that the wireless
capability remains disabled. Acquisition policies often include provisions to
prevent the purchase of equipment that will be used in sensitive spaces and
includes wireless capabilities. If it is impractical to remove the wireless
hardware, and policy permits the device to enter sensitive spaces as long
as wireless is disabled, efforts should instead focus on disabling wireless capability
via software.</description>
        <Group id="xccdf_org.ssgproject.content_group_wireless_software">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable Wireless Through Software Configuration</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">If it is impossible to remove the wireless hardware
from the device in question, disable as much of it as possible
through software. The following methods can disable software
support for wireless networking, but note that these methods do not
prevent malicious software or careless users from re-activating the
devices.</description>
          <Rule id="xccdf_org.ssgproject.content_rule_service_bluetooth_disabled" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable Bluetooth Service</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">
The <html:code xmlns:html="http://www.w3.org/1999/xhtml">bluetooth</html:code> service can be disabled with the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo systemctl mask --now bluetooth.service</html:pre>
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo service bluetooth stop</html:pre></description>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.16</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000085</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-001551</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-18(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-18(3)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">MP-7</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.11</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.12</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.3</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.06</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.2.6</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.5.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.6.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
            <reference href="https://www.cisecurity.org/controls/">11</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">8</reference>
            <reference href="https://www.cisecurity.org/controls/">9</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disabling the <html:code xmlns:html="http://www.w3.org/1999/xhtml">bluetooth</html:code> service prevents the system from attempting
connections to Bluetooth devices, which entails some security risk.
Nevertheless, variation in this risk decision may be expected due to the
utility of Bluetooth connectivity and its limited range.</rationale>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="service_bluetooth_disabled" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

SYSTEMCTL_EXEC='/usr/bin/systemctl'
"$SYSTEMCTL_EXEC" stop 'bluetooth.service'
"$SYSTEMCTL_EXEC" disable 'bluetooth.service'
"$SYSTEMCTL_EXEC" mask 'bluetooth.service'
# Disable socket activation if we have a unit file for it
if "$SYSTEMCTL_EXEC" list-unit-files | grep -q '^bluetooth.socket'; then
    "$SYSTEMCTL_EXEC" stop 'bluetooth.socket'
    "$SYSTEMCTL_EXEC" mask 'bluetooth.socket'
fi
# The service may not be running because it has been started and failed,
# so let's reset the state so OVAL checks pass.
# Service should be 'inactive', not 'failed' after reboot though.
"$SYSTEMCTL_EXEC" reset-failed 'bluetooth.service' || true

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="service_bluetooth_disabled" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="disable">- name: Disable service bluetooth
  block:

    - name: Gather the service facts
      service_facts: null

    - name: Disable service bluetooth
      systemd:
        name: bluetooth.service
        enabled: 'no'
        state: stopped
        masked: 'yes'
      when: '"bluetooth.service" in ansible_facts.services'
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.16
    - NIST-800-53-AC-18(3)
    - NIST-800-53-AC-18(a)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - disable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - service_bluetooth_disabled

- name: Unit Socket Exists - bluetooth.socket
  command: systemctl list-unit-files bluetooth.socket
  args:
    warn: false
  register: socket_file_exists
  changed_when: false
  ignore_errors: true
  check_mode: false
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.16
    - NIST-800-53-AC-18(3)
    - NIST-800-53-AC-18(a)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - disable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - service_bluetooth_disabled

- name: Disable socket bluetooth
  systemd:
    name: bluetooth.socket
    enabled: 'no'
    state: stopped
    masked: 'yes'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - '"bluetooth.socket" in socket_file_exists.stdout_lines[1]'
  tags:
    - NIST-800-171-3.1.16
    - NIST-800-53-AC-18(3)
    - NIST-800-53-AC-18(a)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - disable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - service_bluetooth_disabled
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="service_bluetooth_disabled" system="urn:xccdf:fix:script:puppet" complexity="low" disruption="low" strategy="enable">include disable_bluetooth

class disable_bluetooth {
  service {'bluetooth':
    enable =&gt; false,
    ensure =&gt; 'stopped',
  }
}
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="service_bluetooth_disabled" system="urn:xccdf:fix:script:kubernetes" reboot="true" complexity="low" disruption="medium" strategy="disable">apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    systemd:
      units:
      - name: bluetooth.service
        enabled: false
        mask: true
      - name: bluetooth.socket
        enabled: false
        mask: true
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-service_bluetooth_disabled:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-service_bluetooth_disabled_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_kernel_module_bluetooth_disabled" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable Bluetooth Kernel Module</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The kernel's module loading system can be configured to prevent
loading of the Bluetooth module. Add the following to
the appropriate <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/modprobe.d</html:code> configuration file
to prevent the loading of the Bluetooth module:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">install bluetooth /bin/true</html:pre></description>
            <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.13.1.3</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.16</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000085</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-001551</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-001443</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-18(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-18(3)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">MP-7</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.11</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.12</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.3</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.06</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.2.6</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.5.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.6.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
            <reference href="https://www.cisecurity.org/controls/">11</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">8</reference>
            <reference href="https://www.cisecurity.org/controls/">9</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000095-GPOS-00049</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000300-GPOS-00118</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">If Bluetooth functionality must be disabled, preventing the kernel
from loading the kernel module provides an additional safeguard against its
activation.</rationale>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="kernel_module_bluetooth_disabled" system="urn:xccdf:fix:script:sh" reboot="true" complexity="low" disruption="medium" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

if LC_ALL=C grep -q -m 1 "^install bluetooth" /etc/modprobe.d/bluetooth.conf ; then
	sed -i 's/^install bluetooth.*/install bluetooth /bin/true/g' /etc/modprobe.d/bluetooth.conf
else
	echo -e "\n# Disable per security requirements" &gt;&gt; /etc/modprobe.d/bluetooth.conf
	echo "install bluetooth /bin/true" &gt;&gt; /etc/modprobe.d/bluetooth.conf
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="kernel_module_bluetooth_disabled" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="medium" strategy="disable">- name: Ensure kernel module 'bluetooth' is disabled
  lineinfile:
    create: true
    dest: /etc/modprobe.d/bluetooth.conf
    regexp: bluetooth
    line: install bluetooth /bin/true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.13.1.3
    - NIST-800-171-3.1.16
    - NIST-800-53-AC-18(3)
    - NIST-800-53-AC-18(a)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - disable_strategy
    - kernel_module_bluetooth_disabled
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="kernel_module_bluetooth_disabled" system="urn:xccdf:fix:script:kubernetes">apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,install%20bluetooth%20/bin/true%0A
        mode: 0644
        path: /etc/modprobe.d/75-kernel_module_bluetooth_disabled.conf
        overwrite: true
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-kernel_module_bluetooth_disabled:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-kernel_module_bluetooth_disabled_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_wireless_disable_interfaces" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Deactivate Wireless Network Interfaces</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Deactivating wireless network interfaces should prevent
normal usage of the wireless capability.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>

Configure the system to disable all wireless network interfaces with the
following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo nmcli radio wifi off</html:pre></description>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.16</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000085</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-002418</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-002421</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-001444</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-18(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-18(3)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">MP-7</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000299-GPOS-00117</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000300-GPOS-00118</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000424-GPOS-00188</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000481-GPOS-000481</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.11</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.12</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.3</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.06</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.2.6</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.5.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.6.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
            <reference href="https://www.cisecurity.org/controls/">11</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">8</reference>
            <reference href="https://www.cisecurity.org/controls/">9</reference>
            <reference href="">1315</reference>
            <reference href="">1319</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The use of wireless networking can introduce many different attack vectors into
the organization's network. Common attack vectors such as malicious association
and ad hoc networks will allow an attacker to spoof a wireless access point
(AP), allowing validated systems to connect to the malicious AP and enabling the
attacker to monitor and record network traffic. These malicious APs can also
serve to create a man-in-the-middle attack or be used to create a denial of
service to valid network resources.</rationale>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="wireless_disable_interfaces" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

nmcli radio wifi off

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="wireless_disable_interfaces" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="medium">- name: Deactivate Wireless Network Interfaces
  command: nmcli radio wifi off
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.16
    - NIST-800-53-AC-18(3)
    - NIST-800-53-AC-18(a)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy
    - wireless_disable_interfaces
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-wireless_disable_interfaces:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-wireless_disable_interfaces_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_wireless_disable_in_bios" selected="false" role="full" severity="unknown">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable WiFi or Bluetooth in BIOS</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Some machines that include built-in wireless support offer the
ability to disable the device through the BIOS. This is hardware-specific;
consult your hardware manual or explore the BIOS setup during
boot.</description>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000085</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-18(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-18(3)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">MP-7</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.11</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.12</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.3</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.06</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.2.6</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.5.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.6.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
            <reference href="https://www.cisecurity.org/controls/">11</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">8</reference>
            <reference href="https://www.cisecurity.org/controls/">9</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disabling wireless support in the BIOS prevents easy
activation of the wireless interface, generally requiring administrators
to reboot the system first.</rationale>
            <platform idref="cpe:/a:machine"/>
          </Rule>
        </Group>
      </Group>
      <Group id="xccdf_org.ssgproject.content_group_network_disable_unused_interfaces">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable Unused Interfaces</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Network interfaces expand the attack surface of the
system.  Unused interfaces are not monitored or controlled, and
should be disabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
If the system does not require network communications but still
needs to use the loopback interface, remove all files of the form
<html:code xmlns:html="http://www.w3.org/1999/xhtml">ifcfg-<html:i>interface</html:i></html:code> except for <html:code xmlns:html="http://www.w3.org/1999/xhtml">ifcfg-lo</html:code> from
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/sysconfig/network-scripts</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo rm /etc/sysconfig/network-scripts/ifcfg-<html:i>interface</html:i></html:pre>
If the system is a standalone machine with no need for network access or even
communication over the loopback device, then disable this service.

The <html:code xmlns:html="http://www.w3.org/1999/xhtml">network</html:code> service can be disabled with the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo systemctl mask --now network.service</html:pre></description>
      </Group>
      <Group id="xccdf_org.ssgproject.content_group_network-susefirewall2">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">SuSEfirewall2</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The SuSEfirewall2 provides a managed firewall.</description>
      </Group>
      <Group id="xccdf_org.ssgproject.content_group_network-iptables">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">iptables and ip6tables</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">A host-based firewall called <html:code xmlns:html="http://www.w3.org/1999/xhtml">netfilter</html:code> is included as
part of the Linux kernel distributed with the system. It is
activated by default. This firewall is controlled by the program
<html:code xmlns:html="http://www.w3.org/1999/xhtml">iptables</html:code>, and the entire capability is frequently referred to by
this name. An analogous program called <html:code xmlns:html="http://www.w3.org/1999/xhtml">ip6tables</html:code> handles filtering
for IPv6.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Unlike TCP Wrappers, which depends on the network server
program to support and respect the rules written, <html:code xmlns:html="http://www.w3.org/1999/xhtml">netfilter</html:code>
filtering occurs at the kernel level, before a program can even
process the data from the network packet. As such, any program on
the system is affected by the rules written.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
This section provides basic information about strengthening
the <html:code xmlns:html="http://www.w3.org/1999/xhtml">iptables</html:code> and <html:code xmlns:html="http://www.w3.org/1999/xhtml">ip6tables</html:code> configurations included with the system.
For more complete information that may allow the construction of a
sophisticated ruleset tailored to your environment, please consult
the references at the end of this section.</description>
        <Rule id="xccdf_org.ssgproject.content_rule_package_iptables_installed" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Install iptables Package</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">iptables</html:code> package can be installed with the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">
$ sudo dnf install iptables</html:pre></description>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US"><html:code xmlns:html="http://www.w3.org/1999/xhtml">iptables</html:code> controls the Linux kernel network packet filtering
code. <html:code xmlns:html="http://www.w3.org/1999/xhtml">iptables</html:code> allows system operators to set up firewalls and IP
masquerading, etc.</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_iptables_installed" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="enable">
if ! rpm -q --quiet "iptables" ; then
    dnf install -y "iptables"
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_iptables_installed" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="enable">- name: Ensure iptables is installed
  package:
    name: iptables
    state: present
  tags:
    - NIST-800-53-CM-6(a)
    - enable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - package_iptables_installed
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_iptables_installed" system="urn:xccdf:fix:script:puppet" complexity="low" disruption="low" strategy="enable">include install_iptables

class install_iptables {
  package { 'iptables':
    ensure =&gt; 'installed',
  }
}
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_iptables_installed" system="urn:redhat:anaconda:pre" complexity="low" disruption="low" strategy="enable">
package --add=iptables
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_iptables_installed" system="urn:redhat:osbuild:blueprint">
[[packages]]
name = "iptables"
version = "*"
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-package_iptables_installed:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-package_iptables_installed_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Group id="xccdf_org.ssgproject.content_group_iptables_ruleset_modifications">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Strengthen the Default Ruleset</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The default rules can be strengthened. The system
scripts that activate the firewall rules expect them to be defined
in the configuration files <html:code xmlns:html="http://www.w3.org/1999/xhtml">iptables</html:code> and <html:code xmlns:html="http://www.w3.org/1999/xhtml">ip6tables</html:code> in the directory
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/sysconfig</html:code>. Many of the lines in these files are similar
to the command line arguments that would be provided to the programs
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/sbin/iptables</html:code> or <html:code xmlns:html="http://www.w3.org/1999/xhtml">/sbin/ip6tables</html:code> - but some are quite
different.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
The following recommendations describe how to strengthen the
default ruleset configuration file. An alternative to editing this
configuration file is to create a shell script that makes calls to
the iptables program to load in rules, and then invokes service
iptables save to write those loaded rules to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/sysconfig/iptables.</html:code>
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
The following alterations can be made directly to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/sysconfig/iptables</html:code> and <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/sysconfig/ip6tables</html:code>.
Instructions apply to both unless otherwise noted. Language and address
conventions for regular iptables are used throughout this section;
configuration for ip6tables will be either analogous or explicitly
covered.</description>
          <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">The program <html:code xmlns:html="http://www.w3.org/1999/xhtml">system-config-securitylevel</html:code>
allows additional services to penetrate the default firewall rules
and automatically adjusts <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/sysconfig/iptables</html:code>. This program
is only useful if the default ruleset meets your security
requirements. Otherwise, this program should not be used to make
changes to the firewall configuration because it re-writes the
saved configuration file.</warning>
          <Rule id="xccdf_org.ssgproject.content_rule_set_iptables_default_rule" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Set Default iptables Policy for Incoming Packets</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To set the default policy to DROP (instead of ACCEPT) for
the built-in INPUT chain which processes incoming packets,
add or correct the following line in
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/sysconfig/iptables</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">:INPUT DROP [0:0]</html:pre></description>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CA-3(5)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-7(23)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.11</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.12</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.3</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.06</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.5.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.6.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
            <reference href="https://www.cisecurity.org/controls/">11</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">9</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">In <html:code xmlns:html="http://www.w3.org/1999/xhtml">iptables</html:code> the default policy is applied only after all
the applicable rules in the table are examined for a match. Setting the
default policy to <html:code xmlns:html="http://www.w3.org/1999/xhtml">DROP</html:code> implements proper design for a firewall, i.e.
any packets which are not explicitly permitted should not be
accepted.</rationale>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-set_iptables_default_rule_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_set_iptables_default_rule_forward" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Set Default iptables Policy for Forwarded Packets</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To set the default policy to DROP (instead of ACCEPT) for
the built-in FORWARD chain which processes packets that will be forwarded from
one interface to another,
add or correct the following line in
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/sysconfig/iptables</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">:FORWARD DROP [0:0]</html:pre></description>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CA-3(5)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-7(23)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.11</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.12</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.3</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.06</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.5.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.6.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
            <reference href="https://www.cisecurity.org/controls/">11</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">9</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">In <html:code xmlns:html="http://www.w3.org/1999/xhtml">iptables</html:code>, the default policy is applied only after all
the applicable rules in the table are examined for a match. Setting the
default policy to <html:code xmlns:html="http://www.w3.org/1999/xhtml">DROP</html:code> implements proper design for a firewall, i.e.
any packets which are not explicitly permitted should not be
accepted.</rationale>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-set_iptables_default_rule_forward_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Group id="xccdf_org.ssgproject.content_group_iptables_icmp_disabled">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Restrict ICMP Message Types</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">In <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/sysconfig/iptables</html:code>, the accepted ICMP messages
types can be restricted. To accept only ICMP echo reply, destination
unreachable, and time exceeded messages, remove the line:<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-A INPUT -p icmp --icmp-type any -j ACCEPT</html:pre>
and insert the lines:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-A INPUT -p icmp --icmp-type echo-reply -j ACCEPT
-A INPUT -p icmp --icmp-type destination-unreachable -j ACCEPT
-A INPUT -p icmp --icmp-type time-exceeded -j ACCEPT</html:pre>
To allow the system to respond to pings, also insert the following line:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-A INPUT -p icmp --icmp-type echo-request -j ACCEPT</html:pre>
Ping responses can also be limited to certain networks or hosts by using the -s
option in the previous rule.  Because IPv6 depends so heavily on ICMPv6, it is
preferable to deny the ICMPv6 packets you know you don't need (e.g. ping
requests) in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/sysconfig/ip6tables</html:code>, while letting everything else
through:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-A INPUT -p icmpv6 --icmpv6-type echo-request -j DROP</html:pre>
If you are going to statically configure the system's address, it should
ignore Router Advertisements which could add another IPv6 address to the
interface or alter important network settings:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-A INPUT -p icmpv6 --icmpv6-type router-advertisement -j DROP</html:pre>
Restricting ICMPv6 message types in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/sysconfig/ip6tables</html:code> is not
recommended because the operation of IPv6 depends heavily on ICMPv6. Thus, great
care must be taken if any other ICMPv6 types are blocked.</description>
          </Group>
          <Group id="xccdf_org.ssgproject.content_group_iptables_log_and_drop_suspicious">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Log and Drop Packets with Suspicious Source Addresses</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Packets with non-routable source addresses should be rejected, as they may indicate spoofing. Because the
modified policy will reject non-matching packets, you only need to add these rules if you are interested in also
logging these spoofing or suspicious attempts before they are dropped. If you do choose to log various suspicious
traffic, add identical rules with a target of <html:code xmlns:html="http://www.w3.org/1999/xhtml">DROP</html:code> after each <html:i xmlns:html="http://www.w3.org/1999/xhtml">LOG</html:i>.
To log and then drop these IPv4 packets, insert the following rules in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/sysconfig/iptables</html:code> (excepting
any that are intentionally used):
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-A INPUT -s 10.0.0.0/8 -j LOG --log-prefix "IP DROP SPOOF A: "
-A INPUT -s 172.16.0.0/12 -j LOG --log-prefix "IP DROP SPOOF B: "
-A INPUT -s 192.168.0.0/16 -j LOG --log-prefix "IP DROP SPOOF C: "
-A INPUT -s 224.0.0.0/4 -j LOG --log-prefix "IP DROP MULTICAST D: "
-A INPUT -s 240.0.0.0/5 -j LOG --log-prefix "IP DROP SPOOF E: "
-A INPUT -d 127.0.0.0/8 -j LOG --log-prefix "IP DROP LOOPBACK: "</html:pre>
Similarly, you might wish to log packets containing some IPv6 reserved addresses if they are not expected
on your network:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-A INPUT -i eth0 -s ::1 -j LOG --log-prefix "IPv6 DROP LOOPBACK: "
-A INPUT -s 2002:E000::/20 -j LOG --log-prefix "IPv6 6to4 TRAFFIC: "
-A INPUT -s 2002:7F00::/24 -j LOG --log-prefix "IPv6 6to4 TRAFFIC: "
-A INPUT -s 2002:0000::/24 -j LOG --log-prefix "IPv6 6to4 TRAFFIC: "
-A INPUT -s 2002:FF00::/24 -j LOG --log-prefix "IPv6 6to4 TRAFFIC: "
-A INPUT -s 2002:0A00::/24 -j LOG --log-prefix "IPv6 6to4 TRAFFIC: "
-A INPUT -s 2002:AC10::/28 -j LOG --log-prefix "IPv6 6to4 TRAFFIC: "
-A INPUT -s 2002:C0A8::/32 -j LOG --log-prefix "IPv6 6to4 TRAFFIC: "</html:pre>
If you are not expecting to see site-local multicast or auto-tunneled traffic, you can log those:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-A INPUT -s FF05::/16 -j LOG --log-prefix "IPv6 SITE-LOCAL MULTICAST: "
-A INPUT -s ::0.0.0.0/96 -j LOG --log-prefix "IPv4 COMPATIBLE IPv6 ADDR: "</html:pre>
If you wish to block multicasts to all link-local nodes (e.g. if you are not using router auto-configuration and
do not plan to have any services that multicast to the entire local network), you can block the link-local
all-nodes multicast address (before accepting incoming ICMPv6):
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-A INPUT -d FF02::1 -j LOG --log-prefix "Link-local All-Nodes Multicast: "</html:pre>
However, if you're going to allow IPv4 compatible IPv6 addresses (of the form ::0.0.0.0/96), you should
then consider logging the non-routable IPv4-compatible addresses:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-A INPUT -s ::0.0.0.0/104 -j LOG --log-prefix "IP NON-ROUTABLE ADDR: "
-A INPUT -s ::127.0.0.0/104 -j LOG --log-prefix "IP DROP LOOPBACK: "
-A INPUT -s ::224.0.0.0.0/100 -j LOG --log-prefix "IP DROP MULTICAST D: "
-A INPUT -s ::255.0.0.0/104 -j LOG --log-prefix "IP BROADCAST: "</html:pre>
If you are not expecting to see any IPv4 (or IPv4-compatible) traffic on your network, consider logging it before it gets dropped:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-A INPUT -s ::FFFF:0.0.0.0/96 -j LOG --log-prefix "IPv4 MAPPED IPv6 ADDR: "
-A INPUT -s 2002::/16 -j LOG --log-prefix "IPv6 6to4 ADDR: "</html:pre>
The following rule will log all traffic originating from a site-local address, which is deprecated address space:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-A INPUT -s FEC0::/10 -j LOG --log-prefix "SITE-LOCAL ADDRESS TRAFFIC: "</html:pre></description>
          </Group>
        </Group>
        <Group id="xccdf_org.ssgproject.content_group_iptables_activation">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Inspect and Activate Default Rules</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">View the currently-enforced <html:code xmlns:html="http://www.w3.org/1999/xhtml">iptables</html:code> rules by running
the command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo iptables -nL --line-numbers</html:pre>
The command is analogous for <html:code xmlns:html="http://www.w3.org/1999/xhtml">ip6tables</html:code>.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
If the firewall does not appear to be active (i.e., no rules
appear), activate it and ensure that it starts at boot by issuing
the following commands (and analogously for <html:code xmlns:html="http://www.w3.org/1999/xhtml">ip6tables</html:code>):
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo service iptables restart</html:pre>
The default iptables rules are:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">Chain INPUT (policy ACCEPT)
num  target     prot opt source       destination
1    ACCEPT     all  --  0.0.0.0/0    0.0.0.0/0    state RELATED,ESTABLISHED 
2    ACCEPT     icmp --  0.0.0.0/0    0.0.0.0/0
3    ACCEPT     all  --  0.0.0.0/0    0.0.0.0/0
4    ACCEPT     tcp  --  0.0.0.0/0    0.0.0.0/0    state NEW tcp dpt:22 
5    REJECT     all  --  0.0.0.0/0    0.0.0.0/0    reject-with icmp-host-prohibited 

Chain FORWARD (policy ACCEPT)
num  target     prot opt source       destination
1    REJECT     all  --  0.0.0.0/0    0.0.0.0/0    reject-with icmp-host-prohibited 

Chain OUTPUT (policy ACCEPT)
num  target     prot opt source       destination</html:pre>
The <html:code xmlns:html="http://www.w3.org/1999/xhtml">ip6tables</html:code> default rules are essentially the same.</description>
          <Rule id="xccdf_org.ssgproject.content_rule_service_ip6tables_enabled" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Verify ip6tables Enabled if Using IPv6</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">
The <html:code xmlns:html="http://www.w3.org/1999/xhtml">ip6tables</html:code> service can be enabled with the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo systemctl enable ip6tables.service</html:pre></description>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-4</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CA-3(5)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-7(21)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.AM-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-5</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.11</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.12</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.3.3</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.06</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.10.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.1.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.1.5</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.5.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.6.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.1.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.7.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.7.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.7.3.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.8.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.8.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.5</reference>
            <reference href="https://www.cisecurity.org/controls/">1</reference>
            <reference href="https://www.cisecurity.org/controls/">11</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">13</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">18</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">4</reference>
            <reference href="https://www.cisecurity.org/controls/">6</reference>
            <reference href="https://www.cisecurity.org/controls/">8</reference>
            <reference href="https://www.cisecurity.org/controls/">9</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">ip6tables</html:code> service provides the system's host-based firewalling
capability for IPv6 and ICMPv6.</rationale>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="service_ip6tables_enabled" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="enable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

SYSTEMCTL_EXEC='/usr/bin/systemctl'
"$SYSTEMCTL_EXEC" unmask 'ip6tables.service'
"$SYSTEMCTL_EXEC" start 'ip6tables.service'
"$SYSTEMCTL_EXEC" enable 'ip6tables.service'

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="service_ip6tables_enabled" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="enable">- name: Enable service ip6tables
  block:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: Enable service ip6tables
      service:
        name: ip6tables
        enabled: 'yes'
        state: started
        masked: 'no'
      when:
        - '"iptables-ipv6" in ansible_facts.packages'
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-4
    - NIST-800-53-CA-3(5)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-SC-7(21)
    - enable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - service_ip6tables_enabled
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="service_ip6tables_enabled" system="urn:xccdf:fix:script:puppet" complexity="low" disruption="low" strategy="enable">include enable_ip6tables

class enable_ip6tables {
  service {'ip6tables':
    enable =&gt; true,
    ensure =&gt; 'running',
  }
}
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-service_ip6tables_enabled:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-service_ip6tables_enabled_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_service_iptables_enabled" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Verify iptables Enabled</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">
The <html:code xmlns:html="http://www.w3.org/1999/xhtml">iptables</html:code> service can be enabled with the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo systemctl enable iptables.service</html:pre></description>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-4</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CA-3(5)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-7(21)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.AM-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-5</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.11</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.12</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.3.3</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.06</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.10.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.1.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.1.5</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.5.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.6.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.1.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.7.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.7.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.7.3.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.8.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.8.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.5</reference>
            <reference href="https://www.cisecurity.org/controls/">1</reference>
            <reference href="https://www.cisecurity.org/controls/">11</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">13</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">18</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">4</reference>
            <reference href="https://www.cisecurity.org/controls/">6</reference>
            <reference href="https://www.cisecurity.org/controls/">8</reference>
            <reference href="https://www.cisecurity.org/controls/">9</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">iptables</html:code> service provides the system's host-based firewalling
capability for IPv4 and ICMP.</rationale>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="service_iptables_enabled" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="enable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

SYSTEMCTL_EXEC='/usr/bin/systemctl'
"$SYSTEMCTL_EXEC" unmask 'iptables.service'
"$SYSTEMCTL_EXEC" start 'iptables.service'
"$SYSTEMCTL_EXEC" enable 'iptables.service'

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="service_iptables_enabled" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="enable">- name: Enable service iptables
  block:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: Enable service iptables
      service:
        name: iptables
        enabled: 'yes'
        state: started
        masked: 'no'
      when:
        - '"iptables" in ansible_facts.packages'
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-4
    - NIST-800-53-CA-3(5)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-SC-7(21)
    - enable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - service_iptables_enabled
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="service_iptables_enabled" system="urn:xccdf:fix:script:puppet" complexity="low" disruption="low" strategy="enable">include enable_iptables

class enable_iptables {
  service {'iptables':
    enable =&gt; true,
    ensure =&gt; 'running',
  }
}
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-service_iptables_enabled:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-service_iptables_enabled_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_set_ip6tables_default_rule" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Set Default ip6tables Policy for Incoming Packets</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To set the default policy to DROP (instead of ACCEPT) for
the built-in INPUT chain which processes incoming packets,
add or correct the following line in
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/sysconfig/ip6tables</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">:INPUT DROP [0:0]</html:pre>
If changes were required, reload the ip6tables rules:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo service ip6tables reload</html:pre></description>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-4</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CA-3(5)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-7(21)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.11</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.12</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.3</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.06</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.5.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.6.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
            <reference href="https://www.cisecurity.org/controls/">11</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">9</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">In <html:code xmlns:html="http://www.w3.org/1999/xhtml">ip6tables</html:code>, the default policy is applied only after all
the applicable rules in the table are examined for a match. Setting the
default policy to <html:code xmlns:html="http://www.w3.org/1999/xhtml">DROP</html:code> implements proper design for a firewall, i.e.
any packets which are not explicitly permitted should not be
accepted.</rationale>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-set_ip6tables_default_rule_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
        </Group>
      </Group>
      <Group id="xccdf_org.ssgproject.content_group_network-ipsec">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">IPSec Support</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Support for Internet Protocol Security (IPsec)
is provided with Libreswan.</description>
        <Rule id="xccdf_org.ssgproject.content_rule_package_libreswan_installed" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Install libreswan Package</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The Libreswan package provides an implementation of IPsec
and IKE, which permits the creation of secure tunnels over
untrusted networks. The <html:code xmlns:html="http://www.w3.org/1999/xhtml">libreswan</html:code> package can be installed with the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">
$ sudo dnf install libreswan</html:pre></description>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-001130</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-001131</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.MA-2</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
          <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-4.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS01.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.11.2.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.11.2.6</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.15.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.15.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.6.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.6.2.2</reference>
          <reference href="https://www.cisecurity.org/controls/">12</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">5</reference>
          <reference href="https://www.cisecurity.org/controls/">8</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000120-GPOS-00061</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Providing the ability for remote users or systems
to initiate a secure VPN connection protects information when it is
transmitted over a wide area network.</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_libreswan_installed" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="enable">
if ! rpm -q --quiet "libreswan" ; then
    dnf install -y "libreswan"
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_libreswan_installed" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="enable">- name: Ensure libreswan is installed
  package:
    name: libreswan
    state: present
  tags:
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-4.1
    - enable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - package_libreswan_installed
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_libreswan_installed" system="urn:xccdf:fix:script:puppet" complexity="low" disruption="low" strategy="enable">include install_libreswan

class install_libreswan {
  package { 'libreswan':
    ensure =&gt; 'installed',
  }
}
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_libreswan_installed" system="urn:redhat:anaconda:pre" complexity="low" disruption="low" strategy="enable">
package --add=libreswan
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_libreswan_installed" system="urn:redhat:osbuild:blueprint">
[[packages]]
name = "libreswan"
version = "*"
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-package_libreswan_installed:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-package_libreswan_installed_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_libreswan_approved_tunnels" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Verify Any Configured IPSec Tunnel Connections</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Libreswan provides an implementation of IPsec
and IKE, which permits the creation of secure tunnels over
untrusted networks. As such, IPsec can be used to circumvent certain
network requirements such as filtering. Verify that if any IPsec connection
(<html:code xmlns:html="http://www.w3.org/1999/xhtml">conn</html:code>) configured in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/ipsec.conf</html:code> and <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/ipsec.d</html:code>
exists is an approved organizational connection.</description>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-000336</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(4)(i)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(1)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(3)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(1)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(2)(ii)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">MA-4(6)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-4</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-8</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.AM-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-5</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.3.3</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS01.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.10.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.11.1.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.11.1.5</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.11.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.1.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.2.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.2.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.6.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.7.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.7.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.7.3.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.8.2.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.8.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.5</reference>
          <reference href="https://www.cisecurity.org/controls/">1</reference>
          <reference href="https://www.cisecurity.org/controls/">12</reference>
          <reference href="https://www.cisecurity.org/controls/">13</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">16</reference>
          <reference href="https://www.cisecurity.org/controls/">18</reference>
          <reference href="https://www.cisecurity.org/controls/">4</reference>
          <reference href="https://www.cisecurity.org/controls/">6</reference>
          <reference href="https://www.cisecurity.org/controls/">8</reference>
          <reference href="https://www.cisecurity.org/controls/">9</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">IP tunneling mechanisms can be used to bypass network filtering.</rationale>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-libreswan_approved_tunnels_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
      </Group>
      <Group id="xccdf_org.ssgproject.content_group_network-firewalld">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">firewalld</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The dynamic firewall daemon <html:code xmlns:html="http://www.w3.org/1999/xhtml">firewalld</html:code> provides a
dynamically managed firewall with support for network “zones” to assign
a level of trust to a network and its associated connections and interfaces.
It has support for IPv4 and IPv6 firewall settings. It supports Ethernet
bridges and has a separation of runtime and permanent configuration options.
It also has an interface for services or applications to add firewall rules
directly.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
A graphical configuration tool, <html:code xmlns:html="http://www.w3.org/1999/xhtml">firewall-config</html:code>, is used to configure
<html:code xmlns:html="http://www.w3.org/1999/xhtml">firewalld</html:code>, which in turn uses <html:code xmlns:html="http://www.w3.org/1999/xhtml">iptables</html:code> tool to communicate
with <html:code xmlns:html="http://www.w3.org/1999/xhtml">Netfilter</html:code> in the kernel which implements packet filtering.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
The firewall service provided by <html:code xmlns:html="http://www.w3.org/1999/xhtml">firewalld</html:code> is dynamic rather than
static because changes to the configuration can be made at anytime and are
immediately implemented. There is no need to save or apply the changes. No
unintended disruption of existing network connections occurs as no part of
the firewall has to be reloaded.</description>
        <platform idref="cpe:/a:machine"/>
        <Group id="xccdf_org.ssgproject.content_group_firewalld_activation">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Inspect and Activate Default firewalld Rules</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Firewalls can be used to separate networks into different zones
based on the level of trust the user has decided to place on the devices and
traffic within that network. <html:code xmlns:html="http://www.w3.org/1999/xhtml">NetworkManager</html:code> informs firewalld to which
zone an interface belongs. An interface's assigned zone can be changed by
<html:code xmlns:html="http://www.w3.org/1999/xhtml">NetworkManager</html:code> or via the <html:code xmlns:html="http://www.w3.org/1999/xhtml">firewall-config</html:code> tool.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
The zone settings in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/firewalld/</html:code> are a range of preset settings
which can be quickly applied to a network interface. These are the zones
provided by firewalld sorted according to the default trust level of the
zones from untrusted to trusted:
<html:ul xmlns:html="http://www.w3.org/1999/xhtml"><html:li><html:code>drop</html:code><html:br/><html:p>Any incoming network packets are dropped, there is no
reply. Only outgoing network connections are possible.</html:p></html:li><html:li><html:code>block</html:code><html:br/><html:p>Any incoming network connections are rejected with an
<html:code>icmp-host-prohibited</html:code> message for IPv4 and <html:code>icmp6-adm-prohibited</html:code>
for IPv6. Only network connections initiated from within the system are
possible.</html:p></html:li><html:li><html:code>public</html:code><html:br/><html:p>For use in public areas. You do not trust the other
computers on the network to not harm your computer. Only selected incoming
connections are accepted.</html:p></html:li><html:li><html:code>external</html:code><html:br/><html:p>For use on external networks with masquerading enabled
especially for routers. You do not trust the other computers on the network to
not harm your computer. Only selected incoming connections are accepted.</html:p></html:li><html:li><html:code>dmz</html:code><html:br/><html:p>For computers in your demilitarized zone that are
publicly-accessible with limited access to your internal network. Only selected
incoming connections are accepted.</html:p></html:li><html:li><html:code>work</html:code><html:br/><html:p>For use in work areas. You mostly trust the other computers
on networks to not harm your computer. Only selected incoming connections are
accepted.</html:p></html:li><html:li><html:code>home</html:code><html:br/><html:p>For use in home areas. You mostly trust the other computers
on networks to not harm your computer. Only selected incoming connections are
accepted.</html:p></html:li><html:li><html:code>internal</html:code><html:br/><html:p>For use on internal networks. You mostly trust the
other computers on the networks to not harm your computer. Only selected
incoming connections are accepted.</html:p></html:li><html:li><html:code>trusted</html:code><html:br/><html:p>All network connections are accepted.</html:p></html:li></html:ul>
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
It is possible to designate one of these zones to be the default zone. When
interface connections are added to <html:code xmlns:html="http://www.w3.org/1999/xhtml">NetworkManager</html:code>, they are assigned
to the default zone. On installation, the default zone in firewalld is set to
be the public zone.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
To find out all the settings of a zone, for example the <html:code xmlns:html="http://www.w3.org/1999/xhtml">public zone,</html:code>
enter the following command as root:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml"># firewall-cmd --zone=public --list-all</html:pre>
Example output of this command might look like the following:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">
# firewall-cmd --zone=public --list-all
public
  interfaces:
  services: mdns dhcpv6-client ssh
  ports:
  forward-ports:
  icmp-blocks: source-quench
</html:pre>
To view the network zones currently active, enter the following command as root:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml"># firewall-cmd --get-service</html:pre>
The following listing displays the result of this command
on common Fedora system:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">
# firewall-cmd --get-service
amanda-client bacula bacula-client dhcp dhcpv6 dhcpv6-client dns ftp
high-availability http https imaps ipp ipp-client ipsec kerberos kpasswd
ldap ldaps libvirt libvirt-tls mdns mountd ms-wbt mysql nfs ntp openvpn
pmcd pmproxy pmwebapi pmwebapis pop3s postgresql proxy-dhcp radius rpc-bind
samba samba-client smtp ssh telnet tftp tftp-client transmission-client
vnc-server wbem-https
</html:pre>
Finally to view the network zones that will be active after the next firewalld
service reload, enter the following command as root:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml"># firewall-cmd --get-service --permanent</html:pre></description>
          <platform idref="cpe:/a:machine"/>
          <Rule id="xccdf_org.ssgproject.content_rule_service_firewalld_enabled" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Verify firewalld Enabled</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">
The <html:code xmlns:html="http://www.w3.org/1999/xhtml">firewalld</html:code> service can be enabled with the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo systemctl enable firewalld.service</html:pre></description>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.3</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.4.7</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000382</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-002314</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-4</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CA-3(5)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-7(21)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
            <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_MOF_EXT.1</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000096-GPOS-00050</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000297-GPOS-00115</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00231</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00232</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.3</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.5.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.6.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.4</reference>
            <reference href="https://www.cisecurity.org/controls/">11</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">9</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Access control methods provide the ability to enhance system security posture
by restricting services and known good IP addresses and address ranges. This
prevents connections from unknown hosts and protocols.</rationale>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="service_firewalld_enabled" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="enable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

SYSTEMCTL_EXEC='/usr/bin/systemctl'
"$SYSTEMCTL_EXEC" unmask 'firewalld.service'
"$SYSTEMCTL_EXEC" start 'firewalld.service'
"$SYSTEMCTL_EXEC" enable 'firewalld.service'

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="service_firewalld_enabled" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="enable">- name: Enable service firewalld
  block:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: Enable service firewalld
      service:
        name: firewalld
        enabled: 'yes'
        state: started
        masked: 'no'
      when:
        - '"firewalld" in ansible_facts.packages'
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.3
    - NIST-800-171-3.4.7
    - NIST-800-53-AC-4
    - NIST-800-53-CA-3(5)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-SC-7(21)
    - enable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - service_firewalld_enabled
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="service_firewalld_enabled" system="urn:xccdf:fix:script:puppet" complexity="low" disruption="low" strategy="enable">include enable_firewalld

class enable_firewalld {
  service {'firewalld':
    enable =&gt; true,
    ensure =&gt; 'running',
  }
}
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-service_firewalld_enabled:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-service_firewalld_enabled_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
        </Group>
        <Group id="xccdf_org.ssgproject.content_group_ruleset_modifications">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Strengthen the Default Ruleset</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The default rules can be strengthened. The system
scripts that activate the firewall rules expect them to be defined
in configuration files under the <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/firewalld/services</html:code>
and <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/firewalld/zones</html:code> directories.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
The following recommendations describe how to strengthen the
default ruleset configuration file. An alternative to editing this
configuration file is to create a shell script that makes calls to
the <html:code xmlns:html="http://www.w3.org/1999/xhtml">firewall-cmd</html:code> program to load in rules under the <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/firewalld/services</html:code>
and <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/firewalld/zones</html:code> directories.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Instructions apply to both unless otherwise noted. Language and address
conventions for regular firewalld rules are used throughout this section.</description>
          <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">The program <html:code xmlns:html="http://www.w3.org/1999/xhtml">firewall-config</html:code>
allows additional services to penetrate the default firewall rules
and automatically adjusts the <html:code xmlns:html="http://www.w3.org/1999/xhtml">firewalld</html:code> ruleset(s).</warning>
          <platform idref="cpe:/a:machine"/>
          <Rule id="xccdf_org.ssgproject.content_rule_set_firewalld_default_zone" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Set Default firewalld Zone for Incoming Packets</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To set the default zone to <html:code xmlns:html="http://www.w3.org/1999/xhtml">drop</html:code> for
the built-in default zone which processes incoming IPv4 and IPv6 packets,
modify the following line in
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/firewalld/firewalld.conf</html:code> to be:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">DefaultZone=drop</html:pre></description>
            <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">To prevent denying any access to the system, automatic remediation
of this control is not available. Remediation must be automated as
a component of machine provisioning, or followed manually as outlined
above.</warning>
            <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.10.1</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.3</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.4.7</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.13.6</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CA-3(5)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-7(23)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
            <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_MOF_EXT.1</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
            <reference href="">SRG-OS-000480-VMM-002000</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.11</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.12</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.3</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.06</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.5.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.6.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
            <reference href="https://www.cisecurity.org/controls/">11</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">9</reference>
            <reference href="">1416</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">In <html:code xmlns:html="http://www.w3.org/1999/xhtml">firewalld</html:code> the default zone is applied only after all
the applicable rules in the table are examined for a match. Setting the
default zone to <html:code xmlns:html="http://www.w3.org/1999/xhtml">drop</html:code> implements proper design for a firewall, i.e.
any packets which are not explicitly permitted should not be
accepted.</rationale>
            <platform idref="cpe:/a:machine"/>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-set_firewalld_default_zone:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-set_firewalld_default_zone_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
        </Group>
      </Group>
      <Group id="xccdf_org.ssgproject.content_group_network_ssl">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Transport Layer Security Support</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Support for Transport Layer Security (TLS), and its predecessor, the Secure
Sockets Layer (SSL), is included in Red Hat Enterprise Linux in the OpenSSL software (RPM package
<html:code xmlns:html="http://www.w3.org/1999/xhtml">openssl</html:code>).  TLS provides encrypted and authenticated network
communications, and many network services include support for it.  TLS or SSL
can be leveraged to avoid any plaintext transmission of sensitive data.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
For information on how to use OpenSSL, see
<html:b xmlns:html="http://www.w3.org/1999/xhtml"><html:a href="http://www.openssl.org/docs/">http://www.openssl.org/docs/</html:a></html:b>.  Information on FIPS validation
of OpenSSL is available at <html:b xmlns:html="http://www.w3.org/1999/xhtml"><html:a href="http://www.openssl.org/docs/fips.html">http://www.openssl.org/docs/fips.html</html:a></html:b>
and <html:b xmlns:html="http://www.w3.org/1999/xhtml"><html:a href="http://csrc.nist.gov/groups/STM/cmvp/documents/140-1/140val-all.htm">http://csrc.nist.gov/groups/STM/cmvp/documents/140-1/140val-all.htm</html:a></html:b>.</description>
      </Group>
      <Group id="xccdf_org.ssgproject.content_group_network-kernel">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Kernel Parameters Which Affect Networking</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">sysctl</html:code> utility is used to set
parameters which affect the operation of the Linux kernel. Kernel parameters
which affect networking and have security implications are described here.</description>
        <Group id="xccdf_org.ssgproject.content_group_network_host_parameters">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Network Parameters for Hosts Only</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">If the system is not going to be used as a router, then setting certain
kernel parameters ensure that the host will not perform routing
of network traffic.</description>
          <Rule id="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_ip_forward" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To set the runtime status of the <html:code xmlns:html="http://www.w3.org/1999/xhtml">net.ipv4.ip_forward</html:code> kernel parameter, run the following command: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo sysctl -w net.ipv4.ip_forward=0</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/sysctl.d</html:code>: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">net.ipv4.ip_forward = 0</html:pre></description>
            <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="functionality">Certain technologies such as virtual machines, containers, etc. rely on IPv4 forwarding to enable and use networking.
Disabling IPv4 forwarding would cause those technologies to stop working. Therefore, this rule should not be used in
profiles or benchmarks that target usage of IPv4 forwarding.</warning>
            <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R22)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.20</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-5</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-7(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.11</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.12</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.3</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI04.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.06</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.1.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.5.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.6.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.17.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
            <reference href="https://www.cisecurity.org/controls/">1</reference>
            <reference href="https://www.cisecurity.org/controls/">11</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">13</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">2</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">7</reference>
            <reference href="https://www.cisecurity.org/controls/">8</reference>
            <reference href="https://www.cisecurity.org/controls/">9</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Routing protocol daemons are typically used on routers to exchange
network topology information with other routers. If this capability is used when
not required, system network information may be unnecessarily transmitted across
the network.</rationale>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_net_ipv4_ip_forward" system="urn:xccdf:fix:script:sh" reboot="true" complexity="low" disruption="medium" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then



#
# Set runtime for net.ipv4.ip_forward
#
/sbin/sysctl -q -n -w net.ipv4.ip_forward="0"

#
# If net.ipv4.ip_forward present in /etc/sysctl.conf, change value to "0"
#	else, add "net.ipv4.ip_forward = 0" to /etc/sysctl.conf
#
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_replace_or_append" use="legacy"/>
replace_or_append '/etc/sysctl.conf' '^net.ipv4.ip_forward' "0" ''

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_net_ipv4_ip_forward" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="medium" strategy="disable">- name: Ensure sysctl net.ipv4.ip_forward is set to 0
  sysctl:
    name: net.ipv4.ip_forward
    value: '0'
    state: present
    reload: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-SC-5
    - NIST-800-53-SC-7(a)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv4_ip_forward
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-sysctl_net_ipv4_ip_forward:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-sysctl_net_ipv4_ip_forward_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_send_redirects" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To set the runtime status of the <html:code xmlns:html="http://www.w3.org/1999/xhtml">net.ipv4.conf.all.send_redirects</html:code> kernel parameter, run the following command: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo sysctl -w net.ipv4.conf.all.send_redirects=0</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/sysctl.d</html:code>: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">net.ipv4.conf.all.send_redirects = 0</html:pre></description>
            <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R22)</reference>
            <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.10.1.1</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.20</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-5</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-7(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.AM-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-5</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.11</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.12</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.3.3</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI04.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.06</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.10.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.1.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.1.5</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.1.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.5.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.6.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.1.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.17.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.7.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.7.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.7.3.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.8.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.8.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.5</reference>
            <reference href="https://www.cisecurity.org/controls/">1</reference>
            <reference href="https://www.cisecurity.org/controls/">11</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">13</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">18</reference>
            <reference href="https://www.cisecurity.org/controls/">2</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">4</reference>
            <reference href="https://www.cisecurity.org/controls/">6</reference>
            <reference href="https://www.cisecurity.org/controls/">7</reference>
            <reference href="https://www.cisecurity.org/controls/">8</reference>
            <reference href="https://www.cisecurity.org/controls/">9</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">ICMP redirect messages are used by routers to inform hosts that a more
direct route exists for a particular destination. These messages contain information
from the system's route table possibly revealing portions of the network topology.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
The ability to send ICMP redirects is only appropriate for systems acting as routers.</rationale>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_net_ipv4_conf_all_send_redirects" system="urn:xccdf:fix:script:sh" reboot="true" complexity="low" disruption="medium" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then



#
# Set runtime for net.ipv4.conf.all.send_redirects
#
/sbin/sysctl -q -n -w net.ipv4.conf.all.send_redirects="0"

#
# If net.ipv4.conf.all.send_redirects present in /etc/sysctl.conf, change value to "0"
#	else, add "net.ipv4.conf.all.send_redirects = 0" to /etc/sysctl.conf
#
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_replace_or_append" use="legacy"/>
replace_or_append '/etc/sysctl.conf' '^net.ipv4.conf.all.send_redirects' "0" ''

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_net_ipv4_conf_all_send_redirects" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="medium" strategy="disable">- name: Ensure sysctl net.ipv4.conf.all.send_redirects is set to 0
  sysctl:
    name: net.ipv4.conf.all.send_redirects
    value: '0'
    state: present
    reload: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.10.1.1
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-SC-5
    - NIST-800-53-SC-7(a)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv4_conf_all_send_redirects
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_net_ipv4_conf_all_send_redirects" system="urn:xccdf:fix:script:kubernetes">apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,net.ipv4.conf.all.send_redirects%3D0%0A
        mode: 0644
        path: /etc/sysctl.d/75-sysctl_net_ipv4_conf_all_send_redirects.conf
        overwrite: true
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-sysctl_net_ipv4_conf_all_send_redirects:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-sysctl_net_ipv4_conf_all_send_redirects_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_send_redirects" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To set the runtime status of the <html:code xmlns:html="http://www.w3.org/1999/xhtml">net.ipv4.conf.default.send_redirects</html:code> kernel parameter, run the following command: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo sysctl -w net.ipv4.conf.default.send_redirects=0</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/sysctl.d</html:code>: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">net.ipv4.conf.default.send_redirects = 0</html:pre></description>
            <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R22)</reference>
            <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.10.1.1</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.20</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-5</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-7(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.AM-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-5</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.11</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.12</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.3.3</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI04.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.06</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.10.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.1.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.1.5</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.1.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.5.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.6.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.1.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.17.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.7.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.7.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.7.3.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.8.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.8.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.5</reference>
            <reference href="https://www.cisecurity.org/controls/">1</reference>
            <reference href="https://www.cisecurity.org/controls/">11</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">13</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">18</reference>
            <reference href="https://www.cisecurity.org/controls/">2</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">4</reference>
            <reference href="https://www.cisecurity.org/controls/">6</reference>
            <reference href="https://www.cisecurity.org/controls/">7</reference>
            <reference href="https://www.cisecurity.org/controls/">8</reference>
            <reference href="https://www.cisecurity.org/controls/">9</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">ICMP redirect messages are used by routers to inform hosts that a more
direct route exists for a particular destination. These messages contain information
from the system's route table possibly revealing portions of the network topology.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
The ability to send ICMP redirects is only appropriate for systems acting as routers.</rationale>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_net_ipv4_conf_default_send_redirects" system="urn:xccdf:fix:script:sh" reboot="true" complexity="low" disruption="medium" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then



#
# Set runtime for net.ipv4.conf.default.send_redirects
#
/sbin/sysctl -q -n -w net.ipv4.conf.default.send_redirects="0"

#
# If net.ipv4.conf.default.send_redirects present in /etc/sysctl.conf, change value to "0"
#	else, add "net.ipv4.conf.default.send_redirects = 0" to /etc/sysctl.conf
#
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_replace_or_append" use="legacy"/>
replace_or_append '/etc/sysctl.conf' '^net.ipv4.conf.default.send_redirects' "0" ''

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_net_ipv4_conf_default_send_redirects" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="medium" strategy="disable">- name: Ensure sysctl net.ipv4.conf.default.send_redirects is set to 0
  sysctl:
    name: net.ipv4.conf.default.send_redirects
    value: '0'
    state: present
    reload: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.10.1.1
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-SC-5
    - NIST-800-53-SC-7(a)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv4_conf_default_send_redirects
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_net_ipv4_conf_default_send_redirects" system="urn:xccdf:fix:script:kubernetes">apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,net.ipv4.conf.default.send_redirects%3D0%0A
        mode: 0644
        path: /etc/sysctl.d/75-sysctl_net_ipv4_conf_default_send_redirects.conf
        overwrite: true
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-sysctl_net_ipv4_conf_default_send_redirects:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-sysctl_net_ipv4_conf_default_send_redirects_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
        </Group>
        <Group id="xccdf_org.ssgproject.content_group_network_host_and_router_parameters">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Network Related Kernel Runtime Parameters for Hosts and Routers</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Certain kernel parameters should be set for systems which are
acting as either hosts or routers to improve the system's ability defend
against certain types of IPv4 protocol attacks.</description>
          <platform idref="cpe:/a:machine"/>
          <Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_accept_redirects_value" type="number">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">net.ipv4.conf.all.accept_redirects</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable ICMP Redirect Acceptance</description>
            <value>0</value>
            <value selector="disabled">0</value>
            <value selector="enabled">1</value>
          </Value>
          <Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_accept_source_route_value" type="number">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">net.ipv4.conf.all.accept_source_route</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Trackers could be using source-routed packets to
generate traffic that seems to be intra-net, but actually was
created outside and has been redirected.</description>
            <value>0</value>
            <value selector="disabled">0</value>
            <value selector="enabled">1</value>
          </Value>
          <Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_log_martians_value" type="number">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">net.ipv4.conf.all.log_martians</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable so you don't Log Spoofed Packets, Source
Routed Packets, Redirect Packets</description>
            <value>1</value>
            <value selector="disabled">0</value>
            <value selector="enabled">1</value>
          </Value>
          <Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_rp_filter_value" type="number">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">net.ipv4.conf.all.rp_filter</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Enable to enforce sanity checking, also called ingress
filtering or egress filtering. The point is to drop a packet if the
source and destination IP addresses in the IP header do not make
sense when considered in light of the physical interface on which
it arrived.</description>
            <value>1</value>
            <value selector="disabled">0</value>
            <value selector="enabled">1</value>
          </Value>
          <Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_secure_redirects_value" type="number">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">net.ipv4.conf.all.secure_redirects</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Enable to prevent hijacking of routing path by only
allowing redirects from gateways known in routing
table. Disable to refuse acceptance of secure ICMP redirected packets on all interfaces.</description>
            <value>0</value>
            <value selector="disabled">0</value>
            <value selector="enabled">1</value>
          </Value>
          <Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_default_accept_redirects_value" type="number">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">net.ipv4.conf.default.accept_redirects</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable ICMP Redirect Acceptance?</description>
            <value>0</value>
            <value selector="disabled">0</value>
            <value selector="enabled">1</value>
          </Value>
          <Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_default_accept_source_route_value" type="number">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">net.ipv4.conf.default.accept_source_route</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable IP source routing?</description>
            <value>0</value>
            <value selector="disabled">0</value>
            <value selector="enabled">1</value>
          </Value>
          <Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_default_log_martians_value" type="number">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">net.ipv4.conf.default.log_martians</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable so you don't Log Spoofed Packets, Source
Routed Packets, Redirect Packets</description>
            <value>1</value>
            <value selector="disabled">0</value>
            <value selector="enabled">1</value>
          </Value>
          <Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_default_rp_filter_value" type="number">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">net.ipv4.conf.default.rp_filter</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Enables source route verification</description>
            <value>1</value>
            <value selector="disabled">0</value>
            <value selector="enabled">1</value>
          </Value>
          <Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_default_secure_redirects_value" type="number">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">net.ipv4.conf.default.secure_redirects</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Enable to prevent hijacking of routing path by only
allowing redirects from gateways known in routing
table. Disable to refuse acceptance of secure ICMP redirected packages by default.</description>
            <value>0</value>
            <value selector="disabled">0</value>
            <value selector="enabled">1</value>
          </Value>
          <Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_icmp_echo_ignore_broadcasts_value" type="number">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">net.ipv4.icmp_echo_ignore_broadcasts</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ignore all ICMP ECHO and TIMESTAMP requests sent to it
via broadcast/multicast</description>
            <value>1</value>
            <value selector="disabled">0</value>
            <value selector="enabled">1</value>
          </Value>
          <Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_icmp_ignore_bogus_error_responses_value" type="number">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">net.ipv4.icmp_ignore_bogus_error_responses</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Enable to prevent unnecessary logging</description>
            <value>1</value>
            <value selector="disabled">0</value>
            <value selector="enabled">1</value>
          </Value>
          <Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_tcp_invalid_ratelimit_value" type="number">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">net.ipv4.tcp_invalid_ratelimit</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Configure  the maximal rate for sending duplicate acknowledgments in
response to incoming invalid TCP packets.</description>
            <value>500</value>
            <value selector="one_thousand">1000</value>
            <value selector="five_hundred">500</value>
            <value selector="two_hundred_fifty">250</value>
            <value selector="one_hundred">100</value>
          </Value>
          <Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_tcp_rfc1337_value" type="number">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">net.ipv4.tcp_rfc1337</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Enable to enable TCP behavior conformant with RFC 1337</description>
            <value>1</value>
            <value selector="disabled">0</value>
            <value selector="enabled">1</value>
          </Value>
          <Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_tcp_syncookies_value" type="number">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">net.ipv4.tcp_syncookies</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Enable to turn on TCP SYN Cookie
Protection</description>
            <value>1</value>
            <value selector="disabled">0</value>
            <value selector="enabled">1</value>
          </Value>
          <Rule id="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_accept_source_route" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To set the runtime status of the <html:code xmlns:html="http://www.w3.org/1999/xhtml">net.ipv4.conf.all.accept_source_route</html:code> kernel parameter, run the following command: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo sysctl -w net.ipv4.conf.all.accept_source_route=0</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/sysctl.d</html:code>: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">net.ipv4.conf.all.accept_source_route = 0</html:pre></description>
            <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R22)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.20</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-5</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-7(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.AM-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-5</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.11</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.12</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.3.3</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI04.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.06</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.10.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.1.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.1.5</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.1.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.5.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.6.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.1.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.17.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.7.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.7.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.7.3.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.8.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.8.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.5</reference>
            <reference href="https://www.cisecurity.org/controls/">1</reference>
            <reference href="https://www.cisecurity.org/controls/">11</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">13</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">18</reference>
            <reference href="https://www.cisecurity.org/controls/">2</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">4</reference>
            <reference href="https://www.cisecurity.org/controls/">6</reference>
            <reference href="https://www.cisecurity.org/controls/">7</reference>
            <reference href="https://www.cisecurity.org/controls/">8</reference>
            <reference href="https://www.cisecurity.org/controls/">9</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Source-routed packets allow the source of the packet to suggest routers
forward the packet along a different path than configured on the router,
which can be used to bypass network security measures. This requirement
applies only to the forwarding of source-routerd traffic, such as when IPv4
forwarding is enabled and the system is functioning as a router.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Accepting source-routed packets in the IPv4 protocol has few legitimate
uses. It should be disabled unless it is absolutely required.</rationale>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_net_ipv4_conf_all_accept_source_route" system="urn:xccdf:fix:script:sh" reboot="true" complexity="low" disruption="medium" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then


sysctl_net_ipv4_conf_all_accept_source_route_value="<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_accept_source_route_value" use="legacy"/>"



#
# Set runtime for net.ipv4.conf.all.accept_source_route
#
/sbin/sysctl -q -n -w net.ipv4.conf.all.accept_source_route="$sysctl_net_ipv4_conf_all_accept_source_route_value"

#
# If net.ipv4.conf.all.accept_source_route present in /etc/sysctl.conf, change value to appropriate value
#	else, add "net.ipv4.conf.all.accept_source_route = value" to /etc/sysctl.conf
#
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_replace_or_append" use="legacy"/>
replace_or_append '/etc/sysctl.conf' '^net.ipv4.conf.all.accept_source_route' "$sysctl_net_ipv4_conf_all_accept_source_route_value" ''

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_net_ipv4_conf_all_accept_source_route" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="medium" strategy="disable">- name: XCCDF Value sysctl_net_ipv4_conf_all_accept_source_route_value # promote to variable
  set_fact:
    sysctl_net_ipv4_conf_all_accept_source_route_value: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_accept_source_route_value" use="legacy"/>
  tags:
    - always

- name: Ensure sysctl net.ipv4.conf.all.accept_source_route is set
  sysctl:
    name: net.ipv4.conf.all.accept_source_route
    value: '{{ sysctl_net_ipv4_conf_all_accept_source_route_value }}'
    state: present
    reload: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-SC-5
    - NIST-800-53-SC-7(a)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv4_conf_all_accept_source_route
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_net_ipv4_conf_all_accept_source_route" system="urn:xccdf:fix:script:kubernetes">apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,net.ipv4.conf.all.accept_source_route%3D0%0A
        mode: 0644
        path: /etc/sysctl.d/75-sysctl_net_ipv4_conf_all_accept_source_route.conf
        overwrite: true
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-export export-name="oval:ssg-sysctl_net_ipv4_conf_all_accept_source_route_value:var:1" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_accept_source_route_value"/>
              <check-content-ref name="oval:ssg-sysctl_net_ipv4_conf_all_accept_source_route:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-sysctl_net_ipv4_conf_all_accept_source_route_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_icmp_ignore_bogus_error_responses" selected="false" role="full" severity="unknown">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Enable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To set the runtime status of the <html:code xmlns:html="http://www.w3.org/1999/xhtml">net.ipv4.icmp_ignore_bogus_error_responses</html:code> kernel parameter, run the following command: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo sysctl -w net.ipv4.icmp_ignore_bogus_error_responses=1</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/sysctl.d</html:code>: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">net.ipv4.icmp_ignore_bogus_error_responses = 1</html:pre></description>
            <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R22)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.20</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-5</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.11</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.12</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.3</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI04.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.06</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.1.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.5.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.6.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.17.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
            <reference href="https://www.cisecurity.org/controls/">1</reference>
            <reference href="https://www.cisecurity.org/controls/">11</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">13</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">2</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">7</reference>
            <reference href="https://www.cisecurity.org/controls/">8</reference>
            <reference href="https://www.cisecurity.org/controls/">9</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ignoring bogus ICMP error responses reduces
log size, although some activity would not be logged.</rationale>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_net_ipv4_icmp_ignore_bogus_error_responses" system="urn:xccdf:fix:script:sh" reboot="true" complexity="low" disruption="medium" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then


sysctl_net_ipv4_icmp_ignore_bogus_error_responses_value="<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_icmp_ignore_bogus_error_responses_value" use="legacy"/>"



#
# Set runtime for net.ipv4.icmp_ignore_bogus_error_responses
#
/sbin/sysctl -q -n -w net.ipv4.icmp_ignore_bogus_error_responses="$sysctl_net_ipv4_icmp_ignore_bogus_error_responses_value"

#
# If net.ipv4.icmp_ignore_bogus_error_responses present in /etc/sysctl.conf, change value to appropriate value
#	else, add "net.ipv4.icmp_ignore_bogus_error_responses = value" to /etc/sysctl.conf
#
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_replace_or_append" use="legacy"/>
replace_or_append '/etc/sysctl.conf' '^net.ipv4.icmp_ignore_bogus_error_responses' "$sysctl_net_ipv4_icmp_ignore_bogus_error_responses_value" ''

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_net_ipv4_icmp_ignore_bogus_error_responses" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="medium" strategy="disable">- name: XCCDF Value sysctl_net_ipv4_icmp_ignore_bogus_error_responses_value # promote to variable
  set_fact:
    sysctl_net_ipv4_icmp_ignore_bogus_error_responses_value: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_icmp_ignore_bogus_error_responses_value" use="legacy"/>
  tags:
    - always

- name: Ensure sysctl net.ipv4.icmp_ignore_bogus_error_responses is set
  sysctl:
    name: net.ipv4.icmp_ignore_bogus_error_responses
    value: '{{ sysctl_net_ipv4_icmp_ignore_bogus_error_responses_value }}'
    state: present
    reload: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-SC-5
    - disable_strategy
    - low_complexity
    - medium_disruption
    - reboot_required
    - sysctl_net_ipv4_icmp_ignore_bogus_error_responses
    - unknown_severity
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_net_ipv4_icmp_ignore_bogus_error_responses" system="urn:xccdf:fix:script:kubernetes">apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,net.ipv4.icmp_ignore_bogus_error_responses%3D1%0A
        mode: 0644
        path: /etc/sysctl.d/75-sysctl_net_ipv4_icmp_ignore_bogus_error_responses.conf
        overwrite: true
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-export export-name="oval:ssg-sysctl_net_ipv4_icmp_ignore_bogus_error_responses_value:var:1" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_icmp_ignore_bogus_error_responses_value"/>
              <check-content-ref name="oval:ssg-sysctl_net_ipv4_icmp_ignore_bogus_error_responses:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-sysctl_net_ipv4_icmp_ignore_bogus_error_responses_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_rp_filter" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Enable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To set the runtime status of the <html:code xmlns:html="http://www.w3.org/1999/xhtml">net.ipv4.conf.default.rp_filter</html:code> kernel parameter, run the following command: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo sysctl -w net.ipv4.conf.default.rp_filter=1</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/sysctl.d</html:code>: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">net.ipv4.conf.default.rp_filter = 1</html:pre></description>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</reference>
            <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R22)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.20</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-7(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.AM-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-5</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.3.3</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI04.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.10.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.1.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.1.5</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.1.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.1.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.17.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.7.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.7.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.7.3.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.8.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.8.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.5</reference>
            <reference href="https://www.cisecurity.org/controls/">1</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">13</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">18</reference>
            <reference href="https://www.cisecurity.org/controls/">2</reference>
            <reference href="https://www.cisecurity.org/controls/">4</reference>
            <reference href="https://www.cisecurity.org/controls/">6</reference>
            <reference href="https://www.cisecurity.org/controls/">7</reference>
            <reference href="https://www.cisecurity.org/controls/">8</reference>
            <reference href="https://www.cisecurity.org/controls/">9</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Enabling reverse path filtering drops packets with source addresses
that should not have been able to be received on the interface they were
received on. It should not be used on systems which are routers for
complicated networks, but is helpful for end hosts and routers serving small
networks.</rationale>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_net_ipv4_conf_default_rp_filter" system="urn:xccdf:fix:script:sh" reboot="true" complexity="low" disruption="medium" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then


sysctl_net_ipv4_conf_default_rp_filter_value="<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_default_rp_filter_value" use="legacy"/>"



#
# Set runtime for net.ipv4.conf.default.rp_filter
#
/sbin/sysctl -q -n -w net.ipv4.conf.default.rp_filter="$sysctl_net_ipv4_conf_default_rp_filter_value"

#
# If net.ipv4.conf.default.rp_filter present in /etc/sysctl.conf, change value to appropriate value
#	else, add "net.ipv4.conf.default.rp_filter = value" to /etc/sysctl.conf
#
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_replace_or_append" use="legacy"/>
replace_or_append '/etc/sysctl.conf' '^net.ipv4.conf.default.rp_filter' "$sysctl_net_ipv4_conf_default_rp_filter_value" ''

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_net_ipv4_conf_default_rp_filter" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="medium" strategy="disable">- name: XCCDF Value sysctl_net_ipv4_conf_default_rp_filter_value # promote to variable
  set_fact:
    sysctl_net_ipv4_conf_default_rp_filter_value: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_default_rp_filter_value" use="legacy"/>
  tags:
    - always

- name: Ensure sysctl net.ipv4.conf.default.rp_filter is set
  sysctl:
    name: net.ipv4.conf.default.rp_filter
    value: '{{ sysctl_net_ipv4_conf_default_rp_filter_value }}'
    state: present
    reload: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-SC-7(a)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv4_conf_default_rp_filter
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_net_ipv4_conf_default_rp_filter" system="urn:xccdf:fix:script:kubernetes">apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,net.ipv4.conf.default.rp_filter%3D1%0A
        mode: 0644
        path: /etc/sysctl.d/75-sysctl_net_ipv4_conf_default_rp_filter.conf
        overwrite: true
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-export export-name="oval:ssg-sysctl_net_ipv4_conf_default_rp_filter_value:var:1" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_default_rp_filter_value"/>
              <check-content-ref name="oval:ssg-sysctl_net_ipv4_conf_default_rp_filter:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-sysctl_net_ipv4_conf_default_rp_filter_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_log_martians" selected="false" role="full" severity="unknown">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Enable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To set the runtime status of the <html:code xmlns:html="http://www.w3.org/1999/xhtml">net.ipv4.conf.all.log_martians</html:code> kernel parameter, run the following command: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo sysctl -w net.ipv4.conf.all.log_martians=1</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/sysctl.d</html:code>: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">net.ipv4.conf.all.log_martians = 1</html:pre></description>
            <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R22)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.20</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000126</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-5(3)(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.11</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.12</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.3</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI04.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.06</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.2.6</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.1.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.5.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.6.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.17.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
            <reference href="https://www.cisecurity.org/controls/">1</reference>
            <reference href="https://www.cisecurity.org/controls/">11</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">13</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">2</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">7</reference>
            <reference href="https://www.cisecurity.org/controls/">8</reference>
            <reference href="https://www.cisecurity.org/controls/">9</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The presence of "martian" packets (which have impossible addresses)
as well as spoofed packets, source-routed packets, and redirects could be a
sign of nefarious network activity. Logging these packets enables this activity
to be detected.</rationale>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_net_ipv4_conf_all_log_martians" system="urn:xccdf:fix:script:sh" reboot="true" complexity="low" disruption="medium" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then


sysctl_net_ipv4_conf_all_log_martians_value="<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_log_martians_value" use="legacy"/>"



#
# Set runtime for net.ipv4.conf.all.log_martians
#
/sbin/sysctl -q -n -w net.ipv4.conf.all.log_martians="$sysctl_net_ipv4_conf_all_log_martians_value"

#
# If net.ipv4.conf.all.log_martians present in /etc/sysctl.conf, change value to appropriate value
#	else, add "net.ipv4.conf.all.log_martians = value" to /etc/sysctl.conf
#
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_replace_or_append" use="legacy"/>
replace_or_append '/etc/sysctl.conf' '^net.ipv4.conf.all.log_martians' "$sysctl_net_ipv4_conf_all_log_martians_value" ''

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_net_ipv4_conf_all_log_martians" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="medium" strategy="disable">- name: XCCDF Value sysctl_net_ipv4_conf_all_log_martians_value # promote to variable
  set_fact:
    sysctl_net_ipv4_conf_all_log_martians_value: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_log_martians_value" use="legacy"/>
  tags:
    - always

- name: Ensure sysctl net.ipv4.conf.all.log_martians is set
  sysctl:
    name: net.ipv4.conf.all.log_martians
    value: '{{ sysctl_net_ipv4_conf_all_log_martians_value }}'
    state: present
    reload: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-SC-5(3)(a)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - reboot_required
    - sysctl_net_ipv4_conf_all_log_martians
    - unknown_severity
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_net_ipv4_conf_all_log_martians" system="urn:xccdf:fix:script:kubernetes">apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,net.ipv4.conf.all.log_martians%3D1%0A
        mode: 0644
        path: /etc/sysctl.d/75-sysctl_net_ipv4_conf_all_log_martians.conf
        overwrite: true
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-export export-name="oval:ssg-sysctl_net_ipv4_conf_all_log_martians_value:var:1" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_log_martians_value"/>
              <check-content-ref name="oval:ssg-sysctl_net_ipv4_conf_all_log_martians:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-sysctl_net_ipv4_conf_all_log_martians_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_log_martians" selected="false" role="full" severity="unknown">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Enable Kernel Paremeter to Log Martian Packets on all IPv4 Interfaces by Default</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To set the runtime status of the <html:code xmlns:html="http://www.w3.org/1999/xhtml">net.ipv4.conf.default.log_martians</html:code> kernel parameter, run the following command: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo sysctl -w net.ipv4.conf.default.log_martians=1</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/sysctl.d</html:code>: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">net.ipv4.conf.default.log_martians = 1</html:pre></description>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.20</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000126</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-5(3)(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.11</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.12</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.3</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI04.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.06</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.2.6</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.1.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.5.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.6.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.17.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
            <reference href="https://www.cisecurity.org/controls/">1</reference>
            <reference href="https://www.cisecurity.org/controls/">11</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">13</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">2</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">7</reference>
            <reference href="https://www.cisecurity.org/controls/">8</reference>
            <reference href="https://www.cisecurity.org/controls/">9</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The presence of "martian" packets (which have impossible addresses)
as well as spoofed packets, source-routed packets, and redirects could be a
sign of nefarious network activity. Logging these packets enables this activity
to be detected.</rationale>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_net_ipv4_conf_default_log_martians" system="urn:xccdf:fix:script:sh" reboot="true" complexity="low" disruption="medium" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then


sysctl_net_ipv4_conf_default_log_martians_value="<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_default_log_martians_value" use="legacy"/>"



#
# Set runtime for net.ipv4.conf.default.log_martians
#
/sbin/sysctl -q -n -w net.ipv4.conf.default.log_martians="$sysctl_net_ipv4_conf_default_log_martians_value"

#
# If net.ipv4.conf.default.log_martians present in /etc/sysctl.conf, change value to appropriate value
#	else, add "net.ipv4.conf.default.log_martians = value" to /etc/sysctl.conf
#
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_replace_or_append" use="legacy"/>
replace_or_append '/etc/sysctl.conf' '^net.ipv4.conf.default.log_martians' "$sysctl_net_ipv4_conf_default_log_martians_value" ''

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_net_ipv4_conf_default_log_martians" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="medium" strategy="disable">- name: XCCDF Value sysctl_net_ipv4_conf_default_log_martians_value # promote to variable
  set_fact:
    sysctl_net_ipv4_conf_default_log_martians_value: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_default_log_martians_value" use="legacy"/>
  tags:
    - always

- name: Ensure sysctl net.ipv4.conf.default.log_martians is set
  sysctl:
    name: net.ipv4.conf.default.log_martians
    value: '{{ sysctl_net_ipv4_conf_default_log_martians_value }}'
    state: present
    reload: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-SC-5(3)(a)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - reboot_required
    - sysctl_net_ipv4_conf_default_log_martians
    - unknown_severity
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_net_ipv4_conf_default_log_martians" system="urn:xccdf:fix:script:kubernetes">apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,net.ipv4.conf.default.log_martians%3D1%0A
        mode: 0644
        path: /etc/sysctl.d/75-sysctl_net_ipv4_conf_default_log_martians.conf
        overwrite: true
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-export export-name="oval:ssg-sysctl_net_ipv4_conf_default_log_martians_value:var:1" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_default_log_martians_value"/>
              <check-content-ref name="oval:ssg-sysctl_net_ipv4_conf_default_log_martians:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-sysctl_net_ipv4_conf_default_log_martians_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_accept_source_route" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To set the runtime status of the <html:code xmlns:html="http://www.w3.org/1999/xhtml">net.ipv4.conf.default.accept_source_route</html:code> kernel parameter, run the following command: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo sysctl -w net.ipv4.conf.default.accept_source_route=0</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/sysctl.d</html:code>: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">net.ipv4.conf.default.accept_source_route = 0</html:pre></description>
            <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R22)</reference>
            <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.10.1.1</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.20</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-001551</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-5</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-7(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.AM-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-5</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.11</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.12</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.3.3</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI04.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.06</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.10.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.1.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.1.5</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.1.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.5.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.6.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.1.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.17.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.7.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.7.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.7.3.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.8.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.8.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.5</reference>
            <reference href="https://www.cisecurity.org/controls/">1</reference>
            <reference href="https://www.cisecurity.org/controls/">11</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">13</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">18</reference>
            <reference href="https://www.cisecurity.org/controls/">2</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">4</reference>
            <reference href="https://www.cisecurity.org/controls/">6</reference>
            <reference href="https://www.cisecurity.org/controls/">7</reference>
            <reference href="https://www.cisecurity.org/controls/">8</reference>
            <reference href="https://www.cisecurity.org/controls/">9</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Source-routed packets allow the source of the packet to suggest routers
forward the packet along a different path than configured on the router,
which can be used to bypass network security measures.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Accepting source-routed packets in the IPv4 protocol has few legitimate
uses. It should be disabled unless it is absolutely required, such as when
IPv4 forwarding is enabled and the system is legitimately functioning as a
router.</rationale>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_net_ipv4_conf_default_accept_source_route" system="urn:xccdf:fix:script:sh" reboot="true" complexity="low" disruption="medium" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then


sysctl_net_ipv4_conf_default_accept_source_route_value="<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_default_accept_source_route_value" use="legacy"/>"



#
# Set runtime for net.ipv4.conf.default.accept_source_route
#
/sbin/sysctl -q -n -w net.ipv4.conf.default.accept_source_route="$sysctl_net_ipv4_conf_default_accept_source_route_value"

#
# If net.ipv4.conf.default.accept_source_route present in /etc/sysctl.conf, change value to appropriate value
#	else, add "net.ipv4.conf.default.accept_source_route = value" to /etc/sysctl.conf
#
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_replace_or_append" use="legacy"/>
replace_or_append '/etc/sysctl.conf' '^net.ipv4.conf.default.accept_source_route' "$sysctl_net_ipv4_conf_default_accept_source_route_value" ''

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_net_ipv4_conf_default_accept_source_route" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="medium" strategy="disable">- name: XCCDF Value sysctl_net_ipv4_conf_default_accept_source_route_value # promote to variable
  set_fact:
    sysctl_net_ipv4_conf_default_accept_source_route_value: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_default_accept_source_route_value" use="legacy"/>
  tags:
    - always

- name: Ensure sysctl net.ipv4.conf.default.accept_source_route is set
  sysctl:
    name: net.ipv4.conf.default.accept_source_route
    value: '{{ sysctl_net_ipv4_conf_default_accept_source_route_value }}'
    state: present
    reload: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.10.1.1
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-SC-5
    - NIST-800-53-SC-7(a)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv4_conf_default_accept_source_route
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_net_ipv4_conf_default_accept_source_route" system="urn:xccdf:fix:script:kubernetes">apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,net.ipv4.conf.default.accept_source_route%3D0%0A
        mode: 0644
        path: /etc/sysctl.d/75-sysctl_net_ipv4_conf_default_accept_source_route.conf
        overwrite: true
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-export export-name="oval:ssg-sysctl_net_ipv4_conf_default_accept_source_route_value:var:1" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_default_accept_source_route_value"/>
              <check-content-ref name="oval:ssg-sysctl_net_ipv4_conf_default_accept_source_route:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-sysctl_net_ipv4_conf_default_accept_source_route_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_accept_redirects" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable Accepting ICMP Redirects for All IPv4 Interfaces</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To set the runtime status of the <html:code xmlns:html="http://www.w3.org/1999/xhtml">net.ipv4.conf.all.accept_redirects</html:code> kernel parameter, run the following command: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo sysctl -w net.ipv4.conf.all.accept_redirects=0</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/sysctl.d</html:code>: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">net.ipv4.conf.all.accept_redirects = 0</html:pre></description>
            <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R22)</reference>
            <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.10.1.1</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.20</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-001503</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-001551</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-7(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.11</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.12</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.3</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI04.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.06</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.1.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.5.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.6.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.17.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
            <reference href="https://www.cisecurity.org/controls/">1</reference>
            <reference href="https://www.cisecurity.org/controls/">11</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">13</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">2</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">7</reference>
            <reference href="https://www.cisecurity.org/controls/">8</reference>
            <reference href="https://www.cisecurity.org/controls/">9</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">ICMP redirect messages are used by routers to inform hosts that a more
direct route exists for a particular destination. These messages modify the
host's route table and are unauthenticated. An illicit ICMP redirect
message could result in a man-in-the-middle attack.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
This feature of the IPv4 protocol has few legitimate uses. It should be
disabled unless absolutely required."</rationale>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_net_ipv4_conf_all_accept_redirects" system="urn:xccdf:fix:script:sh" reboot="true" complexity="low" disruption="medium" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then


sysctl_net_ipv4_conf_all_accept_redirects_value="<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_accept_redirects_value" use="legacy"/>"



#
# Set runtime for net.ipv4.conf.all.accept_redirects
#
/sbin/sysctl -q -n -w net.ipv4.conf.all.accept_redirects="$sysctl_net_ipv4_conf_all_accept_redirects_value"

#
# If net.ipv4.conf.all.accept_redirects present in /etc/sysctl.conf, change value to appropriate value
#	else, add "net.ipv4.conf.all.accept_redirects = value" to /etc/sysctl.conf
#
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_replace_or_append" use="legacy"/>
replace_or_append '/etc/sysctl.conf' '^net.ipv4.conf.all.accept_redirects' "$sysctl_net_ipv4_conf_all_accept_redirects_value" ''

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_net_ipv4_conf_all_accept_redirects" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="medium" strategy="disable">- name: XCCDF Value sysctl_net_ipv4_conf_all_accept_redirects_value # promote to variable
  set_fact:
    sysctl_net_ipv4_conf_all_accept_redirects_value: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_accept_redirects_value" use="legacy"/>
  tags:
    - always

- name: Ensure sysctl net.ipv4.conf.all.accept_redirects is set
  sysctl:
    name: net.ipv4.conf.all.accept_redirects
    value: '{{ sysctl_net_ipv4_conf_all_accept_redirects_value }}'
    state: present
    reload: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.10.1.1
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-SC-7(a)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv4_conf_all_accept_redirects
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_net_ipv4_conf_all_accept_redirects" system="urn:xccdf:fix:script:kubernetes">apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,net.ipv4.conf.all.accept_redirects%3D0%0A
        mode: 0644
        path: /etc/sysctl.d/75-sysctl_net_ipv4_conf_all_accept_redirects.conf
        overwrite: true
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-export export-name="oval:ssg-sysctl_net_ipv4_conf_all_accept_redirects_value:var:1" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_accept_redirects_value"/>
              <check-content-ref name="oval:ssg-sysctl_net_ipv4_conf_all_accept_redirects:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-sysctl_net_ipv4_conf_all_accept_redirects_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_accept_redirects" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To set the runtime status of the <html:code xmlns:html="http://www.w3.org/1999/xhtml">net.ipv4.conf.default.accept_redirects</html:code> kernel parameter, run the following command: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo sysctl -w net.ipv4.conf.default.accept_redirects=0</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/sysctl.d</html:code>: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">net.ipv4.conf.default.accept_redirects = 0</html:pre></description>
            <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R22)</reference>
            <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.10.1.1</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.20</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-001551</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-7(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.AM-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-5</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.11</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.12</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.3.3</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI04.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.06</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.10.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.1.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.1.5</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.1.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.5.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.6.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.1.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.17.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.7.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.7.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.7.3.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.8.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.8.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.5</reference>
            <reference href="https://www.cisecurity.org/controls/">1</reference>
            <reference href="https://www.cisecurity.org/controls/">11</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">13</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">18</reference>
            <reference href="https://www.cisecurity.org/controls/">2</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">4</reference>
            <reference href="https://www.cisecurity.org/controls/">6</reference>
            <reference href="https://www.cisecurity.org/controls/">7</reference>
            <reference href="https://www.cisecurity.org/controls/">8</reference>
            <reference href="https://www.cisecurity.org/controls/">9</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">ICMP redirect messages are used by routers to inform hosts that a more
direct route exists for a particular destination. These messages modify the
host's route table and are unauthenticated. An illicit ICMP redirect
message could result in a man-in-the-middle attack.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>This feature of the IPv4 protocol has few legitimate uses. It should
be disabled unless absolutely required.</rationale>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_net_ipv4_conf_default_accept_redirects" system="urn:xccdf:fix:script:sh" reboot="true" complexity="low" disruption="medium" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then


sysctl_net_ipv4_conf_default_accept_redirects_value="<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_default_accept_redirects_value" use="legacy"/>"



#
# Set runtime for net.ipv4.conf.default.accept_redirects
#
/sbin/sysctl -q -n -w net.ipv4.conf.default.accept_redirects="$sysctl_net_ipv4_conf_default_accept_redirects_value"

#
# If net.ipv4.conf.default.accept_redirects present in /etc/sysctl.conf, change value to appropriate value
#	else, add "net.ipv4.conf.default.accept_redirects = value" to /etc/sysctl.conf
#
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_replace_or_append" use="legacy"/>
replace_or_append '/etc/sysctl.conf' '^net.ipv4.conf.default.accept_redirects' "$sysctl_net_ipv4_conf_default_accept_redirects_value" ''

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_net_ipv4_conf_default_accept_redirects" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="medium" strategy="disable">- name: XCCDF Value sysctl_net_ipv4_conf_default_accept_redirects_value # promote to variable
  set_fact:
    sysctl_net_ipv4_conf_default_accept_redirects_value: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_default_accept_redirects_value" use="legacy"/>
  tags:
    - always

- name: Ensure sysctl net.ipv4.conf.default.accept_redirects is set
  sysctl:
    name: net.ipv4.conf.default.accept_redirects
    value: '{{ sysctl_net_ipv4_conf_default_accept_redirects_value }}'
    state: present
    reload: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.10.1.1
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-SC-7(a)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv4_conf_default_accept_redirects
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_net_ipv4_conf_default_accept_redirects" system="urn:xccdf:fix:script:kubernetes">apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,net.ipv4.conf.default.accept_redirects%3D0%0A
        mode: 0644
        path: /etc/sysctl.d/75-sysctl_net_ipv4_conf_default_accept_redirects.conf
        overwrite: true
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-export export-name="oval:ssg-sysctl_net_ipv4_conf_default_accept_redirects_value:var:1" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_default_accept_redirects_value"/>
              <check-content-ref name="oval:ssg-sysctl_net_ipv4_conf_default_accept_redirects:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-sysctl_net_ipv4_conf_default_accept_redirects_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_ip_local_port_range" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Set Kernel Parameter to Increase Local Port Range</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To set the runtime status of the <html:code xmlns:html="http://www.w3.org/1999/xhtml">net.ipv4.ip_local_port_range</html:code> kernel parameter, run the following command: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo sysctl -w net.ipv4.ip_local_port_range=32768 65535</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/sysctl.d</html:code>: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">net.ipv4.ip_local_port_range = 32768 65535</html:pre></description>
            <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R22)</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">This setting defines the local port range that is used by TCP and UDP to
choose the local port. The first number is the first, the second the last
local port number.</rationale>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_net_ipv4_ip_local_port_range" system="urn:xccdf:fix:script:sh" reboot="true" complexity="low" disruption="medium" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then



#
# Set runtime for net.ipv4.ip_local_port_range
#
/sbin/sysctl -q -n -w net.ipv4.ip_local_port_range="32768 65535"

#
# If net.ipv4.ip_local_port_range present in /etc/sysctl.conf, change value to "32768 65535"
#	else, add "net.ipv4.ip_local_port_range = 32768 65535" to /etc/sysctl.conf
#
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_replace_or_append" use="legacy"/>
replace_or_append '/etc/sysctl.conf' '^net.ipv4.ip_local_port_range' "32768 65535" ''

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_net_ipv4_ip_local_port_range" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="medium" strategy="disable">- name: Ensure sysctl net.ipv4.ip_local_port_range is set to 32768 65535
  sysctl:
    name: net.ipv4.ip_local_port_range
    value: 32768 65535
    state: present
    reload: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv4_ip_local_port_range
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-sysctl_net_ipv4_ip_local_port_range:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-sysctl_net_ipv4_ip_local_port_range_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_secure_redirects" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Configure Kernel Parameter for Accepting Secure Redirects By Default</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To set the runtime status of the <html:code xmlns:html="http://www.w3.org/1999/xhtml">net.ipv4.conf.default.secure_redirects</html:code> kernel parameter, run the following command: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo sysctl -w net.ipv4.conf.default.secure_redirects=0</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/sysctl.d</html:code>: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">net.ipv4.conf.default.secure_redirects = 0</html:pre></description>
            <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R22)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.20</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-001551</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-5</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-7(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.AM-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-5</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.11</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.12</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.3.3</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI04.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.06</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.10.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.1.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.1.5</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.1.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.5.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.6.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.1.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.17.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.7.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.7.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.7.3.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.8.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.8.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.5</reference>
            <reference href="https://www.cisecurity.org/controls/">1</reference>
            <reference href="https://www.cisecurity.org/controls/">11</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">13</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">18</reference>
            <reference href="https://www.cisecurity.org/controls/">2</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">4</reference>
            <reference href="https://www.cisecurity.org/controls/">6</reference>
            <reference href="https://www.cisecurity.org/controls/">7</reference>
            <reference href="https://www.cisecurity.org/controls/">8</reference>
            <reference href="https://www.cisecurity.org/controls/">9</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Accepting "secure" ICMP redirects (from those gateways listed as
default gateways) has few legitimate uses. It should be disabled unless it is
absolutely required.</rationale>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_net_ipv4_conf_default_secure_redirects" system="urn:xccdf:fix:script:sh" reboot="true" complexity="low" disruption="medium" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then


sysctl_net_ipv4_conf_default_secure_redirects_value="<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_default_secure_redirects_value" use="legacy"/>"



#
# Set runtime for net.ipv4.conf.default.secure_redirects
#
/sbin/sysctl -q -n -w net.ipv4.conf.default.secure_redirects="$sysctl_net_ipv4_conf_default_secure_redirects_value"

#
# If net.ipv4.conf.default.secure_redirects present in /etc/sysctl.conf, change value to appropriate value
#	else, add "net.ipv4.conf.default.secure_redirects = value" to /etc/sysctl.conf
#
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_replace_or_append" use="legacy"/>
replace_or_append '/etc/sysctl.conf' '^net.ipv4.conf.default.secure_redirects' "$sysctl_net_ipv4_conf_default_secure_redirects_value" ''

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_net_ipv4_conf_default_secure_redirects" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="medium" strategy="disable">- name: XCCDF Value sysctl_net_ipv4_conf_default_secure_redirects_value # promote to variable
  set_fact:
    sysctl_net_ipv4_conf_default_secure_redirects_value: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_default_secure_redirects_value" use="legacy"/>
  tags:
    - always

- name: Ensure sysctl net.ipv4.conf.default.secure_redirects is set
  sysctl:
    name: net.ipv4.conf.default.secure_redirects
    value: '{{ sysctl_net_ipv4_conf_default_secure_redirects_value }}'
    state: present
    reload: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-SC-5
    - NIST-800-53-SC-7(a)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv4_conf_default_secure_redirects
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_net_ipv4_conf_default_secure_redirects" system="urn:xccdf:fix:script:kubernetes">apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,net.ipv4.conf.default.secure_redirects%3D0%0A
        mode: 0644
        path: /etc/sysctl.d/75-sysctl_net_ipv4_conf_default_secure_redirects.conf
        overwrite: true
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-export export-name="oval:ssg-sysctl_net_ipv4_conf_default_secure_redirects_value:var:1" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_default_secure_redirects_value"/>
              <check-content-ref name="oval:ssg-sysctl_net_ipv4_conf_default_secure_redirects:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-sysctl_net_ipv4_conf_default_secure_redirects_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_icmp_echo_ignore_broadcasts" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To set the runtime status of the <html:code xmlns:html="http://www.w3.org/1999/xhtml">net.ipv4.icmp_echo_ignore_broadcasts</html:code> kernel parameter, run the following command: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo sysctl -w net.ipv4.icmp_echo_ignore_broadcasts=1</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/sysctl.d</html:code>: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">net.ipv4.icmp_echo_ignore_broadcasts = 1</html:pre></description>
            <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.10.1.1</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.20</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-5</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.AM-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-5</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.11</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.12</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.3.3</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI04.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.06</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.10.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.1.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.1.5</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.1.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.5.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.6.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.1.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.17.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.7.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.7.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.7.3.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.8.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.8.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.5</reference>
            <reference href="https://www.cisecurity.org/controls/">1</reference>
            <reference href="https://www.cisecurity.org/controls/">11</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">13</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">18</reference>
            <reference href="https://www.cisecurity.org/controls/">2</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">4</reference>
            <reference href="https://www.cisecurity.org/controls/">6</reference>
            <reference href="https://www.cisecurity.org/controls/">7</reference>
            <reference href="https://www.cisecurity.org/controls/">8</reference>
            <reference href="https://www.cisecurity.org/controls/">9</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Responding to broadcast (ICMP) echoes facilitates network mapping
and provides a vector for amplification attacks.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Ignoring ICMP echo requests (pings) sent to broadcast or multicast
addresses makes the system slightly more difficult to enumerate on the network.</rationale>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_net_ipv4_icmp_echo_ignore_broadcasts" system="urn:xccdf:fix:script:sh" reboot="true" complexity="low" disruption="medium" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then


sysctl_net_ipv4_icmp_echo_ignore_broadcasts_value="<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_icmp_echo_ignore_broadcasts_value" use="legacy"/>"



#
# Set runtime for net.ipv4.icmp_echo_ignore_broadcasts
#
/sbin/sysctl -q -n -w net.ipv4.icmp_echo_ignore_broadcasts="$sysctl_net_ipv4_icmp_echo_ignore_broadcasts_value"

#
# If net.ipv4.icmp_echo_ignore_broadcasts present in /etc/sysctl.conf, change value to appropriate value
#	else, add "net.ipv4.icmp_echo_ignore_broadcasts = value" to /etc/sysctl.conf
#
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_replace_or_append" use="legacy"/>
replace_or_append '/etc/sysctl.conf' '^net.ipv4.icmp_echo_ignore_broadcasts' "$sysctl_net_ipv4_icmp_echo_ignore_broadcasts_value" ''

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_net_ipv4_icmp_echo_ignore_broadcasts" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="medium" strategy="disable">- name: XCCDF Value sysctl_net_ipv4_icmp_echo_ignore_broadcasts_value # promote to variable
  set_fact:
    sysctl_net_ipv4_icmp_echo_ignore_broadcasts_value: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_icmp_echo_ignore_broadcasts_value" use="legacy"/>
  tags:
    - always

- name: Ensure sysctl net.ipv4.icmp_echo_ignore_broadcasts is set
  sysctl:
    name: net.ipv4.icmp_echo_ignore_broadcasts
    value: '{{ sysctl_net_ipv4_icmp_echo_ignore_broadcasts_value }}'
    state: present
    reload: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.10.1.1
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-SC-5
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv4_icmp_echo_ignore_broadcasts
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_net_ipv4_icmp_echo_ignore_broadcasts" system="urn:xccdf:fix:script:kubernetes">apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,net.ipv4.icmp_echo_ignore_broadcasts%3D1%0A
        mode: 0644
        path: /etc/sysctl.d/75-sysctl_net_ipv4_icmp_echo_ignore_broadcasts.conf
        overwrite: true
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-export export-name="oval:ssg-sysctl_net_ipv4_icmp_echo_ignore_broadcasts_value:var:1" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_icmp_echo_ignore_broadcasts_value"/>
              <check-content-ref name="oval:ssg-sysctl_net_ipv4_icmp_echo_ignore_broadcasts:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-sysctl_net_ipv4_icmp_echo_ignore_broadcasts_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_tcp_syncookies" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Enable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To set the runtime status of the <html:code xmlns:html="http://www.w3.org/1999/xhtml">net.ipv4.tcp_syncookies</html:code> kernel parameter, run the following command: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo sysctl -w net.ipv4.tcp_syncookies=1</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/sysctl.d</html:code>: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">net.ipv4.tcp_syncookies = 1</html:pre></description>
            <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R22)</reference>
            <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.10.1.1</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.20</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-001095</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-5(1)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-5(2)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-5(3)(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.AM-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-5</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000420-GPOS-00186</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000142-GPOS-00071</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.3.3</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI04.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.10.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.1.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.1.5</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.1.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.1.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.17.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.7.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.7.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.7.3.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.8.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.8.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.5</reference>
            <reference href="https://www.cisecurity.org/controls/">1</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">13</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">18</reference>
            <reference href="https://www.cisecurity.org/controls/">2</reference>
            <reference href="https://www.cisecurity.org/controls/">4</reference>
            <reference href="https://www.cisecurity.org/controls/">6</reference>
            <reference href="https://www.cisecurity.org/controls/">7</reference>
            <reference href="https://www.cisecurity.org/controls/">8</reference>
            <reference href="https://www.cisecurity.org/controls/">9</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">A TCP SYN flood attack can cause a denial of service by filling a
system's TCP connection table with connections in the SYN_RCVD state.
Syncookies can be used to track a connection when a subsequent ACK is received,
verifying the initiator is attempting a valid connection and is not a flood
source. This feature is activated when a flood condition is detected, and
enables the system to continue servicing valid connection requests.</rationale>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_net_ipv4_tcp_syncookies" system="urn:xccdf:fix:script:sh" reboot="true" complexity="low" disruption="medium" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then


sysctl_net_ipv4_tcp_syncookies_value="<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_tcp_syncookies_value" use="legacy"/>"



#
# Set runtime for net.ipv4.tcp_syncookies
#
/sbin/sysctl -q -n -w net.ipv4.tcp_syncookies="$sysctl_net_ipv4_tcp_syncookies_value"

#
# If net.ipv4.tcp_syncookies present in /etc/sysctl.conf, change value to appropriate value
#	else, add "net.ipv4.tcp_syncookies = value" to /etc/sysctl.conf
#
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_replace_or_append" use="legacy"/>
replace_or_append '/etc/sysctl.conf' '^net.ipv4.tcp_syncookies' "$sysctl_net_ipv4_tcp_syncookies_value" ''

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_net_ipv4_tcp_syncookies" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="medium" strategy="disable">- name: XCCDF Value sysctl_net_ipv4_tcp_syncookies_value # promote to variable
  set_fact:
    sysctl_net_ipv4_tcp_syncookies_value: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_tcp_syncookies_value" use="legacy"/>
  tags:
    - always

- name: Ensure sysctl net.ipv4.tcp_syncookies is set
  sysctl:
    name: net.ipv4.tcp_syncookies
    value: '{{ sysctl_net_ipv4_tcp_syncookies_value }}'
    state: present
    reload: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.10.1.1
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-SC-5(1)
    - NIST-800-53-SC-5(2)
    - NIST-800-53-SC-5(3)(a)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv4_tcp_syncookies
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_net_ipv4_tcp_syncookies" system="urn:xccdf:fix:script:kubernetes">apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,net.ipv4.tcp_syncookies%3D1%0A
        mode: 0644
        path: /etc/sysctl.d/75-sysctl_net_ipv4_tcp_syncookies.conf
        overwrite: true
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-export export-name="oval:ssg-sysctl_net_ipv4_tcp_syncookies_value:var:1" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_tcp_syncookies_value"/>
              <check-content-ref name="oval:ssg-sysctl_net_ipv4_tcp_syncookies:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-sysctl_net_ipv4_tcp_syncookies_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_rp_filter" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Enable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To set the runtime status of the <html:code xmlns:html="http://www.w3.org/1999/xhtml">net.ipv4.conf.all.rp_filter</html:code> kernel parameter, run the following command: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo sysctl -w net.ipv4.conf.all.rp_filter=1</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/sysctl.d</html:code>: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">net.ipv4.conf.all.rp_filter = 1</html:pre></description>
            <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R22)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.20</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-001551</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-7(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.AM-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-5</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.3.3</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI04.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.10.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.1.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.1.5</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.1.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.1.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.17.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.7.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.7.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.7.3.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.8.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.8.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.5</reference>
            <reference href="https://www.cisecurity.org/controls/">1</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">13</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">18</reference>
            <reference href="https://www.cisecurity.org/controls/">2</reference>
            <reference href="https://www.cisecurity.org/controls/">4</reference>
            <reference href="https://www.cisecurity.org/controls/">6</reference>
            <reference href="https://www.cisecurity.org/controls/">7</reference>
            <reference href="https://www.cisecurity.org/controls/">8</reference>
            <reference href="https://www.cisecurity.org/controls/">9</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Enabling reverse path filtering drops packets with source addresses
that should not have been able to be received on the interface they were
received on. It should not be used on systems which are routers for
complicated networks, but is helpful for end hosts and routers serving small
networks.</rationale>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_net_ipv4_conf_all_rp_filter" system="urn:xccdf:fix:script:sh" reboot="true" complexity="low" disruption="medium" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then


sysctl_net_ipv4_conf_all_rp_filter_value="<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_rp_filter_value" use="legacy"/>"



#
# Set runtime for net.ipv4.conf.all.rp_filter
#
/sbin/sysctl -q -n -w net.ipv4.conf.all.rp_filter="$sysctl_net_ipv4_conf_all_rp_filter_value"

#
# If net.ipv4.conf.all.rp_filter present in /etc/sysctl.conf, change value to appropriate value
#	else, add "net.ipv4.conf.all.rp_filter = value" to /etc/sysctl.conf
#
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_replace_or_append" use="legacy"/>
replace_or_append '/etc/sysctl.conf' '^net.ipv4.conf.all.rp_filter' "$sysctl_net_ipv4_conf_all_rp_filter_value" ''

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_net_ipv4_conf_all_rp_filter" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="medium" strategy="disable">- name: XCCDF Value sysctl_net_ipv4_conf_all_rp_filter_value # promote to variable
  set_fact:
    sysctl_net_ipv4_conf_all_rp_filter_value: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_rp_filter_value" use="legacy"/>
  tags:
    - always

- name: Ensure sysctl net.ipv4.conf.all.rp_filter is set
  sysctl:
    name: net.ipv4.conf.all.rp_filter
    value: '{{ sysctl_net_ipv4_conf_all_rp_filter_value }}'
    state: present
    reload: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-SC-7(a)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv4_conf_all_rp_filter
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_net_ipv4_conf_all_rp_filter" system="urn:xccdf:fix:script:kubernetes">apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,net.ipv4.conf.all.rp_filter%3D1%0A
        mode: 0644
        path: /etc/sysctl.d/75-sysctl_net_ipv4_conf_all_rp_filter.conf
        overwrite: true
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-export export-name="oval:ssg-sysctl_net_ipv4_conf_all_rp_filter_value:var:1" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_rp_filter_value"/>
              <check-content-ref name="oval:ssg-sysctl_net_ipv4_conf_all_rp_filter:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-sysctl_net_ipv4_conf_all_rp_filter_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_secure_redirects" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To set the runtime status of the <html:code xmlns:html="http://www.w3.org/1999/xhtml">net.ipv4.conf.all.secure_redirects</html:code> kernel parameter, run the following command: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo sysctl -w net.ipv4.conf.all.secure_redirects=0</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/sysctl.d</html:code>: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">net.ipv4.conf.all.secure_redirects = 0</html:pre></description>
            <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R22)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.20</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-001503</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-001551</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-7(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.AM-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-5</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.11</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.12</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.3.3</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI04.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.06</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.10.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.1.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.1.5</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.11.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.1.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.5.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.6.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.1.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.13.2.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.17.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.7.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.7.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.7.3.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.8.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.8.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.5</reference>
            <reference href="https://www.cisecurity.org/controls/">1</reference>
            <reference href="https://www.cisecurity.org/controls/">11</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">13</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">18</reference>
            <reference href="https://www.cisecurity.org/controls/">2</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">4</reference>
            <reference href="https://www.cisecurity.org/controls/">6</reference>
            <reference href="https://www.cisecurity.org/controls/">7</reference>
            <reference href="https://www.cisecurity.org/controls/">8</reference>
            <reference href="https://www.cisecurity.org/controls/">9</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Accepting "secure" ICMP redirects (from those gateways listed as
default gateways) has few legitimate uses. It should be disabled unless it is
absolutely required.</rationale>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_net_ipv4_conf_all_secure_redirects" system="urn:xccdf:fix:script:sh" reboot="true" complexity="low" disruption="medium" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then


sysctl_net_ipv4_conf_all_secure_redirects_value="<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_secure_redirects_value" use="legacy"/>"



#
# Set runtime for net.ipv4.conf.all.secure_redirects
#
/sbin/sysctl -q -n -w net.ipv4.conf.all.secure_redirects="$sysctl_net_ipv4_conf_all_secure_redirects_value"

#
# If net.ipv4.conf.all.secure_redirects present in /etc/sysctl.conf, change value to appropriate value
#	else, add "net.ipv4.conf.all.secure_redirects = value" to /etc/sysctl.conf
#
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_replace_or_append" use="legacy"/>
replace_or_append '/etc/sysctl.conf' '^net.ipv4.conf.all.secure_redirects' "$sysctl_net_ipv4_conf_all_secure_redirects_value" ''

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_net_ipv4_conf_all_secure_redirects" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="medium" strategy="disable">- name: XCCDF Value sysctl_net_ipv4_conf_all_secure_redirects_value # promote to variable
  set_fact:
    sysctl_net_ipv4_conf_all_secure_redirects_value: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_secure_redirects_value" use="legacy"/>
  tags:
    - always

- name: Ensure sysctl net.ipv4.conf.all.secure_redirects is set
  sysctl:
    name: net.ipv4.conf.all.secure_redirects
    value: '{{ sysctl_net_ipv4_conf_all_secure_redirects_value }}'
    state: present
    reload: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-SC-7(a)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv4_conf_all_secure_redirects
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_net_ipv4_conf_all_secure_redirects" system="urn:xccdf:fix:script:kubernetes">apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,net.ipv4.conf.all.secure_redirects%3D0%0A
        mode: 0644
        path: /etc/sysctl.d/75-sysctl_net_ipv4_conf_all_secure_redirects.conf
        overwrite: true
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-export export-name="oval:ssg-sysctl_net_ipv4_conf_all_secure_redirects_value:var:1" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_secure_redirects_value"/>
              <check-content-ref name="oval:ssg-sysctl_net_ipv4_conf_all_secure_redirects:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-sysctl_net_ipv4_conf_all_secure_redirects_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
        </Group>
      </Group>
      <Group id="xccdf_org.ssgproject.content_group_network-ipv6">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">IPv6</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The system includes support for Internet Protocol
version 6. A major and often-mentioned improvement over IPv4 is its
enormous increase in the number of available addresses. Another
important feature is its support for automatic configuration of
many network settings.</description>
        <Group id="xccdf_org.ssgproject.content_group_disabling_ipv6">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable Support for IPv6 Unless Needed</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Despite configuration that suggests support for IPv6 has
been disabled, link-local IPv6 address auto-configuration occurs
even when only an IPv4 address is assigned. The only way to
effectively prevent execution of the IPv6 networking stack is to
instruct the system not to activate the IPv6 kernel module.</description>
          <Rule id="xccdf_org.ssgproject.content_rule_network_ipv6_disable_interfaces" selected="false" role="full" severity="unknown">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable Interface Usage of IPv6</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To disable interface usage of IPv6, add or correct the following lines in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/sysconfig/network</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">NETWORKING_IPV6=no
IPV6INIT=no</html:pre></description>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US"/>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_kernel_module_ipv6_option_disabled" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable IPv6 Networking Support Automatic Loading</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To prevent the IPv6 kernel module (<html:code xmlns:html="http://www.w3.org/1999/xhtml">ipv6</html:code>) from binding to the
IPv6 networking stack, add the following line to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/modprobe.d/disabled.conf</html:code> (or another file in
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/modprobe.d</html:code>):
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">options ipv6 disable=1</html:pre>
This permits the IPv6 module to be loaded (and thus satisfy other modules that
depend on it), while disabling support for the IPv6 protocol.</description>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.11</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.12</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.3</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.06</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.5.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.6.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
            <reference href="https://www.cisecurity.org/controls/">11</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">9</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Any unnecessary network stacks - including IPv6 - should be disabled, to reduce
the vulnerability to exploitation.</rationale>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="kernel_module_ipv6_option_disabled" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

# Prevent the IPv6 kernel module (ipv6) from loading the IPv6 networking stack
echo "options ipv6 disable=1" &gt; /etc/modprobe.d/ipv6.conf

# Since according to: https://access.redhat.com/solutions/72733
# "ipv6 disable=1" options doesn't always disable the IPv6 networking stack from
# loading, instruct also sysctl configuration to disable IPv6 according to:
# https://access.redhat.com/solutions/8709#rhel6disable

declare -a IPV6_SETTINGS=("net.ipv6.conf.all.disable_ipv6" "net.ipv6.conf.default.disable_ipv6")

for setting in "${IPV6_SETTINGS[@]}"
do
	# Set runtime =1 for setting
	/sbin/sysctl -q -n -w "$setting=1"

	# If setting is present in /etc/sysctl.conf, change value to "1"
	# else, add "$setting = 1" to /etc/sysctl.conf
	if grep -q ^"$setting" /etc/sysctl.conf ; then
		sed -i "s/^$setting.*/$setting = 1/g" /etc/sysctl.conf
	else
		echo "" &gt;&gt; /etc/sysctl.conf
		echo "# Set $setting = 1 per security requirements" &gt;&gt; /etc/sysctl.conf
		echo "$setting = 1" &gt;&gt; /etc/sysctl.conf
	fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="kernel_module_ipv6_option_disabled" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="medium" strategy="disable">- name: Disable IPv6 Networking kernel module
  lineinfile:
    create: true
    dest: /etc/modprobe.d/ipv6.conf
    regexp: ^options\s+ipv6\s+disable=\d
    line: options ipv6 disable=1
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - disable_strategy
    - kernel_module_ipv6_option_disabled
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required

- name: Ensure disable_ipv6 (all and default) is set to 1
  sysctl:
    name: '{{ item }}'
    value: '1'
    state: present
    reload: true
  with_items:
    - net.ipv6.conf.all.disable_ipv6
    - net.ipv6.conf.default.disable_ipv6
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - disable_strategy
    - kernel_module_ipv6_option_disabled
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-kernel_module_ipv6_option_disabled:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-kernel_module_ipv6_option_disabled_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_all_disable_ipv6" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable IPv6 Networking Support Automatic Loading</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To disable support for (<html:code xmlns:html="http://www.w3.org/1999/xhtml">ipv6</html:code>) add the following line to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/sysctl.d/ipv6.conf</html:code> (or another file in
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/sysctl.d</html:code>):
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">net.ipv6.conf.all.disable_ipv6 = 1</html:pre>
This disables IPv6 on all network interfaces as other services and system
functionality require the IPv6 stack loaded to work.</description>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.20</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-001551</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.11</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.12</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.3</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.06</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.5.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.6.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
            <reference href="https://www.cisecurity.org/controls/">11</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">9</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Any unnecessary network stacks - including IPv6 - should be disabled, to reduce
the vulnerability to exploitation.</rationale>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_net_ipv6_conf_all_disable_ipv6" system="urn:xccdf:fix:script:sh" reboot="true" complexity="low" disruption="medium" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then



#
# Set runtime for net.ipv6.conf.all.disable_ipv6
#
/sbin/sysctl -q -n -w net.ipv6.conf.all.disable_ipv6="1"

#
# If net.ipv6.conf.all.disable_ipv6 present in /etc/sysctl.conf, change value to "1"
#	else, add "net.ipv6.conf.all.disable_ipv6 = 1" to /etc/sysctl.conf
#
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_replace_or_append" use="legacy"/>
replace_or_append '/etc/sysctl.conf' '^net.ipv6.conf.all.disable_ipv6' "1" ''

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_net_ipv6_conf_all_disable_ipv6" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="medium" strategy="disable">- name: Ensure sysctl net.ipv6.conf.all.disable_ipv6 is set to 1
  sysctl:
    name: net.ipv6.conf.all.disable_ipv6
    value: '1'
    state: present
    reload: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv6_conf_all_disable_ipv6
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-sysctl_net_ipv6_conf_all_disable_ipv6:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-sysctl_net_ipv6_conf_all_disable_ipv6_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_network_ipv6_disable_rpc" selected="false" role="full" severity="unknown">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable Support for RPC IPv6</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">RPC services for NFSv4 try to load transport modules for
<html:code xmlns:html="http://www.w3.org/1999/xhtml">udp6</html:code> and <html:code xmlns:html="http://www.w3.org/1999/xhtml">tcp6</html:code> by default, even if IPv6 has been disabled in
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/modprobe.d</html:code>. To prevent RPC services such as <html:code xmlns:html="http://www.w3.org/1999/xhtml">rpc.mountd</html:code>
from attempting to start IPv6 network listeners, remove or comment out the
following two lines in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/netconfig</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">udp6       tpi_clts      v     inet6    udp     -       -
tcp6       tpi_cots_ord  v     inet6    tcp     -       -</html:pre></description>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.20</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.11</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.12</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.3</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.06</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.5.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.6.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
            <reference href="https://www.cisecurity.org/controls/">11</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">9</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US"/>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-network_ipv6_disable_rpc:def:1" href="ssg-fedora-oval.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_grub2_ipv6_disable_argument" selected="false" role="full" severity="low">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure IPv6 is disabled through kernel boot parameter</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To disable IPv6 protocol support in the Linux kernel,
add the argument <html:code xmlns:html="http://www.w3.org/1999/xhtml">ipv6.disable=1</html:code> to the default
GRUB2 command line for the Linux operating system in

<html:code xmlns:html="http://www.w3.org/1999/xhtml">/boot/grub2/grubenv</html:code>, in the manner below:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">sudo  grub2-editenv - set "$(grub2-editenv - list | grep kernelopts) ipv6.disable=1"</html:pre></description>
            <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="management">The GRUB 2 configuration file, <html:code xmlns:html="http://www.w3.org/1999/xhtml">grub.cfg</html:code>,
is automatically updated each time a new kernel is installed. Note that any
changes to <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/default/grub</html:code> require rebuilding the <html:code xmlns:html="http://www.w3.org/1999/xhtml">grub.cfg</html:code>
file. To update the GRUB 2 configuration file manually, use the
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">grub2-mkconfig -o</html:pre> command as follows:
<html:ul xmlns:html="http://www.w3.org/1999/xhtml"><html:li>On BIOS-based machines, issue the following command:
<html:pre>sudo grub2-mkconfig -o /boot/grub2/grub.cfg</html:pre></html:li><html:li>On UEFI-based machines, issue the following command:

<html:pre>sudo grub2-mkconfig -o /boot/efi/EFI/fedora/grub.cfg</html:pre></html:li></html:ul></warning>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Any unnecessary network stacks, including IPv6, should be disabled to reduce
the vulnerability to exploitation.</rationale>
            <platform idref="cpe:/a:grub2"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="grub2_ipv6_disable_argument" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q grub2-common; then

# Correct grub2 kernelopts value using grub2-editenv
if ! grub2-editenv - list | grep -qE '^kernelopts=(.*\s)?ipv6.disable=1(\s.*)?$'; then
  grub2-editenv - set "$(grub2-editenv - list | grep kernelopts) ipv6.disable=1"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="grub2_ipv6_disable_argument" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="medium" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - grub2_ipv6_disable_argument
    - low_disruption
    - low_severity
    - medium_complexity
    - reboot_required
    - restrict_strategy

- name: get current kernel parameters
  command: /usr/bin/grub2-editenv - list
  register: kernelopts
  changed_when: false
  when: '"grub2-common" in ansible_facts.packages'
  tags:
    - grub2_ipv6_disable_argument
    - low_disruption
    - low_severity
    - medium_complexity
    - reboot_required
    - restrict_strategy

- name: Update the bootloader menu
  command: /usr/bin/grub2-editenv - set "{{ item }} ipv6.disable=1"
  with_items: '{{ kernelopts.stdout_lines | select(''match'', ''^kernelopts.*'') |
    list }}'
  when:
    - '"grub2-common" in ansible_facts.packages'
    - kernelopts.stdout_lines is defined
    - kernelopts.stdout_lines | length &gt; 0
    - kernelopts.stdout | regex_search('^kernelopts=(?:.*\s)?ipv6.disable=1(?:\s.*)?$',
      multiline=True) is none
  tags:
    - grub2_ipv6_disable_argument
    - low_disruption
    - low_severity
    - medium_complexity
    - reboot_required
    - restrict_strategy
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-grub2_ipv6_disable_argument:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-grub2_ipv6_disable_argument_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
        </Group>
        <Group id="xccdf_org.ssgproject.content_group_configuring_ipv6">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Configure IPv6 Settings if Necessary</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">A major feature of IPv6 is the extent to which systems
implementing it can automatically configure their networking
devices using information from the network. From a security
perspective, manually configuring important configuration
information is preferable to accepting it from the network
in an unauthenticated fashion.</description>
          <Value id="xccdf_org.ssgproject.content_value_sysconfig_network_IPV6_AUTOCONF_value" type="string">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">IPV6_AUTOCONF</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Toggle global IPv6 auto-configuration (only, if global
forwarding is disabled)</description>
            <value>no</value>
            <value selector="disabled">no</value>
            <value selector="enabled">yes</value>
          </Value>
          <Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_accept_ra_defrtr_value" type="number">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">net.ipv6.conf.all.accept_ra_defrtr</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Accept default router in router advertisements?</description>
            <value>0</value>
            <value selector="disabled">0</value>
            <value selector="enabled">1</value>
          </Value>
          <Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_accept_ra_pinfo_value" type="number">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">net.ipv6.conf.all.accept_ra_pinfo</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Accept prefix information in router advertisements?</description>
            <value>0</value>
            <value selector="disabled">0</value>
            <value selector="enabled">1</value>
          </Value>
          <Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_accept_ra_rtr_pref_value" type="number">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">net.ipv6.conf.all.accept_ra_rtr_pref</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Accept router preference in router advertisements?</description>
            <value>0</value>
            <value selector="disabled">0</value>
            <value selector="enabled">1</value>
          </Value>
          <Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_accept_ra_value" type="number">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">net.ipv6.conf.all.accept_ra</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Accept all router advertisements?</description>
            <value>0</value>
            <value selector="disabled">0</value>
            <value selector="enabled">1</value>
          </Value>
          <Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_accept_redirects_value" type="number">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">net.ipv6.conf.all.accept_redirects</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Toggle ICMP Redirect Acceptance</description>
            <value>0</value>
            <value selector="disabled">0</value>
            <value selector="enabled">1</value>
          </Value>
          <Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_accept_source_route_value" type="number">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">net.ipv6.conf.all.accept_source_route</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Trackers could be using source-routed packets to
generate traffic that seems to be intra-net, but actually was
created outside and has been redirected.</description>
            <value>0</value>
            <value selector="disabled">0</value>
            <value selector="enabled">1</value>
          </Value>
          <Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_autoconf_value" type="number">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">net.ipv6.conf.all.autoconf</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Enable auto configuration on IPv6 interfaces</description>
            <value>0</value>
            <value selector="disabled">0</value>
            <value selector="enabled">1</value>
          </Value>
          <Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_forwarding_value" type="number">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">net.ipv6.conf.all.forwarding</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Toggle IPv6 Forwarding</description>
            <value>0</value>
            <value selector="disabled">0</value>
            <value selector="enabled">1</value>
          </Value>
          <Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_max_addresses_value" type="number">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">net.ipv6.conf.all.max_addresses</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Maximum number of autoconfigured IPv6 addresses</description>
            <value>1</value>
          </Value>
          <Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_router_solicitations_value" type="number">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">net.ipv6.conf.all.router_solicitations</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Accept all router solicitations?</description>
            <value>0</value>
            <value selector="disabled">0</value>
            <value selector="enabled">1</value>
          </Value>
          <Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_accept_ra_defrtr_value" type="number">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">net.ipv6.conf.default.accept_ra_defrtr</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Accept default router in router advertisements?</description>
            <value>0</value>
            <value selector="disabled">0</value>
            <value selector="enabled">1</value>
          </Value>
          <Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_accept_ra_pinfo_value" type="number">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">net.ipv6.conf.default.accept_ra_pinfo</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Accept prefix information in router advertisements?</description>
            <value>0</value>
            <value selector="disabled">0</value>
            <value selector="enabled">1</value>
          </Value>
          <Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_accept_ra_rtr_pref_value" type="number">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">net.ipv6.conf.default.accept_ra_rtr_pref</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Accept router preference in router advertisements?</description>
            <value>0</value>
            <value selector="disabled">0</value>
            <value selector="enabled">1</value>
          </Value>
          <Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_accept_ra_value" type="number">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">net.ipv6.conf.default.accept_ra</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Accept default router advertisements by default?</description>
            <value>0</value>
            <value selector="disabled">0</value>
            <value selector="enabled">1</value>
          </Value>
          <Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_accept_redirects_value" type="number">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">net.ipv6.conf.default.accept_redirects</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Toggle ICMP Redirect Acceptance By Default</description>
            <value>0</value>
            <value selector="disabled">0</value>
            <value selector="enabled">1</value>
          </Value>
          <Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_accept_source_route_value" type="number">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">net.ipv6.conf.default.accept_source_route</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Trackers could be using source-routed packets to
generate traffic that seems to be intra-net, but actually was
created outside and has been redirected.</description>
            <value>0</value>
            <value selector="disabled">0</value>
            <value selector="enabled">1</value>
          </Value>
          <Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_autoconf_value" type="number">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">net.ipv6.conf.default.autoconf</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Enable auto configuration on IPv6 interfaces</description>
            <value>0</value>
            <value selector="disabled">0</value>
            <value selector="enabled">1</value>
          </Value>
          <Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_forwarding_value" type="number">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">net.ipv6.conf.default.forwarding</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Toggle IPv6 default Forwarding</description>
            <value>0</value>
            <value selector="disabled">0</value>
            <value selector="enabled">1</value>
          </Value>
          <Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_max_addresses_value" type="number">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">net.ipv6.conf.default.max_addresses</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Maximum number of autoconfigured IPv6 addresses</description>
            <value>1</value>
          </Value>
          <Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_router_solicitations_value" type="number">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">net.ipv6.conf.default.router_solicitations</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Accept all router solicitations by default?</description>
            <value>0</value>
            <value selector="disabled">0</value>
            <value selector="enabled">1</value>
          </Value>
          <Rule id="xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_all_max_addresses" selected="false" role="full" severity="unknown">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Configure Maximum Number of Autoconfigured Addresses on All IPv6 Interfaces</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To set the runtime status of the <html:code xmlns:html="http://www.w3.org/1999/xhtml">net.ipv6.conf.all.max_addresses</html:code> kernel parameter, run the following command: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo sysctl -w net.ipv6.conf.all.max_addresses=1</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/sysctl.d</html:code>: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">net.ipv6.conf.all.max_addresses = 1</html:pre></description>
            <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R22)</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The number of global unicast IPv6 addresses for each interface should be limited exactly to the number of statically configured addresses.</rationale>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_net_ipv6_conf_all_max_addresses" system="urn:xccdf:fix:script:sh" reboot="true" complexity="low" disruption="medium" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then


sysctl_net_ipv6_conf_all_max_addresses_value="<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_max_addresses_value" use="legacy"/>"



#
# Set runtime for net.ipv6.conf.all.max_addresses
#
/sbin/sysctl -q -n -w net.ipv6.conf.all.max_addresses="$sysctl_net_ipv6_conf_all_max_addresses_value"

#
# If net.ipv6.conf.all.max_addresses present in /etc/sysctl.conf, change value to appropriate value
#	else, add "net.ipv6.conf.all.max_addresses = value" to /etc/sysctl.conf
#
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_replace_or_append" use="legacy"/>
replace_or_append '/etc/sysctl.conf' '^net.ipv6.conf.all.max_addresses' "$sysctl_net_ipv6_conf_all_max_addresses_value" ''

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_net_ipv6_conf_all_max_addresses" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="medium" strategy="disable">- name: XCCDF Value sysctl_net_ipv6_conf_all_max_addresses_value # promote to variable
  set_fact:
    sysctl_net_ipv6_conf_all_max_addresses_value: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_max_addresses_value" use="legacy"/>
  tags:
    - always

- name: Ensure sysctl net.ipv6.conf.all.max_addresses is set
  sysctl:
    name: net.ipv6.conf.all.max_addresses
    value: '{{ sysctl_net_ipv6_conf_all_max_addresses_value }}'
    state: present
    reload: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - disable_strategy
    - low_complexity
    - medium_disruption
    - reboot_required
    - sysctl_net_ipv6_conf_all_max_addresses
    - unknown_severity
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-export export-name="oval:ssg-sysctl_net_ipv6_conf_all_max_addresses_value:var:1" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_max_addresses_value"/>
              <check-content-ref name="oval:ssg-sysctl_net_ipv6_conf_all_max_addresses:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-sysctl_net_ipv6_conf_all_max_addresses_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_all_accept_ra_rtr_pref" selected="false" role="full" severity="unknown">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Configure Accepting Router Preference in Router Advertisements on All IPv6 Interfaces</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To set the runtime status of the <html:code xmlns:html="http://www.w3.org/1999/xhtml">net.ipv6.conf.all.accept_ra_rtr_pref</html:code> kernel parameter, run the following command: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo sysctl -w net.ipv6.conf.all.accept_ra_rtr_pref=0</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/sysctl.d</html:code>: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">net.ipv6.conf.all.accept_ra_rtr_pref = 0</html:pre></description>
            <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R22)</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">An illicit router advertisement message could result in a man-in-the-middle attack.</rationale>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_net_ipv6_conf_all_accept_ra_rtr_pref" system="urn:xccdf:fix:script:sh" reboot="true" complexity="low" disruption="medium" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then


sysctl_net_ipv6_conf_all_accept_ra_rtr_pref_value="<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_accept_ra_rtr_pref_value" use="legacy"/>"



#
# Set runtime for net.ipv6.conf.all.accept_ra_rtr_pref
#
/sbin/sysctl -q -n -w net.ipv6.conf.all.accept_ra_rtr_pref="$sysctl_net_ipv6_conf_all_accept_ra_rtr_pref_value"

#
# If net.ipv6.conf.all.accept_ra_rtr_pref present in /etc/sysctl.conf, change value to appropriate value
#	else, add "net.ipv6.conf.all.accept_ra_rtr_pref = value" to /etc/sysctl.conf
#
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_replace_or_append" use="legacy"/>
replace_or_append '/etc/sysctl.conf' '^net.ipv6.conf.all.accept_ra_rtr_pref' "$sysctl_net_ipv6_conf_all_accept_ra_rtr_pref_value" ''

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_net_ipv6_conf_all_accept_ra_rtr_pref" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="medium" strategy="disable">- name: XCCDF Value sysctl_net_ipv6_conf_all_accept_ra_rtr_pref_value # promote to variable
  set_fact:
    sysctl_net_ipv6_conf_all_accept_ra_rtr_pref_value: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_accept_ra_rtr_pref_value" use="legacy"/>
  tags:
    - always

- name: Ensure sysctl net.ipv6.conf.all.accept_ra_rtr_pref is set
  sysctl:
    name: net.ipv6.conf.all.accept_ra_rtr_pref
    value: '{{ sysctl_net_ipv6_conf_all_accept_ra_rtr_pref_value }}'
    state: present
    reload: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - disable_strategy
    - low_complexity
    - medium_disruption
    - reboot_required
    - sysctl_net_ipv6_conf_all_accept_ra_rtr_pref
    - unknown_severity
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-export export-name="oval:ssg-sysctl_net_ipv6_conf_all_accept_ra_rtr_pref_value:var:1" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_accept_ra_rtr_pref_value"/>
              <check-content-ref name="oval:ssg-sysctl_net_ipv6_conf_all_accept_ra_rtr_pref:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-sysctl_net_ipv6_conf_all_accept_ra_rtr_pref_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_default_accept_ra_pinfo" selected="false" role="full" severity="unknown">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Configure Accepting Prefix Information in Router Advertisements on All IPv6 Interfaces By Default</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To set the runtime status of the <html:code xmlns:html="http://www.w3.org/1999/xhtml">net.ipv6.conf.default.accept_ra_pinfo</html:code> kernel parameter, run the following command: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo sysctl -w net.ipv6.conf.default.accept_ra_pinfo=0</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/sysctl.d</html:code>: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">net.ipv6.conf.default.accept_ra_pinfo = 0</html:pre></description>
            <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R22)</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">An illicit router advertisement message could result in a man-in-the-middle attack.</rationale>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_net_ipv6_conf_default_accept_ra_pinfo" system="urn:xccdf:fix:script:sh" reboot="true" complexity="low" disruption="medium" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then


sysctl_net_ipv6_conf_default_accept_ra_pinfo_value="<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_accept_ra_pinfo_value" use="legacy"/>"



#
# Set runtime for net.ipv6.conf.default.accept_ra_pinfo
#
/sbin/sysctl -q -n -w net.ipv6.conf.default.accept_ra_pinfo="$sysctl_net_ipv6_conf_default_accept_ra_pinfo_value"

#
# If net.ipv6.conf.default.accept_ra_pinfo present in /etc/sysctl.conf, change value to appropriate value
#	else, add "net.ipv6.conf.default.accept_ra_pinfo = value" to /etc/sysctl.conf
#
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_replace_or_append" use="legacy"/>
replace_or_append '/etc/sysctl.conf' '^net.ipv6.conf.default.accept_ra_pinfo' "$sysctl_net_ipv6_conf_default_accept_ra_pinfo_value" ''

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_net_ipv6_conf_default_accept_ra_pinfo" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="medium" strategy="disable">- name: XCCDF Value sysctl_net_ipv6_conf_default_accept_ra_pinfo_value # promote to variable
  set_fact:
    sysctl_net_ipv6_conf_default_accept_ra_pinfo_value: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_accept_ra_pinfo_value" use="legacy"/>
  tags:
    - always

- name: Ensure sysctl net.ipv6.conf.default.accept_ra_pinfo is set
  sysctl:
    name: net.ipv6.conf.default.accept_ra_pinfo
    value: '{{ sysctl_net_ipv6_conf_default_accept_ra_pinfo_value }}'
    state: present
    reload: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - disable_strategy
    - low_complexity
    - medium_disruption
    - reboot_required
    - sysctl_net_ipv6_conf_default_accept_ra_pinfo
    - unknown_severity
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-export export-name="oval:ssg-sysctl_net_ipv6_conf_default_accept_ra_pinfo_value:var:1" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_accept_ra_pinfo_value"/>
              <check-content-ref name="oval:ssg-sysctl_net_ipv6_conf_default_accept_ra_pinfo:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-sysctl_net_ipv6_conf_default_accept_ra_pinfo_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_network_ipv6_default_gateway" selected="false" role="full" severity="unknown">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Manually Assign IPv6 Router Address</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Edit the file
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/sysconfig/network-scripts/ifcfg-<html:i>interface</html:i></html:code>, and add or correct
the following line (substituting your gateway IP as appropriate):
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">IPV6_DEFAULTGW=2001:0DB8::0001</html:pre>
Router addresses should be manually set and not accepted via any
auto-configuration or router advertisement.</description>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US"/>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-network_ipv6_default_gateway:def:1" href="ssg-fedora-oval.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_default_accept_ra" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable Accepting Router Advertisements on all IPv6 Interfaces by Default</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To set the runtime status of the <html:code xmlns:html="http://www.w3.org/1999/xhtml">net.ipv6.conf.default.accept_ra</html:code> kernel parameter, run the following command: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo sysctl -w net.ipv6.conf.default.accept_ra=0</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/sysctl.d</html:code>: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">net.ipv6.conf.default.accept_ra = 0</html:pre></description>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.20</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.11</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.12</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.3</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.06</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.5.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.6.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
            <reference href="https://www.cisecurity.org/controls/">11</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">9</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">An illicit router advertisement message could result in a man-in-the-middle attack.</rationale>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_net_ipv6_conf_default_accept_ra" system="urn:xccdf:fix:script:sh" reboot="true" complexity="low" disruption="medium" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then


sysctl_net_ipv6_conf_default_accept_ra_value="<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_accept_ra_value" use="legacy"/>"



#
# Set runtime for net.ipv6.conf.default.accept_ra
#
/sbin/sysctl -q -n -w net.ipv6.conf.default.accept_ra="$sysctl_net_ipv6_conf_default_accept_ra_value"

#
# If net.ipv6.conf.default.accept_ra present in /etc/sysctl.conf, change value to appropriate value
#	else, add "net.ipv6.conf.default.accept_ra = value" to /etc/sysctl.conf
#
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_replace_or_append" use="legacy"/>
replace_or_append '/etc/sysctl.conf' '^net.ipv6.conf.default.accept_ra' "$sysctl_net_ipv6_conf_default_accept_ra_value" ''

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_net_ipv6_conf_default_accept_ra" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="medium" strategy="disable">- name: XCCDF Value sysctl_net_ipv6_conf_default_accept_ra_value # promote to variable
  set_fact:
    sysctl_net_ipv6_conf_default_accept_ra_value: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_accept_ra_value" use="legacy"/>
  tags:
    - always

- name: Ensure sysctl net.ipv6.conf.default.accept_ra is set
  sysctl:
    name: net.ipv6.conf.default.accept_ra
    value: '{{ sysctl_net_ipv6_conf_default_accept_ra_value }}'
    state: present
    reload: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv6_conf_default_accept_ra
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_net_ipv6_conf_default_accept_ra" system="urn:xccdf:fix:script:kubernetes">apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,net.ipv6.conf.default.accept_ra%3D0%0A
        mode: 0644
        path: /etc/sysctl.d/75-sysctl_net_ipv6_conf_default_accept_ra.conf
        overwrite: true
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-export export-name="oval:ssg-sysctl_net_ipv6_conf_default_accept_ra_value:var:1" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_accept_ra_value"/>
              <check-content-ref name="oval:ssg-sysctl_net_ipv6_conf_default_accept_ra:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-sysctl_net_ipv6_conf_default_accept_ra_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_network_ipv6_static_address" selected="false" role="full" severity="unknown">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Manually Assign Global IPv6 Address</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To manually assign an IP address for an interface, edit the
file <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/sysconfig/network-scripts/ifcfg-<html:i>interface</html:i></html:code>. Add or correct the
following line (substituting the correct IPv6 address):
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">IPV6ADDR=2001:0DB8::ABCD/64</html:pre>
Manually assigning an IP address is preferable to accepting one from routers or
from the network otherwise. The example address here is an IPv6 address
reserved for documentation purposes, as defined by RFC3849.</description>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</reference>
            <reference href="">1315</reference>
            <reference href="">1319</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US"/>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-network_ipv6_static_address:def:1" href="ssg-fedora-oval.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_default_router_solicitations" selected="false" role="full" severity="unknown">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Configure Denying Router Solicitations on All IPv6 Interfaces By Default</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To set the runtime status of the <html:code xmlns:html="http://www.w3.org/1999/xhtml">net.ipv6.conf.default.router_solicitations</html:code> kernel parameter, run the following command: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo sysctl -w net.ipv6.conf.default.router_solicitations=0</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/sysctl.d</html:code>: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">net.ipv6.conf.default.router_solicitations = 0</html:pre></description>
            <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R22)</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To prevent discovery of the system by other systems, router solicitation requests should be denied.</rationale>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_net_ipv6_conf_default_router_solicitations" system="urn:xccdf:fix:script:sh" reboot="true" complexity="low" disruption="medium" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then


sysctl_net_ipv6_conf_default_router_solicitations_value="<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_router_solicitations_value" use="legacy"/>"



#
# Set runtime for net.ipv6.conf.default.router_solicitations
#
/sbin/sysctl -q -n -w net.ipv6.conf.default.router_solicitations="$sysctl_net_ipv6_conf_default_router_solicitations_value"

#
# If net.ipv6.conf.default.router_solicitations present in /etc/sysctl.conf, change value to appropriate value
#	else, add "net.ipv6.conf.default.router_solicitations = value" to /etc/sysctl.conf
#
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_replace_or_append" use="legacy"/>
replace_or_append '/etc/sysctl.conf' '^net.ipv6.conf.default.router_solicitations' "$sysctl_net_ipv6_conf_default_router_solicitations_value" ''

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_net_ipv6_conf_default_router_solicitations" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="medium" strategy="disable">- name: XCCDF Value sysctl_net_ipv6_conf_default_router_solicitations_value # promote to variable
  set_fact:
    sysctl_net_ipv6_conf_default_router_solicitations_value: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_router_solicitations_value" use="legacy"/>
  tags:
    - always

- name: Ensure sysctl net.ipv6.conf.default.router_solicitations is set
  sysctl:
    name: net.ipv6.conf.default.router_solicitations
    value: '{{ sysctl_net_ipv6_conf_default_router_solicitations_value }}'
    state: present
    reload: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - disable_strategy
    - low_complexity
    - medium_disruption
    - reboot_required
    - sysctl_net_ipv6_conf_default_router_solicitations
    - unknown_severity
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-export export-name="oval:ssg-sysctl_net_ipv6_conf_default_router_solicitations_value:var:1" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_router_solicitations_value"/>
              <check-content-ref name="oval:ssg-sysctl_net_ipv6_conf_default_router_solicitations:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-sysctl_net_ipv6_conf_default_router_solicitations_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_all_autoconf" selected="false" role="full" severity="unknown">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Configure Auto Configuration on All IPv6 Interfaces</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To set the runtime status of the <html:code xmlns:html="http://www.w3.org/1999/xhtml">net.ipv6.conf.all.autoconf</html:code> kernel parameter, run the following command: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo sysctl -w net.ipv6.conf.all.autoconf=0</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/sysctl.d</html:code>: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">net.ipv6.conf.all.autoconf = 0</html:pre></description>
            <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R22)</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">An illicit router advertisement message could result in a man-in-the-middle attack.</rationale>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_net_ipv6_conf_all_autoconf" system="urn:xccdf:fix:script:sh" reboot="true" complexity="low" disruption="medium" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then


sysctl_net_ipv6_conf_all_autoconf_value="<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_autoconf_value" use="legacy"/>"



#
# Set runtime for net.ipv6.conf.all.autoconf
#
/sbin/sysctl -q -n -w net.ipv6.conf.all.autoconf="$sysctl_net_ipv6_conf_all_autoconf_value"

#
# If net.ipv6.conf.all.autoconf present in /etc/sysctl.conf, change value to appropriate value
#	else, add "net.ipv6.conf.all.autoconf = value" to /etc/sysctl.conf
#
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_replace_or_append" use="legacy"/>
replace_or_append '/etc/sysctl.conf' '^net.ipv6.conf.all.autoconf' "$sysctl_net_ipv6_conf_all_autoconf_value" ''

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_net_ipv6_conf_all_autoconf" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="medium" strategy="disable">- name: XCCDF Value sysctl_net_ipv6_conf_all_autoconf_value # promote to variable
  set_fact:
    sysctl_net_ipv6_conf_all_autoconf_value: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_autoconf_value" use="legacy"/>
  tags:
    - always

- name: Ensure sysctl net.ipv6.conf.all.autoconf is set
  sysctl:
    name: net.ipv6.conf.all.autoconf
    value: '{{ sysctl_net_ipv6_conf_all_autoconf_value }}'
    state: present
    reload: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - disable_strategy
    - low_complexity
    - medium_disruption
    - reboot_required
    - sysctl_net_ipv6_conf_all_autoconf
    - unknown_severity
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-export export-name="oval:ssg-sysctl_net_ipv6_conf_all_autoconf_value:var:1" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_autoconf_value"/>
              <check-content-ref name="oval:ssg-sysctl_net_ipv6_conf_all_autoconf:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-sysctl_net_ipv6_conf_all_autoconf_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_all_router_solicitations" selected="false" role="full" severity="unknown">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Configure Denying Router Solicitations on All IPv6 Interfaces</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To set the runtime status of the <html:code xmlns:html="http://www.w3.org/1999/xhtml">net.ipv6.conf.all.router_solicitations</html:code> kernel parameter, run the following command: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo sysctl -w net.ipv6.conf.all.router_solicitations=0</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/sysctl.d</html:code>: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">net.ipv6.conf.all.router_solicitations = 0</html:pre></description>
            <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R22)</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To prevent discovery of the system by other systems, router solicitation requests should be denied.</rationale>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_net_ipv6_conf_all_router_solicitations" system="urn:xccdf:fix:script:sh" reboot="true" complexity="low" disruption="medium" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then


sysctl_net_ipv6_conf_all_router_solicitations_value="<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_router_solicitations_value" use="legacy"/>"



#
# Set runtime for net.ipv6.conf.all.router_solicitations
#
/sbin/sysctl -q -n -w net.ipv6.conf.all.router_solicitations="$sysctl_net_ipv6_conf_all_router_solicitations_value"

#
# If net.ipv6.conf.all.router_solicitations present in /etc/sysctl.conf, change value to appropriate value
#	else, add "net.ipv6.conf.all.router_solicitations = value" to /etc/sysctl.conf
#
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_replace_or_append" use="legacy"/>
replace_or_append '/etc/sysctl.conf' '^net.ipv6.conf.all.router_solicitations' "$sysctl_net_ipv6_conf_all_router_solicitations_value" ''

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_net_ipv6_conf_all_router_solicitations" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="medium" strategy="disable">- name: XCCDF Value sysctl_net_ipv6_conf_all_router_solicitations_value # promote to variable
  set_fact:
    sysctl_net_ipv6_conf_all_router_solicitations_value: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_router_solicitations_value" use="legacy"/>
  tags:
    - always

- name: Ensure sysctl net.ipv6.conf.all.router_solicitations is set
  sysctl:
    name: net.ipv6.conf.all.router_solicitations
    value: '{{ sysctl_net_ipv6_conf_all_router_solicitations_value }}'
    state: present
    reload: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - disable_strategy
    - low_complexity
    - medium_disruption
    - reboot_required
    - sysctl_net_ipv6_conf_all_router_solicitations
    - unknown_severity
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-export export-name="oval:ssg-sysctl_net_ipv6_conf_all_router_solicitations_value:var:1" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_router_solicitations_value"/>
              <check-content-ref name="oval:ssg-sysctl_net_ipv6_conf_all_router_solicitations:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-sysctl_net_ipv6_conf_all_router_solicitations_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_network_ipv6_privacy_extensions" selected="false" role="full" severity="unknown">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Use Privacy Extensions for Address</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To introduce randomness into the automatic generation of IPv6
addresses, add or correct the following line in
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/sysconfig/network-scripts/ifcfg-<html:i>interface</html:i></html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">IPV6_PRIVACY=rfc3041</html:pre>
Automatically-generated IPv6 addresses are based on the underlying hardware
(e.g. Ethernet) address, and so it becomes possible to track a piece of
hardware over its lifetime using its traffic. If it is important for a system's
IP address to not trivially reveal its hardware address, this setting should be
applied.</description>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.20</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US"/>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-network_ipv6_privacy_extensions:def:1" href="ssg-fedora-oval.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_default_accept_ra_defrtr" selected="false" role="full" severity="unknown">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Configure Accepting Default Router in Router Advertisements on All IPv6 Interfaces By Default</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To set the runtime status of the <html:code xmlns:html="http://www.w3.org/1999/xhtml">net.ipv6.conf.default.accept_ra_defrtr</html:code> kernel parameter, run the following command: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo sysctl -w net.ipv6.conf.default.accept_ra_defrtr=0</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/sysctl.d</html:code>: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">net.ipv6.conf.default.accept_ra_defrtr = 0</html:pre></description>
            <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R22)</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">An illicit router advertisement message could result in a man-in-the-middle attack.</rationale>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_net_ipv6_conf_default_accept_ra_defrtr" system="urn:xccdf:fix:script:sh" reboot="true" complexity="low" disruption="medium" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then


sysctl_net_ipv6_conf_default_accept_ra_defrtr_value="<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_accept_ra_defrtr_value" use="legacy"/>"



#
# Set runtime for net.ipv6.conf.default.accept_ra_defrtr
#
/sbin/sysctl -q -n -w net.ipv6.conf.default.accept_ra_defrtr="$sysctl_net_ipv6_conf_default_accept_ra_defrtr_value"

#
# If net.ipv6.conf.default.accept_ra_defrtr present in /etc/sysctl.conf, change value to appropriate value
#	else, add "net.ipv6.conf.default.accept_ra_defrtr = value" to /etc/sysctl.conf
#
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_replace_or_append" use="legacy"/>
replace_or_append '/etc/sysctl.conf' '^net.ipv6.conf.default.accept_ra_defrtr' "$sysctl_net_ipv6_conf_default_accept_ra_defrtr_value" ''

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_net_ipv6_conf_default_accept_ra_defrtr" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="medium" strategy="disable">- name: XCCDF Value sysctl_net_ipv6_conf_default_accept_ra_defrtr_value # promote to variable
  set_fact:
    sysctl_net_ipv6_conf_default_accept_ra_defrtr_value: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_accept_ra_defrtr_value" use="legacy"/>
  tags:
    - always

- name: Ensure sysctl net.ipv6.conf.default.accept_ra_defrtr is set
  sysctl:
    name: net.ipv6.conf.default.accept_ra_defrtr
    value: '{{ sysctl_net_ipv6_conf_default_accept_ra_defrtr_value }}'
    state: present
    reload: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - disable_strategy
    - low_complexity
    - medium_disruption
    - reboot_required
    - sysctl_net_ipv6_conf_default_accept_ra_defrtr
    - unknown_severity
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-export export-name="oval:ssg-sysctl_net_ipv6_conf_default_accept_ra_defrtr_value:var:1" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_accept_ra_defrtr_value"/>
              <check-content-ref name="oval:ssg-sysctl_net_ipv6_conf_default_accept_ra_defrtr:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-sysctl_net_ipv6_conf_default_accept_ra_defrtr_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_all_accept_ra_defrtr" selected="false" role="full" severity="unknown">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Configure Accepting Default Router in Router Advertisements on All IPv6 Interfaces</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To set the runtime status of the <html:code xmlns:html="http://www.w3.org/1999/xhtml">net.ipv6.conf.all.accept_ra_defrtr</html:code> kernel parameter, run the following command: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo sysctl -w net.ipv6.conf.all.accept_ra_defrtr=0</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/sysctl.d</html:code>: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">net.ipv6.conf.all.accept_ra_defrtr = 0</html:pre></description>
            <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R22)</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">An illicit router advertisement message could result in a man-in-the-middle attack.</rationale>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_net_ipv6_conf_all_accept_ra_defrtr" system="urn:xccdf:fix:script:sh" reboot="true" complexity="low" disruption="medium" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then


sysctl_net_ipv6_conf_all_accept_ra_defrtr_value="<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_accept_ra_defrtr_value" use="legacy"/>"



#
# Set runtime for net.ipv6.conf.all.accept_ra_defrtr
#
/sbin/sysctl -q -n -w net.ipv6.conf.all.accept_ra_defrtr="$sysctl_net_ipv6_conf_all_accept_ra_defrtr_value"

#
# If net.ipv6.conf.all.accept_ra_defrtr present in /etc/sysctl.conf, change value to appropriate value
#	else, add "net.ipv6.conf.all.accept_ra_defrtr = value" to /etc/sysctl.conf
#
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_replace_or_append" use="legacy"/>
replace_or_append '/etc/sysctl.conf' '^net.ipv6.conf.all.accept_ra_defrtr' "$sysctl_net_ipv6_conf_all_accept_ra_defrtr_value" ''

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_net_ipv6_conf_all_accept_ra_defrtr" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="medium" strategy="disable">- name: XCCDF Value sysctl_net_ipv6_conf_all_accept_ra_defrtr_value # promote to variable
  set_fact:
    sysctl_net_ipv6_conf_all_accept_ra_defrtr_value: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_accept_ra_defrtr_value" use="legacy"/>
  tags:
    - always

- name: Ensure sysctl net.ipv6.conf.all.accept_ra_defrtr is set
  sysctl:
    name: net.ipv6.conf.all.accept_ra_defrtr
    value: '{{ sysctl_net_ipv6_conf_all_accept_ra_defrtr_value }}'
    state: present
    reload: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - disable_strategy
    - low_complexity
    - medium_disruption
    - reboot_required
    - sysctl_net_ipv6_conf_all_accept_ra_defrtr
    - unknown_severity
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-export export-name="oval:ssg-sysctl_net_ipv6_conf_all_accept_ra_defrtr_value:var:1" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_accept_ra_defrtr_value"/>
              <check-content-ref name="oval:ssg-sysctl_net_ipv6_conf_all_accept_ra_defrtr:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-sysctl_net_ipv6_conf_all_accept_ra_defrtr_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_default_autoconf" selected="false" role="full" severity="unknown">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Configure Auto Configuration on All IPv6 Interfaces By Default</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To set the runtime status of the <html:code xmlns:html="http://www.w3.org/1999/xhtml">net.ipv6.conf.default.autoconf</html:code> kernel parameter, run the following command: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo sysctl -w net.ipv6.conf.default.autoconf=0</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/sysctl.d</html:code>: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">net.ipv6.conf.default.autoconf = 0</html:pre></description>
            <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R22)</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">An illicit router advertisement message could result in a man-in-the-middle attack.</rationale>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_net_ipv6_conf_default_autoconf" system="urn:xccdf:fix:script:sh" reboot="true" complexity="low" disruption="medium" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then


sysctl_net_ipv6_conf_default_autoconf_value="<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_autoconf_value" use="legacy"/>"



#
# Set runtime for net.ipv6.conf.default.autoconf
#
/sbin/sysctl -q -n -w net.ipv6.conf.default.autoconf="$sysctl_net_ipv6_conf_default_autoconf_value"

#
# If net.ipv6.conf.default.autoconf present in /etc/sysctl.conf, change value to appropriate value
#	else, add "net.ipv6.conf.default.autoconf = value" to /etc/sysctl.conf
#
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_replace_or_append" use="legacy"/>
replace_or_append '/etc/sysctl.conf' '^net.ipv6.conf.default.autoconf' "$sysctl_net_ipv6_conf_default_autoconf_value" ''

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_net_ipv6_conf_default_autoconf" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="medium" strategy="disable">- name: XCCDF Value sysctl_net_ipv6_conf_default_autoconf_value # promote to variable
  set_fact:
    sysctl_net_ipv6_conf_default_autoconf_value: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_autoconf_value" use="legacy"/>
  tags:
    - always

- name: Ensure sysctl net.ipv6.conf.default.autoconf is set
  sysctl:
    name: net.ipv6.conf.default.autoconf
    value: '{{ sysctl_net_ipv6_conf_default_autoconf_value }}'
    state: present
    reload: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - disable_strategy
    - low_complexity
    - medium_disruption
    - reboot_required
    - sysctl_net_ipv6_conf_default_autoconf
    - unknown_severity
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-export export-name="oval:ssg-sysctl_net_ipv6_conf_default_autoconf_value:var:1" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_autoconf_value"/>
              <check-content-ref name="oval:ssg-sysctl_net_ipv6_conf_default_autoconf:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-sysctl_net_ipv6_conf_default_autoconf_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_default_accept_ra_rtr_pref" selected="false" role="full" severity="unknown">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Configure Accepting Router Preference in Router Advertisements on All IPv6 Interfaces By Default</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To set the runtime status of the <html:code xmlns:html="http://www.w3.org/1999/xhtml">net.ipv6.conf.default.accept_ra_rtr_pref</html:code> kernel parameter, run the following command: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo sysctl -w net.ipv6.conf.default.accept_ra_rtr_pref=0</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/sysctl.d</html:code>: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">net.ipv6.conf.default.accept_ra_rtr_pref = 0</html:pre></description>
            <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R22)</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">An illicit router advertisement message could result in a man-in-the-middle attack.</rationale>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_net_ipv6_conf_default_accept_ra_rtr_pref" system="urn:xccdf:fix:script:sh" reboot="true" complexity="low" disruption="medium" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then


sysctl_net_ipv6_conf_default_accept_ra_rtr_pref_value="<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_accept_ra_rtr_pref_value" use="legacy"/>"



#
# Set runtime for net.ipv6.conf.default.accept_ra_rtr_pref
#
/sbin/sysctl -q -n -w net.ipv6.conf.default.accept_ra_rtr_pref="$sysctl_net_ipv6_conf_default_accept_ra_rtr_pref_value"

#
# If net.ipv6.conf.default.accept_ra_rtr_pref present in /etc/sysctl.conf, change value to appropriate value
#	else, add "net.ipv6.conf.default.accept_ra_rtr_pref = value" to /etc/sysctl.conf
#
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_replace_or_append" use="legacy"/>
replace_or_append '/etc/sysctl.conf' '^net.ipv6.conf.default.accept_ra_rtr_pref' "$sysctl_net_ipv6_conf_default_accept_ra_rtr_pref_value" ''

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_net_ipv6_conf_default_accept_ra_rtr_pref" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="medium" strategy="disable">- name: XCCDF Value sysctl_net_ipv6_conf_default_accept_ra_rtr_pref_value # promote to variable
  set_fact:
    sysctl_net_ipv6_conf_default_accept_ra_rtr_pref_value: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_accept_ra_rtr_pref_value" use="legacy"/>
  tags:
    - always

- name: Ensure sysctl net.ipv6.conf.default.accept_ra_rtr_pref is set
  sysctl:
    name: net.ipv6.conf.default.accept_ra_rtr_pref
    value: '{{ sysctl_net_ipv6_conf_default_accept_ra_rtr_pref_value }}'
    state: present
    reload: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - disable_strategy
    - low_complexity
    - medium_disruption
    - reboot_required
    - sysctl_net_ipv6_conf_default_accept_ra_rtr_pref
    - unknown_severity
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-export export-name="oval:ssg-sysctl_net_ipv6_conf_default_accept_ra_rtr_pref_value:var:1" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_accept_ra_rtr_pref_value"/>
              <check-content-ref name="oval:ssg-sysctl_net_ipv6_conf_default_accept_ra_rtr_pref:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-sysctl_net_ipv6_conf_default_accept_ra_rtr_pref_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_all_accept_ra_pinfo" selected="false" role="full" severity="unknown">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Configure Accepting Prefix Information in Router Advertisements on All IPv6 Interfaces</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To set the runtime status of the <html:code xmlns:html="http://www.w3.org/1999/xhtml">net.ipv6.conf.all.accept_ra_pinfo</html:code> kernel parameter, run the following command: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo sysctl -w net.ipv6.conf.all.accept_ra_pinfo=0</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/sysctl.d</html:code>: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">net.ipv6.conf.all.accept_ra_pinfo = 0</html:pre></description>
            <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R22)</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">An illicit router advertisement message could result in a man-in-the-middle attack.</rationale>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_net_ipv6_conf_all_accept_ra_pinfo" system="urn:xccdf:fix:script:sh" reboot="true" complexity="low" disruption="medium" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then


sysctl_net_ipv6_conf_all_accept_ra_pinfo_value="<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_accept_ra_pinfo_value" use="legacy"/>"



#
# Set runtime for net.ipv6.conf.all.accept_ra_pinfo
#
/sbin/sysctl -q -n -w net.ipv6.conf.all.accept_ra_pinfo="$sysctl_net_ipv6_conf_all_accept_ra_pinfo_value"

#
# If net.ipv6.conf.all.accept_ra_pinfo present in /etc/sysctl.conf, change value to appropriate value
#	else, add "net.ipv6.conf.all.accept_ra_pinfo = value" to /etc/sysctl.conf
#
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_replace_or_append" use="legacy"/>
replace_or_append '/etc/sysctl.conf' '^net.ipv6.conf.all.accept_ra_pinfo' "$sysctl_net_ipv6_conf_all_accept_ra_pinfo_value" ''

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_net_ipv6_conf_all_accept_ra_pinfo" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="medium" strategy="disable">- name: XCCDF Value sysctl_net_ipv6_conf_all_accept_ra_pinfo_value # promote to variable
  set_fact:
    sysctl_net_ipv6_conf_all_accept_ra_pinfo_value: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_accept_ra_pinfo_value" use="legacy"/>
  tags:
    - always

- name: Ensure sysctl net.ipv6.conf.all.accept_ra_pinfo is set
  sysctl:
    name: net.ipv6.conf.all.accept_ra_pinfo
    value: '{{ sysctl_net_ipv6_conf_all_accept_ra_pinfo_value }}'
    state: present
    reload: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - disable_strategy
    - low_complexity
    - medium_disruption
    - reboot_required
    - sysctl_net_ipv6_conf_all_accept_ra_pinfo
    - unknown_severity
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-export export-name="oval:ssg-sysctl_net_ipv6_conf_all_accept_ra_pinfo_value:var:1" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_accept_ra_pinfo_value"/>
              <check-content-ref name="oval:ssg-sysctl_net_ipv6_conf_all_accept_ra_pinfo:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-sysctl_net_ipv6_conf_all_accept_ra_pinfo_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_default_max_addresses" selected="false" role="full" severity="unknown">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Configure Maximum Number of Autoconfigured Addresses on All IPv6 Interfaces By Default</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To set the runtime status of the <html:code xmlns:html="http://www.w3.org/1999/xhtml">net.ipv6.conf.default.max_addresses</html:code> kernel parameter, run the following command: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo sysctl -w net.ipv6.conf.default.max_addresses=1</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/sysctl.d</html:code>: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">net.ipv6.conf.default.max_addresses = 1</html:pre></description>
            <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R22)</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The number of global unicast IPv6 addresses for each interface should be limited exactly to the number of statically configured addresses.</rationale>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_net_ipv6_conf_default_max_addresses" system="urn:xccdf:fix:script:sh" reboot="true" complexity="low" disruption="medium" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then


sysctl_net_ipv6_conf_default_max_addresses_value="<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_max_addresses_value" use="legacy"/>"



#
# Set runtime for net.ipv6.conf.default.max_addresses
#
/sbin/sysctl -q -n -w net.ipv6.conf.default.max_addresses="$sysctl_net_ipv6_conf_default_max_addresses_value"

#
# If net.ipv6.conf.default.max_addresses present in /etc/sysctl.conf, change value to appropriate value
#	else, add "net.ipv6.conf.default.max_addresses = value" to /etc/sysctl.conf
#
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_replace_or_append" use="legacy"/>
replace_or_append '/etc/sysctl.conf' '^net.ipv6.conf.default.max_addresses' "$sysctl_net_ipv6_conf_default_max_addresses_value" ''

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_net_ipv6_conf_default_max_addresses" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="medium" strategy="disable">- name: XCCDF Value sysctl_net_ipv6_conf_default_max_addresses_value # promote to variable
  set_fact:
    sysctl_net_ipv6_conf_default_max_addresses_value: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_max_addresses_value" use="legacy"/>
  tags:
    - always

- name: Ensure sysctl net.ipv6.conf.default.max_addresses is set
  sysctl:
    name: net.ipv6.conf.default.max_addresses
    value: '{{ sysctl_net_ipv6_conf_default_max_addresses_value }}'
    state: present
    reload: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - disable_strategy
    - low_complexity
    - medium_disruption
    - reboot_required
    - sysctl_net_ipv6_conf_default_max_addresses
    - unknown_severity
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-export export-name="oval:ssg-sysctl_net_ipv6_conf_default_max_addresses_value:var:1" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_max_addresses_value"/>
              <check-content-ref name="oval:ssg-sysctl_net_ipv6_conf_default_max_addresses:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-sysctl_net_ipv6_conf_default_max_addresses_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_default_accept_redirects" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To set the runtime status of the <html:code xmlns:html="http://www.w3.org/1999/xhtml">net.ipv6.conf.default.accept_redirects</html:code> kernel parameter, run the following command: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo sysctl -w net.ipv6.conf.default.accept_redirects=0</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/sysctl.d</html:code>: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">net.ipv6.conf.default.accept_redirects = 0</html:pre></description>
            <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R22)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.20</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</reference>
            <reference href="https://public.cyber.mil/stigs/cci/">CCI-001551</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.11</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.12</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.3</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.06</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.5.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.6.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
            <reference href="https://www.cisecurity.org/controls/">11</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">9</reference>
            <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">An illicit ICMP redirect message could result in a man-in-the-middle attack.</rationale>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_net_ipv6_conf_default_accept_redirects" system="urn:xccdf:fix:script:sh" reboot="true" complexity="low" disruption="medium" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then


sysctl_net_ipv6_conf_default_accept_redirects_value="<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_accept_redirects_value" use="legacy"/>"



#
# Set runtime for net.ipv6.conf.default.accept_redirects
#
/sbin/sysctl -q -n -w net.ipv6.conf.default.accept_redirects="$sysctl_net_ipv6_conf_default_accept_redirects_value"

#
# If net.ipv6.conf.default.accept_redirects present in /etc/sysctl.conf, change value to appropriate value
#	else, add "net.ipv6.conf.default.accept_redirects = value" to /etc/sysctl.conf
#
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_replace_or_append" use="legacy"/>
replace_or_append '/etc/sysctl.conf' '^net.ipv6.conf.default.accept_redirects' "$sysctl_net_ipv6_conf_default_accept_redirects_value" ''

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_net_ipv6_conf_default_accept_redirects" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="medium" strategy="disable">- name: XCCDF Value sysctl_net_ipv6_conf_default_accept_redirects_value # promote to variable
  set_fact:
    sysctl_net_ipv6_conf_default_accept_redirects_value: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_accept_redirects_value" use="legacy"/>
  tags:
    - always

- name: Ensure sysctl net.ipv6.conf.default.accept_redirects is set
  sysctl:
    name: net.ipv6.conf.default.accept_redirects
    value: '{{ sysctl_net_ipv6_conf_default_accept_redirects_value }}'
    state: present
    reload: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv6_conf_default_accept_redirects
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_net_ipv6_conf_default_accept_redirects" system="urn:xccdf:fix:script:kubernetes">apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,net.ipv6.conf.default.accept_redirects%20%3D%200%0A
        mode: 0644
        path: /etc/sysctl.d/75-sysctl_net_ipv6_conf_default_accept_redirects.conf
        overwrite: true
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-export export-name="oval:ssg-sysctl_net_ipv6_conf_default_accept_redirects_value:var:1" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_accept_redirects_value"/>
              <check-content-ref name="oval:ssg-sysctl_net_ipv6_conf_default_accept_redirects:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-sysctl_net_ipv6_conf_default_accept_redirects_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Group id="xccdf_org.ssgproject.content_group_network_ipv6_limit_requests">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Limit Network-Transmitted Configuration if Using Static IPv6 Addresses</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To limit the configuration information requested from other
systems and accepted from the network on a system that uses
statically-configured IPv6 addresses, add the following lines to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/sysctl.conf</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">net.ipv6.conf.default.router_solicitations = 0
net.ipv6.conf.default.accept_ra_rtr_pref = 0
net.ipv6.conf.default.accept_ra_pinfo = 0
net.ipv6.conf.default.accept_ra_defrtr = 0
net.ipv6.conf.default.autoconf = 0
net.ipv6.conf.default.dad_transmits = 0
net.ipv6.conf.default.max_addresses = 1</html:pre>
The <html:code xmlns:html="http://www.w3.org/1999/xhtml">router_solicitations</html:code> setting determines how many router
solicitations are sent when bringing up the interface. If addresses are
statically assigned, there is no need to send any solicitations.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
The <html:code xmlns:html="http://www.w3.org/1999/xhtml">accept_ra_pinfo</html:code> setting controls whether the system will accept
prefix info from the router.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
The <html:code xmlns:html="http://www.w3.org/1999/xhtml">accept_ra_defrtr</html:code> setting controls whether the system will accept
Hop Limit settings from a router advertisement. Setting it to 0 prevents a
router from changing your default IPv6 Hop Limit for outgoing packets.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
The <html:code xmlns:html="http://www.w3.org/1999/xhtml">autoconf</html:code> setting controls whether router advertisements can cause
the system to assign a global unicast address to an interface.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
The <html:code xmlns:html="http://www.w3.org/1999/xhtml">dad_transmits</html:code> setting determines how many neighbor solicitations
to send out per address (global and link-local) when bringing up an interface
to ensure the desired address is unique on the network.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
The <html:code xmlns:html="http://www.w3.org/1999/xhtml">max_addresses</html:code> setting determines how many global unicast IPv6
addresses can be assigned to each interface.  The default is 16, but it should
be set to exactly the number of statically configured global addresses
required.</description>
          </Group>
        </Group>
      </Group>
    </Group>
    <Group id="xccdf_org.ssgproject.content_group_selinux">
      <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">SELinux</title>
      <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">SELinux is a feature of the Linux kernel which can be
used to guard against misconfigured or compromised programs.
SELinux enforces the idea that programs should be limited in what
files they can access and what actions they can take.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
The default SELinux policy, as configured on Fedora, has been
sufficiently developed and debugged that it should be usable on
almost any system with minimal configuration and a small
amount of system administrator training. This policy prevents
system services - including most of the common network-visible
services such as mail servers, FTP servers, and DNS servers - from
accessing files which those services have no valid reason to
access. This action alone prevents a huge amount of possible damage
from network attacks against services, from trojaned software, and
so forth.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
This guide recommends that SELinux be enabled using the
default (targeted) policy on every Fedora system, unless that
system has unusual requirements which make a stronger policy
appropriate.</description>
      <platform idref="cpe:/a:machine"/>
      <Value id="xccdf_org.ssgproject.content_value_var_selinux_policy_name" type="string">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">SELinux policy</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Type of policy in use. Possible values are:
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>targeted - Only targeted network daemons are protected.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>strict - Full SELinux protection.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>mls - Multiple levels of security</description>
        <value>targeted</value>
        <value selector="mls">mls</value>
        <value selector="targeted">targeted</value>
      </Value>
      <Value id="xccdf_org.ssgproject.content_value_var_selinux_state" type="string">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">SELinux state</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">enforcing - SELinux security policy is enforced.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>permissive - SELinux prints warnings instead of enforcing.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>disabled - SELinux is fully disabled.</description>
        <value>enforcing</value>
        <value selector="disabled">disabled</value>
        <value selector="enforcing">enforcing</value>
        <value selector="permissive">permissive</value>
      </Value>
      <Rule id="xccdf_org.ssgproject.content_rule_package_libselinux_installed" selected="false" role="full" severity="high">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Install libselinux Package</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">libselinux</html:code> package can be installed with the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">
$ sudo dnf install libselinux</html:pre></description>
        <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Security-enhanced Linux is a feature of the Linux kernel and a number of utilities
with enhanced security functionality designed to add mandatory access controls to Linux.

The <html:code xmlns:html="http://www.w3.org/1999/xhtml">libselinux</html:code> package contains the core library of the Security-enhanced Linux system.</rationale>
        <platform idref="cpe:/a:machine"/>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_libselinux_installed" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="enable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

if ! rpm -q --quiet "libselinux" ; then
    dnf install -y "libselinux"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_libselinux_installed" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="enable">- name: Ensure libselinux is installed
  package:
    name: libselinux
    state: present
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - enable_strategy
    - high_severity
    - low_complexity
    - low_disruption
    - no_reboot_needed
    - package_libselinux_installed
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_libselinux_installed" system="urn:xccdf:fix:script:puppet" complexity="low" disruption="low" strategy="enable">include install_libselinux

class install_libselinux {
  package { 'libselinux':
    ensure =&gt; 'installed',
  }
}
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_libselinux_installed" system="urn:redhat:anaconda:pre" complexity="low" disruption="low" strategy="enable">
package --add=libselinux
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_libselinux_installed" system="urn:redhat:osbuild:blueprint">
[[packages]]
name = "libselinux"
version = "*"
</fix>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref name="oval:ssg-package_libselinux_installed:def:1" href="ssg-fedora-oval.xml"/>
        </check>
        <check system="http://scap.nist.gov/schema/ocil/2">
          <check-content-ref name="ocil:ssg-package_libselinux_installed_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
        </check>
      </Rule>
      <Rule id="xccdf_org.ssgproject.content_rule_package_policycoreutils_installed" selected="false" role="full" severity="high">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Install policycoreutils Package</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">policycoreutils</html:code> package can be installed with the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">
$ sudo dnf install policycoreutils</html:pre></description>
        <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
        <reference href="https://public.cyber.mil/stigs/cci/">CCI-001084</reference>
        <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Security-enhanced Linux is a feature of the Linux kernel and a number of utilities
with enhanced security functionality designed to add mandatory access controls to Linux.
The Security-enhanced Linux kernel contains new architectural components originally
developed to improve security of the Flask operating system. These architectural components
provide general support for the enforcement of many kinds of mandatory access control
policies, including those based on the concepts of Type Enforcement, Role-based Access
Control, and Multi-level Security.

<html:code xmlns:html="http://www.w3.org/1999/xhtml">policycoreutils</html:code> contains the policy core utilities that are required for
basic operation of an SELinux-enabled system. These utilities include <html:code xmlns:html="http://www.w3.org/1999/xhtml">load_policy</html:code>
to load SELinux policies, <html:code xmlns:html="http://www.w3.org/1999/xhtml">setfiles</html:code> to label filesystems, <html:code xmlns:html="http://www.w3.org/1999/xhtml">newrole</html:code> to
switch roles, and so on.</rationale>
        <platform idref="cpe:/a:machine"/>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_policycoreutils_installed" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="enable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

if ! rpm -q --quiet "policycoreutils" ; then
    dnf install -y "policycoreutils"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_policycoreutils_installed" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="enable">- name: Ensure policycoreutils is installed
  package:
    name: policycoreutils
    state: present
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - enable_strategy
    - high_severity
    - low_complexity
    - low_disruption
    - no_reboot_needed
    - package_policycoreutils_installed
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_policycoreutils_installed" system="urn:xccdf:fix:script:puppet" complexity="low" disruption="low" strategy="enable">include install_policycoreutils

class install_policycoreutils {
  package { 'policycoreutils':
    ensure =&gt; 'installed',
  }
}
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_policycoreutils_installed" system="urn:redhat:anaconda:pre" complexity="low" disruption="low" strategy="enable">
package --add=policycoreutils
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_policycoreutils_installed" system="urn:redhat:osbuild:blueprint">
[[packages]]
name = "policycoreutils"
version = "*"
</fix>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref name="oval:ssg-package_policycoreutils_installed:def:1" href="ssg-fedora-oval.xml"/>
        </check>
        <check system="http://scap.nist.gov/schema/ocil/2">
          <check-content-ref name="ocil:ssg-package_policycoreutils_installed_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
        </check>
      </Rule>
      <Rule id="xccdf_org.ssgproject.content_rule_package_mcstrans_removed" selected="false" role="full" severity="low">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Uninstall mcstrans Package</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">mcstransd</html:code> daemon provides category label information
to client processes requesting information. The label translations are defined
in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/selinux/targeted/setrans.conf</html:code>.
The <html:code xmlns:html="http://www.w3.org/1999/xhtml">mcstrans</html:code> package can be removed with the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">
$ sudo dnf erase mcstrans</html:pre></description>
        <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Since this service is not used very often, disable it to reduce the
amount of potentially vulnerable code running on the system.</rationale>
        <platform idref="cpe:/a:machine"/>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_mcstrans_removed" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

# CAUTION: This remediation script will remove mcstrans
#	   from the system, and may remove any packages
#	   that depend on mcstrans. Execute this
#	   remediation AFTER testing on a non-production
#	   system!

if rpm -q --quiet "mcstrans" ; then
    dnf remove -y "mcstrans"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_mcstrans_removed" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="disable">- name: Ensure mcstrans is removed
  package:
    name: mcstrans
    state: absent
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - disable_strategy
    - low_complexity
    - low_disruption
    - low_severity
    - no_reboot_needed
    - package_mcstrans_removed
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_mcstrans_removed" system="urn:xccdf:fix:script:puppet" complexity="low" disruption="low" strategy="disable">include remove_mcstrans

class remove_mcstrans {
  package { 'mcstrans':
    ensure =&gt; 'purged',
  }
}
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_mcstrans_removed" system="urn:redhat:anaconda:pre" complexity="low" disruption="low" strategy="disable">
package --remove=mcstrans
</fix>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref name="oval:ssg-package_mcstrans_removed:def:1" href="ssg-fedora-oval.xml"/>
        </check>
      </Rule>
      <Rule id="xccdf_org.ssgproject.content_rule_package_setroubleshoot-plugins_removed" selected="false" role="full" severity="low">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Uninstall setroubleshoot-plugins Package</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The SETroubleshoot plugins are used to analyze SELinux AVC data. The service provides information around configuration errors,
unauthorized intrusions, and other potential errors.
The <html:code xmlns:html="http://www.w3.org/1999/xhtml">setroubleshoot-plugins</html:code> package can be removed with the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">
$ sudo dnf erase setroubleshoot-plugins</html:pre></description>
        <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R68)</reference>
        <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The SETroubleshoot service is an unnecessary daemon to
have running on a server.</rationale>
        <platform idref="cpe:/a:machine"/>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_setroubleshoot-plugins_removed" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

# CAUTION: This remediation script will remove setroubleshoot-plugins
#	   from the system, and may remove any packages
#	   that depend on setroubleshoot-plugins. Execute this
#	   remediation AFTER testing on a non-production
#	   system!

if rpm -q --quiet "setroubleshoot-plugins" ; then
    dnf remove -y "setroubleshoot-plugins"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_setroubleshoot-plugins_removed" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="disable">- name: Ensure setroubleshoot-plugins is removed
  package:
    name: setroubleshoot-plugins
    state: absent
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - disable_strategy
    - low_complexity
    - low_disruption
    - low_severity
    - no_reboot_needed
    - package_setroubleshoot-plugins_removed
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_setroubleshoot-plugins_removed" system="urn:xccdf:fix:script:puppet" complexity="low" disruption="low" strategy="disable">include remove_setroubleshoot-plugins

class remove_setroubleshoot-plugins {
  package { 'setroubleshoot-plugins':
    ensure =&gt; 'purged',
  }
}
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_setroubleshoot-plugins_removed" system="urn:redhat:anaconda:pre" complexity="low" disruption="low" strategy="disable">
package --remove=setroubleshoot-plugins
</fix>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref name="oval:ssg-package_setroubleshoot-plugins_removed:def:1" href="ssg-fedora-oval.xml"/>
        </check>
        <check system="http://scap.nist.gov/schema/ocil/2">
          <check-content-ref name="ocil:ssg-package_setroubleshoot-plugins_removed_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
        </check>
      </Rule>
      <Rule id="xccdf_org.ssgproject.content_rule_package_setroubleshoot-server_removed" selected="false" role="full" severity="low">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Uninstall setroubleshoot-server Package</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The SETroubleshoot service notifies desktop users of SELinux
denials. The service provides information around configuration errors,
unauthorized intrusions, and other potential errors.
The <html:code xmlns:html="http://www.w3.org/1999/xhtml">setroubleshoot-server</html:code> package can be removed with the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">
$ sudo dnf erase setroubleshoot-server</html:pre></description>
        <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R68)</reference>
        <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The SETroubleshoot service is an unnecessary daemon to have
running on a server.</rationale>
        <platform idref="cpe:/a:machine"/>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_setroubleshoot-server_removed" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

# CAUTION: This remediation script will remove setroubleshoot-server
#	   from the system, and may remove any packages
#	   that depend on setroubleshoot-server. Execute this
#	   remediation AFTER testing on a non-production
#	   system!

if rpm -q --quiet "setroubleshoot-server" ; then
    dnf remove -y "setroubleshoot-server"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_setroubleshoot-server_removed" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="disable">- name: Ensure setroubleshoot-server is removed
  package:
    name: setroubleshoot-server
    state: absent
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - disable_strategy
    - low_complexity
    - low_disruption
    - low_severity
    - no_reboot_needed
    - package_setroubleshoot-server_removed
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_setroubleshoot-server_removed" system="urn:xccdf:fix:script:puppet" complexity="low" disruption="low" strategy="disable">include remove_setroubleshoot-server

class remove_setroubleshoot-server {
  package { 'setroubleshoot-server':
    ensure =&gt; 'purged',
  }
}
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_setroubleshoot-server_removed" system="urn:redhat:anaconda:pre" complexity="low" disruption="low" strategy="disable">
package --remove=setroubleshoot-server
</fix>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref name="oval:ssg-package_setroubleshoot-server_removed:def:1" href="ssg-fedora-oval.xml"/>
        </check>
        <check system="http://scap.nist.gov/schema/ocil/2">
          <check-content-ref name="ocil:ssg-package_setroubleshoot-server_removed_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
        </check>
      </Rule>
      <Rule id="xccdf_org.ssgproject.content_rule_package_setroubleshoot_removed" selected="false" role="full" severity="low">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Uninstall setroubleshoot Package</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The SETroubleshoot service notifies desktop users of SELinux
denials. The service provides information around configuration errors,
unauthorized intrusions, and other potential errors.
The <html:code xmlns:html="http://www.w3.org/1999/xhtml">setroubleshoot</html:code> package can be removed with the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">
$ sudo dnf erase setroubleshoot</html:pre></description>
        <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R68)</reference>
        <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The SETroubleshoot service is an unnecessary daemon to
have running on a server, especially if
X Windows is removed or disabled.</rationale>
        <platform idref="cpe:/a:machine"/>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_setroubleshoot_removed" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

# CAUTION: This remediation script will remove setroubleshoot
#	   from the system, and may remove any packages
#	   that depend on setroubleshoot. Execute this
#	   remediation AFTER testing on a non-production
#	   system!

if rpm -q --quiet "setroubleshoot" ; then
    dnf remove -y "setroubleshoot"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_setroubleshoot_removed" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="disable">- name: Ensure setroubleshoot is removed
  package:
    name: setroubleshoot
    state: absent
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - disable_strategy
    - low_complexity
    - low_disruption
    - low_severity
    - no_reboot_needed
    - package_setroubleshoot_removed
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_setroubleshoot_removed" system="urn:xccdf:fix:script:puppet" complexity="low" disruption="low" strategy="disable">include remove_setroubleshoot

class remove_setroubleshoot {
  package { 'setroubleshoot':
    ensure =&gt; 'purged',
  }
}
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_setroubleshoot_removed" system="urn:redhat:anaconda:pre" complexity="low" disruption="low" strategy="disable">
package --remove=setroubleshoot
</fix>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref name="oval:ssg-package_setroubleshoot_removed:def:1" href="ssg-fedora-oval.xml"/>
        </check>
      </Rule>
      <Rule id="xccdf_org.ssgproject.content_rule_grub2_enable_selinux" selected="false" role="full" severity="medium">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure SELinux Not Disabled in /etc/default/grub</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">SELinux can be disabled at boot time by an argument in
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/default/grub</html:code>.
Remove any instances of <html:code xmlns:html="http://www.w3.org/1999/xhtml">selinux=0</html:code> from the kernel arguments in that
file to prevent SELinux from being disabled at boot.</description>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.2</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.7.2</reference>
        <reference href="https://public.cyber.mil/stigs/cci/">CCI-000022</reference>
        <reference href="https://public.cyber.mil/stigs/cci/">CCI-000032</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(4)</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(c)</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-3</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-3(3)(a)</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-1</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.AM-3</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-5</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
        <reference href="">SRG-OS-000445-VMM-001780</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.11</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.12</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.6</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.2</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.3</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.4</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.5</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.7</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.5</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.3</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.3</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.4</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.2.2</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.4</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.3</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.4</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.5</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.6</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.7</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.3.3</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
        <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS01.05</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS06.03</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS06.06</reference>
        <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.10.1.1</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.11.1.4</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.11.1.5</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.11.2.1</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.12.1.1</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.12.1.2</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.12.4.1</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.12.4.2</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.12.4.3</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.12.4.4</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.12.7.1</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.13.1.2</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.13.1.3</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.13.2.2</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.13.2.3</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.13.2.4</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.14.1.2</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.6.1.2</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.7.1.1</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.7.1.2</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.7.3.1</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.8.2.2</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.8.2.3</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.9.1.1</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.9.2.1</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.9.2.3</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.9.4.1</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.9.4.4</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.9.4.5</reference>
        <reference href="https://www.cisecurity.org/controls/">1</reference>
        <reference href="https://www.cisecurity.org/controls/">11</reference>
        <reference href="https://www.cisecurity.org/controls/">12</reference>
        <reference href="https://www.cisecurity.org/controls/">13</reference>
        <reference href="https://www.cisecurity.org/controls/">14</reference>
        <reference href="https://www.cisecurity.org/controls/">15</reference>
        <reference href="https://www.cisecurity.org/controls/">16</reference>
        <reference href="https://www.cisecurity.org/controls/">18</reference>
        <reference href="https://www.cisecurity.org/controls/">3</reference>
        <reference href="https://www.cisecurity.org/controls/">4</reference>
        <reference href="https://www.cisecurity.org/controls/">5</reference>
        <reference href="https://www.cisecurity.org/controls/">6</reference>
        <reference href="https://www.cisecurity.org/controls/">8</reference>
        <reference href="https://www.cisecurity.org/controls/">9</reference>
        <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disabling a major host protection feature, such as SELinux, at boot time prevents
it from confining system services at boot time.  Further, it increases
the chances that it will remain off during system operation.</rationale>
        <platform idref="cpe:/a:machine"/>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="grub2_enable_selinux" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

sed -i --follow-symlinks "s/selinux=0//gI" /etc/default/grub /etc/grub2.cfg /etc/grub.d/*
sed -i --follow-symlinks "s/enforcing=0//gI" /etc/default/grub /etc/grub2.cfg /etc/grub.d/*

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="grub2_enable_selinux" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Find /etc/grub.d/ files
  find:
    paths:
      - /etc/grub.d/
    follow: true
  register: grub
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.2
    - NIST-800-171-3.7.2
    - NIST-800-53-AC-3
    - NIST-800-53-AC-3(3)(a)
    - grub2_enable_selinux
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Ensure SELinux Not Disabled in grub files
  replace:
    dest: '{{ item.path }}'
    regexp: (selinux|enforcing)=0
  with_items:
    - '{{ grub.files }}'
    - path: /etc/grub2.cfg
    - path: /etc/default/grub
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.2
    - NIST-800-171-3.7.2
    - NIST-800-53-AC-3
    - NIST-800-53-AC-3(3)(a)
    - grub2_enable_selinux
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</fix>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref name="oval:ssg-grub2_enable_selinux:def:1" href="ssg-fedora-oval.xml"/>
        </check>
        <check system="http://scap.nist.gov/schema/ocil/2">
          <check-content-ref name="ocil:ssg-grub2_enable_selinux_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
        </check>
      </Rule>
      <Rule id="xccdf_org.ssgproject.content_rule_selinux_state" selected="false" role="full" severity="medium">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure SELinux State is Enforcing</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The SELinux state should be set to <html:code xmlns:html="http://www.w3.org/1999/xhtml" xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2"><xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_selinux_state" use="legacy"/></html:code> at
system boot time.  In the file <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/selinux/config</html:code>, add or correct the
following line to configure the system to boot into enforcing mode:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml" xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2">SELINUX=<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_selinux_state" use="legacy"/></html:pre></description>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.2</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.7.2</reference>
        <reference href="https://public.cyber.mil/stigs/cci/">CCI-002165</reference>
        <reference href="https://public.cyber.mil/stigs/cci/">CCI-002696</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(4)</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(c)</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-3</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-3(3)(a)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-9</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-7(21)</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-1</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.AM-3</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-5</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
        <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000445-GPOS-00199</reference>
        <reference href="">SRG-OS-000445-VMM-001780</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.11</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.12</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.6</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.2</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.3</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.4</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.5</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.7</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.5</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.3</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.3</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.4</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.2.2</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.4</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.3</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.4</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.5</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.6</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.7</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.3.3</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
        <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS01.05</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS06.03</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS06.06</reference>
        <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.10.1.1</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.11.1.4</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.11.1.5</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.11.2.1</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.12.1.1</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.12.1.2</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.12.4.1</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.12.4.2</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.12.4.3</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.12.4.4</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.12.7.1</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.13.1.2</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.13.1.3</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.13.2.2</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.13.2.3</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.13.2.4</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.14.1.2</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.6.1.2</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.7.1.1</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.7.1.2</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.7.3.1</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.8.2.2</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.8.2.3</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.9.1.1</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.9.2.1</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.9.2.3</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.9.4.1</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.9.4.4</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.9.4.5</reference>
        <reference href="https://www.cisecurity.org/controls/">1</reference>
        <reference href="https://www.cisecurity.org/controls/">11</reference>
        <reference href="https://www.cisecurity.org/controls/">12</reference>
        <reference href="https://www.cisecurity.org/controls/">13</reference>
        <reference href="https://www.cisecurity.org/controls/">14</reference>
        <reference href="https://www.cisecurity.org/controls/">15</reference>
        <reference href="https://www.cisecurity.org/controls/">16</reference>
        <reference href="https://www.cisecurity.org/controls/">18</reference>
        <reference href="https://www.cisecurity.org/controls/">3</reference>
        <reference href="https://www.cisecurity.org/controls/">4</reference>
        <reference href="https://www.cisecurity.org/controls/">5</reference>
        <reference href="https://www.cisecurity.org/controls/">6</reference>
        <reference href="https://www.cisecurity.org/controls/">8</reference>
        <reference href="https://www.cisecurity.org/controls/">9</reference>
        <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R4)</reference>
        <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R66)</reference>
        <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Setting the SELinux state to enforcing ensures SELinux is able to confine
potentially compromised processes to the security policy, which is designed to
prevent them from causing damage to the system or further elevating their
privileges.</rationale>
        <platform idref="cpe:/a:machine"/>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="selinux_state" system="urn:xccdf:fix:script:sh" reboot="true" complexity="low" disruption="low" strategy="restrict"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then


var_selinux_state="<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_selinux_state" use="legacy"/>"



if [ -e "/etc/selinux/config" ] ; then
    LC_ALL=C sed -i "/^SELINUX=/Id" "/etc/selinux/config"
else
    touch "/etc/selinux/config"
fi
cp "/etc/selinux/config" "/etc/selinux/config.bak"
# Insert at the end of the file
printf '%s\n' "SELINUX=$var_selinux_state" &gt;&gt; "/etc/selinux/config"
# Clean up after ourselves.
rm "/etc/selinux/config.bak"

fixfiles onboot
fixfiles -f relabel

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="selinux_state" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: XCCDF Value var_selinux_state # promote to variable
  set_fact:
    var_selinux_state: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_selinux_state" use="legacy"/>
  tags:
    - always

- name: Ensure SELinux State is Enforcing
  block:

    - name: Check for duplicate values
      lineinfile:
        path: /etc/selinux/config
        create: false
        regexp: ^SELINUX=
        state: absent
      check_mode: true
      changed_when: false
      register: dupes

    - name: Deduplicate values from /etc/selinux/config
      lineinfile:
        path: /etc/selinux/config
        create: false
        regexp: ^SELINUX=
        state: absent
      when: dupes.found is defined and dupes.found &gt; 1

    - name: Insert correct line to /etc/selinux/config
      lineinfile:
        path: /etc/selinux/config
        create: true
        regexp: ^SELINUX=
        line: SELINUX={{ var_selinux_state }}
        state: present
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.2
    - NIST-800-171-3.7.2
    - NIST-800-53-AC-3
    - NIST-800-53-AC-3(3)(a)
    - NIST-800-53-AU-9
    - NIST-800-53-SC-7(21)
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - selinux_state
</fix>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-export export-name="oval:ssg-var_selinux_state:var:1" value-id="xccdf_org.ssgproject.content_value_var_selinux_state"/>
          <check-content-ref name="oval:ssg-selinux_state:def:1" href="ssg-fedora-oval.xml"/>
        </check>
        <check system="http://scap.nist.gov/schema/ocil/2">
          <check-content-ref name="ocil:ssg-selinux_state_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
        </check>
      </Rule>
      <Rule id="xccdf_org.ssgproject.content_rule_coreos_enable_selinux_kernel_argument" selected="false" role="full" severity="medium">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure SELinux Not Disabled in the kernel arguments</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">SELinux can be disabled at boot time by disabling it via a kernel argument.
Remove any instances of <html:code xmlns:html="http://www.w3.org/1999/xhtml">selinux=0</html:code> from the kernel arguments in that
file to prevent SELinux from being disabled at boot.</description>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.2</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.7.2</reference>
        <reference href="https://public.cyber.mil/stigs/cci/">CCI-000022</reference>
        <reference href="https://public.cyber.mil/stigs/cci/">CCI-000032</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(4)</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(c)</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-3</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-3(3)(a)</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-1</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.AM-3</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-5</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
        <reference href="">SRG-OS-000445-VMM-001780</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.11</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.12</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.6</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.2</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.3</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.4</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.5</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.7</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.5</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.3</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.3</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.4</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.2.2</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.4</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.3</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.4</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.5</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.6</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.7</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.3.3</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
        <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS01.05</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS06.03</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS06.06</reference>
        <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.10.1.1</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.11.1.4</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.11.1.5</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.11.2.1</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.12.1.1</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.12.1.2</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.12.4.1</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.12.4.2</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.12.4.3</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.12.4.4</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.12.7.1</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.13.1.2</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.13.1.3</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.13.2.2</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.13.2.3</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.13.2.4</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.14.1.2</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.6.1.2</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.7.1.1</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.7.1.2</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.7.3.1</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.8.2.2</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.8.2.3</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.9.1.1</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.9.2.1</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.9.2.3</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.9.4.1</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.9.4.4</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.9.4.5</reference>
        <reference href="https://www.cisecurity.org/controls/">1</reference>
        <reference href="https://www.cisecurity.org/controls/">11</reference>
        <reference href="https://www.cisecurity.org/controls/">12</reference>
        <reference href="https://www.cisecurity.org/controls/">13</reference>
        <reference href="https://www.cisecurity.org/controls/">14</reference>
        <reference href="https://www.cisecurity.org/controls/">15</reference>
        <reference href="https://www.cisecurity.org/controls/">16</reference>
        <reference href="https://www.cisecurity.org/controls/">18</reference>
        <reference href="https://www.cisecurity.org/controls/">3</reference>
        <reference href="https://www.cisecurity.org/controls/">4</reference>
        <reference href="https://www.cisecurity.org/controls/">5</reference>
        <reference href="https://www.cisecurity.org/controls/">6</reference>
        <reference href="https://www.cisecurity.org/controls/">8</reference>
        <reference href="https://www.cisecurity.org/controls/">9</reference>
        <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disabling a major host protection feature, such as SELinux, at boot time prevents
it from confining system services at boot time.  Further, it increases
the chances that it will remain off during system operation.</rationale>
        <platform idref="cpe:/a:machine"/>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref name="oval:ssg-coreos_enable_selinux_kernel_argument:def:1" href="ssg-fedora-oval.xml"/>
        </check>
        <check system="http://scap.nist.gov/schema/ocil/2">
          <check-content-ref name="ocil:ssg-coreos_enable_selinux_kernel_argument_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
        </check>
      </Rule>
      <Rule id="xccdf_org.ssgproject.content_rule_selinux_confinement_of_daemons" selected="false" role="full" severity="medium">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure No Daemons are Unconfined by SELinux</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Daemons for which the SELinux policy does not contain rules will inherit the
context of the parent process. Because daemons are launched during
startup and descend from the <html:code xmlns:html="http://www.w3.org/1999/xhtml">init</html:code> process, they inherit the <html:code xmlns:html="http://www.w3.org/1999/xhtml">unconfined_service_t</html:code> context.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
To check for unconfined daemons, run the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo ps -eZ | grep "unconfined_service_t"</html:pre>
It should produce no output in a well-configured system.</description>
        <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">Automatic remediation of this control is not available. Remediation
can be achieved by amending SELinux policy or stopping the unconfined
daemons as outlined above.</warning>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.2</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.5</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.7.2</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(4)</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(c)</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-3(3)(a)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.11</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.12</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.6</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.2</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.3</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.4</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.5</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.7</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.3</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.4</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.5</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.6</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.7</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.2</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.3</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
        <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
        <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
        <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
        <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS06.06</reference>
        <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.10.1.1</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.11.1.4</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.11.1.5</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.11.2.1</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.12.1.2</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.12.4.1</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.12.4.2</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.12.4.3</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.12.4.4</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.12.5.1</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.12.6.2</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.12.7.1</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.13.1.3</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.13.2.3</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.13.2.4</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.14.1.2</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.14.2.2</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.14.2.3</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.14.2.4</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.6.1.2</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.7.1.1</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.7.1.2</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.7.3.1</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.8.2.2</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.8.2.3</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.9.1.1</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.9.2.3</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.9.4.1</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.9.4.4</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.9.4.5</reference>
        <reference href="https://www.cisecurity.org/controls/">1</reference>
        <reference href="https://www.cisecurity.org/controls/">11</reference>
        <reference href="https://www.cisecurity.org/controls/">12</reference>
        <reference href="https://www.cisecurity.org/controls/">13</reference>
        <reference href="https://www.cisecurity.org/controls/">14</reference>
        <reference href="https://www.cisecurity.org/controls/">15</reference>
        <reference href="https://www.cisecurity.org/controls/">16</reference>
        <reference href="https://www.cisecurity.org/controls/">18</reference>
        <reference href="https://www.cisecurity.org/controls/">3</reference>
        <reference href="https://www.cisecurity.org/controls/">5</reference>
        <reference href="https://www.cisecurity.org/controls/">6</reference>
        <reference href="https://www.cisecurity.org/controls/">9</reference>
        <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Daemons which run with the <html:code xmlns:html="http://www.w3.org/1999/xhtml">unconfined_service_t</html:code> context may cause AVC denials,
or allow privileges that the daemon does not require.</rationale>
        <platform idref="cpe:/a:machine"/>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref name="oval:ssg-selinux_confinement_of_daemons:def:1" href="ssg-fedora-oval.xml"/>
        </check>
        <check system="http://scap.nist.gov/schema/ocil/2">
          <check-content-ref name="ocil:ssg-selinux_confinement_of_daemons_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
        </check>
      </Rule>
      <Rule id="xccdf_org.ssgproject.content_rule_selinux_policytype" selected="false" role="full" severity="medium">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Configure SELinux Policy</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The SELinux <html:code xmlns:html="http://www.w3.org/1999/xhtml">targeted</html:code> policy is appropriate for
general-purpose desktops and servers, as well as systems in many other roles.
To configure the system to use this policy, add or correct the following line
in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/selinux/config</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml" xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2">SELINUXTYPE=<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_selinux_policy_name" use="legacy"/></html:pre>
Other policies, such as <html:code xmlns:html="http://www.w3.org/1999/xhtml">mls</html:code>, provide additional security labeling
and greater confinement but are not compatible with many general-purpose
use cases.</description>
        <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R66)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.2</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.7.2</reference>
        <reference href="https://public.cyber.mil/stigs/cci/">CCI-002165</reference>
        <reference href="https://public.cyber.mil/stigs/cci/">CCI-002696</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(4)</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(c)</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-3</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-3(3)(a)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-9</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-7(21)</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-1</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.AM-3</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-5</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
        <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000445-GPOS-00199</reference>
        <reference href="">SRG-OS-000445-VMM-001780</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.11</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.12</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.6</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.2</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.3</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.4</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.5</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.7</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.5</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.3</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.3</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.4</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.2.2</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.4</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.3</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.4</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.5</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.6</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.7</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.3.3</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
        <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS01.05</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS06.03</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS06.06</reference>
        <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.10.1.1</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.11.1.4</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.11.1.5</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.11.2.1</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.12.1.1</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.12.1.2</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.12.4.1</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.12.4.2</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.12.4.3</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.12.4.4</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.12.7.1</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.13.1.2</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.13.1.3</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.13.2.2</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.13.2.3</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.13.2.4</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.14.1.2</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.6.1.2</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.7.1.1</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.7.1.2</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.7.3.1</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.8.2.2</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.8.2.3</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.9.1.1</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.9.2.1</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.9.2.3</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.9.4.1</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.9.4.4</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.9.4.5</reference>
        <reference href="https://www.cisecurity.org/controls/">1</reference>
        <reference href="https://www.cisecurity.org/controls/">11</reference>
        <reference href="https://www.cisecurity.org/controls/">12</reference>
        <reference href="https://www.cisecurity.org/controls/">13</reference>
        <reference href="https://www.cisecurity.org/controls/">14</reference>
        <reference href="https://www.cisecurity.org/controls/">15</reference>
        <reference href="https://www.cisecurity.org/controls/">16</reference>
        <reference href="https://www.cisecurity.org/controls/">18</reference>
        <reference href="https://www.cisecurity.org/controls/">3</reference>
        <reference href="https://www.cisecurity.org/controls/">4</reference>
        <reference href="https://www.cisecurity.org/controls/">5</reference>
        <reference href="https://www.cisecurity.org/controls/">6</reference>
        <reference href="https://www.cisecurity.org/controls/">8</reference>
        <reference href="https://www.cisecurity.org/controls/">9</reference>
        <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Setting the SELinux policy to <html:code xmlns:html="http://www.w3.org/1999/xhtml">targeted</html:code> or a more specialized policy
ensures the system will confine processes that are likely to be
targeted for exploitation, such as network or system services.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Note: During the development or debugging of SELinux modules, it is common to
temporarily place non-production systems in <html:code xmlns:html="http://www.w3.org/1999/xhtml">permissive</html:code> mode. In such
temporary cases, SELinux policies should be developed, and once work
is completed, the system should be reconfigured to
<html:code xmlns:html="http://www.w3.org/1999/xhtml" xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2"><xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_selinux_policy_name" use="legacy"/></html:code>.</rationale>
        <platform idref="cpe:/a:machine"/>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="selinux_policytype" system="urn:xccdf:fix:script:sh" reboot="true" complexity="low" disruption="low" strategy="restrict"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then


var_selinux_policy_name="<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_selinux_policy_name" use="legacy"/>"



if [ -e "/etc/selinux/config" ] ; then
    LC_ALL=C sed -i "/^SELINUXTYPE=/Id" "/etc/selinux/config"
else
    touch "/etc/selinux/config"
fi
cp "/etc/selinux/config" "/etc/selinux/config.bak"
# Insert at the end of the file
printf '%s\n' "SELINUXTYPE=$var_selinux_policy_name" &gt;&gt; "/etc/selinux/config"
# Clean up after ourselves.
rm "/etc/selinux/config.bak"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="selinux_policytype" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="low" strategy="restrict">- name: XCCDF Value var_selinux_policy_name # promote to variable
  set_fact:
    var_selinux_policy_name: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_selinux_policy_name" use="legacy"/>
  tags:
    - always

- name: Configure SELinux Policy
  block:

    - name: Check for duplicate values
      lineinfile:
        path: /etc/selinux/config
        create: false
        regexp: ^SELINUXTYPE=
        state: absent
      check_mode: true
      changed_when: false
      register: dupes

    - name: Deduplicate values from /etc/selinux/config
      lineinfile:
        path: /etc/selinux/config
        create: false
        regexp: ^SELINUXTYPE=
        state: absent
      when: dupes.found is defined and dupes.found &gt; 1

    - name: Insert correct line to /etc/selinux/config
      lineinfile:
        path: /etc/selinux/config
        create: true
        regexp: ^SELINUXTYPE=
        line: SELINUXTYPE={{ var_selinux_policy_name }}
        state: present
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.2
    - NIST-800-171-3.7.2
    - NIST-800-53-AC-3
    - NIST-800-53-AC-3(3)(a)
    - NIST-800-53-AU-9
    - NIST-800-53-SC-7(21)
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
    - selinux_policytype
</fix>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-export export-name="oval:ssg-var_selinux_policy_name:var:1" value-id="xccdf_org.ssgproject.content_value_var_selinux_policy_name"/>
          <check-content-ref name="oval:ssg-selinux_policytype:def:1" href="ssg-fedora-oval.xml"/>
        </check>
        <check system="http://scap.nist.gov/schema/ocil/2">
          <check-content-ref name="ocil:ssg-selinux_policytype_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
        </check>
      </Rule>
      <Rule id="xccdf_org.ssgproject.content_rule_selinux_all_devicefiles_labeled" selected="false" role="full" severity="medium">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure No Device Files are Unlabeled by SELinux</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Device files, which are used for communication with important system
resources, should be labeled with proper SELinux types. If any device files
carry the SELinux type <html:code xmlns:html="http://www.w3.org/1999/xhtml">device_t</html:code> or <html:code xmlns:html="http://www.w3.org/1999/xhtml">unlabeled_t</html:code>, report the
bug so that policy can be corrected. Supply information about what the
device is and what programs use it.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
To check for incorrectly labeled device files, run following commands:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo find /dev -context *:device_t:* \( -type c -o -type b \) -printf "%p %Z\n"</html:pre>
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo find /dev -context *:unlabeled_t:* \( -type c -o -type b \) -printf "%p %Z\n"</html:pre>
It should produce no output in a well-configured system.</description>
        <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">Automatic remediation of this control is not available. The remediation
can be achieved by amending SELinux policy.</warning>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.2</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.5</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.7.2</reference>
        <reference href="https://public.cyber.mil/stigs/cci/">CCI-000022</reference>
        <reference href="https://public.cyber.mil/stigs/cci/">CCI-000032</reference>
        <reference href="https://public.cyber.mil/stigs/cci/">CCI-000318</reference>
        <reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</reference>
        <reference href="https://public.cyber.mil/stigs/cci/">CCI-000368</reference>
        <reference href="https://public.cyber.mil/stigs/cci/">CCI-001812</reference>
        <reference href="https://public.cyber.mil/stigs/cci/">CCI-001813</reference>
        <reference href="https://public.cyber.mil/stigs/cci/">CCI-001814</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-3(3)(a)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-3</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
        <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.11</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.12</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.6</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.2</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.3</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.4</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.5</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.7</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.3</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.4</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.5</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.6</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.7</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.2</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.3</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">BAI01.06</reference>
        <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
        <reference href="https://www.isaca.org/resources/cobit">BAI06.01</reference>
        <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
        <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
        <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
        <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS06.06</reference>
        <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.10.1.1</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.11.1.4</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.11.1.5</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.11.2.1</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.12.1.2</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.12.4.1</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.12.4.2</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.12.4.3</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.12.4.4</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.12.5.1</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.12.6.2</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.12.7.1</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.13.1.3</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.13.2.3</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.13.2.4</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.14.1.2</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.14.2.2</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.14.2.3</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.14.2.4</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.14.2.7</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.15.2.1</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.6.1.2</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.7.1.1</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.7.1.2</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.7.3.1</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.8.2.2</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.8.2.3</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.9.1.1</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.9.2.3</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.9.4.1</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.9.4.4</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.9.4.5</reference>
        <reference href="https://www.cisecurity.org/controls/">1</reference>
        <reference href="https://www.cisecurity.org/controls/">11</reference>
        <reference href="https://www.cisecurity.org/controls/">12</reference>
        <reference href="https://www.cisecurity.org/controls/">13</reference>
        <reference href="https://www.cisecurity.org/controls/">14</reference>
        <reference href="https://www.cisecurity.org/controls/">15</reference>
        <reference href="https://www.cisecurity.org/controls/">16</reference>
        <reference href="https://www.cisecurity.org/controls/">18</reference>
        <reference href="https://www.cisecurity.org/controls/">2</reference>
        <reference href="https://www.cisecurity.org/controls/">3</reference>
        <reference href="https://www.cisecurity.org/controls/">5</reference>
        <reference href="https://www.cisecurity.org/controls/">6</reference>
        <reference href="https://www.cisecurity.org/controls/">7</reference>
        <reference href="https://www.cisecurity.org/controls/">8</reference>
        <reference href="https://www.cisecurity.org/controls/">9</reference>
        <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">If a device file carries the SELinux type <html:code xmlns:html="http://www.w3.org/1999/xhtml">device_t</html:code> or
<html:code xmlns:html="http://www.w3.org/1999/xhtml">unlabeled_t</html:code>, then SELinux cannot properly restrict access to the
device file.</rationale>
        <platform idref="cpe:/a:machine"/>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref name="oval:ssg-selinux_all_devicefiles_labeled:def:1" href="ssg-fedora-oval.xml"/>
        </check>
        <check system="http://scap.nist.gov/schema/ocil/2">
          <check-content-ref name="ocil:ssg-selinux_all_devicefiles_labeled_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
        </check>
      </Rule>
      <Group id="xccdf_org.ssgproject.content_group_selinux-booleans">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">SELinux - Booleans</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Enable or Disable runtime customization of SELinux system policies
without having to reload or recompile the SELinux policy.</description>
        <platform idref="cpe:/a:machine"/>
        <Value id="xccdf_org.ssgproject.content_value_var_abrt_anon_write" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">abrt_anon_write SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_abrt_handle_event" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">abrt_handle_event SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_abrt_upload_watch_anon_write" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">abrt_upload_watch_anon_write SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>true</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_antivirus_can_scan_system" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">antivirus_can_scan_system SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_antivirus_use_jit" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">antivirus_use_jit SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_auditadm_exec_content" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">auditadm_exec_content SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>true</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_authlogin_nsswitch_use_ldap" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">authlogin_nsswitch_use_ldap SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_authlogin_radius" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">authlogin_radius SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_authlogin_yubikey" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">authlogin_yubikey SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_awstats_purge_apache_log_files" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">awstats_purge_apache_log_files SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_boinc_execmem" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">boinc_execmem SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>true</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_cdrecord_read_content" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">cdrecord_read_content SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_cluster_can_network_connect" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">cluster_can_network_connect SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_cluster_manage_all_files" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">cluster_manage_all_files SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_cluster_use_execmem" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">cluster_use_execmem SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_cobbler_anon_write" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">cobbler_anon_write SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_cobbler_can_network_connect" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">cobbler_can_network_connect SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_cobbler_use_cifs" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">cobbler_use_cifs SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_cobbler_use_nfs" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">cobbler_use_nfs SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_collectd_tcp_network_connect" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">collectd_tcp_network_connect SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_condor_tcp_network_connect" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">condor_tcp_network_connect SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_conman_can_network" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">conman_can_network SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_container_connect_any" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">container_connect_any SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_cron_can_relabel" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">cron_can_relabel SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_cron_system_cronjob_use_shares" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">cron_system_cronjob_use_shares SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_cron_userdomain_transition" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">cron_userdomain_transition SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>true</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_cups_execmem" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">cups_execmem SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_cvs_read_shadow" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">cvs_read_shadow SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_daemons_dump_core" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">daemons_dump_core SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_daemons_enable_cluster_mode" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">daemons_enable_cluster_mode SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_daemons_use_tcp_wrapper" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">daemons_use_tcp_wrapper SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_daemons_use_tty" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">daemons_use_tty SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_dbadm_exec_content" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">dbadm_exec_content SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>true</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_dbadm_manage_user_files" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">dbadm_manage_user_files SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_dbadm_read_user_files" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">dbadm_read_user_files SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_deny_execmem" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">deny_execmem SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_deny_ptrace" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">deny_ptrace SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_dhcpc_exec_iptables" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">dhcpc_exec_iptables SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_dhcpd_use_ldap" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">dhcpd_use_ldap SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_domain_fd_use" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">domain_fd_use SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>true</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_domain_kernel_load_modules" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">domain_kernel_load_modules SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_entropyd_use_audio" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">entropyd_use_audio SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>true</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_exim_can_connect_db" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">exim_can_connect_db SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_exim_manage_user_files" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">exim_manage_user_files SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_exim_read_user_files" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">exim_read_user_files SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_fcron_crond" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">fcron_crond SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_fenced_can_network_connect" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">fenced_can_network_connect SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_fenced_can_ssh" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">fenced_can_ssh SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_fips_mode" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">fips_mode SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>true</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_ftpd_anon_write" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">ftpd_anon_write SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_ftpd_connect_all_unreserved" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">ftpd_connect_all_unreserved SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_ftpd_connect_db" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">ftpd_connect_db SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_ftpd_full_access" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">ftpd_full_access SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_ftpd_use_cifs" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">ftpd_use_cifs SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_ftpd_use_fusefs" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">ftpd_use_fusefs SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_ftpd_use_nfs" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">ftpd_use_nfs SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_ftpd_use_passive_mode" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">ftpd_use_passive_mode SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_git_cgi_enable_homedirs" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">git_cgi_enable_homedirs SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_git_cgi_use_cifs" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">git_cgi_use_cifs SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_git_cgi_use_nfs" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">git_cgi_use_nfs SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_git_session_bind_all_unreserved_ports" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">git_session_bind_all_unreserved_ports SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_git_session_users" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">git_session_users SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_git_system_enable_homedirs" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">git_system_enable_homedirs SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_git_system_use_cifs" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">git_system_use_cifs SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_git_system_use_nfs" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">git_system_use_nfs SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_gitosis_can_sendmail" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">gitosis_can_sendmail SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_glance_api_can_network" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">glance_api_can_network SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_glance_use_execmem" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">glance_use_execmem SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_glance_use_fusefs" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">glance_use_fusefs SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_global_ssp" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">global_ssp SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_gluster_anon_write" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">gluster_anon_write SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_gluster_export_all_ro" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">gluster_export_all_ro SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_gluster_export_all_rw" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">gluster_export_all_rw SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>true</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_gpg_web_anon_write" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">gpg_web_anon_write SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_gssd_read_tmp" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">gssd_read_tmp SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>true</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_guest_exec_content" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">guest_exec_content SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>true</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_haproxy_connect_any" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">haproxy_connect_any SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_httpd_anon_write" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">httpd_anon_write SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_httpd_builtin_scripting" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">httpd_builtin_scripting SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>true</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_httpd_can_check_spam" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">httpd_can_check_spam SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_httpd_can_connect_ftp" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">httpd_can_connect_ftp SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_httpd_can_connect_ldap" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">httpd_can_connect_ldap SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_httpd_can_connect_mythtv" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">httpd_can_connect_mythtv SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_httpd_can_connect_zabbix" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">httpd_can_connect_zabbix SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_httpd_can_network_connect" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">httpd_can_network_connect SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_httpd_can_network_connect_cobbler" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">httpd_can_network_connect_cobbler SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_httpd_can_network_connect_db" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">httpd_can_network_connect_db SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_httpd_can_network_memcache" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">httpd_can_network_memcache SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_httpd_can_network_relay" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">httpd_can_network_relay SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_httpd_can_sendmail" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">httpd_can_sendmail SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_httpd_dbus_avahi" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">httpd_dbus_avahi SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_httpd_dbus_sssd" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">httpd_dbus_sssd SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_httpd_dontaudit_search_dirs" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">httpd_dontaudit_search_dirs SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_httpd_enable_cgi" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">httpd_enable_cgi SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>true</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_httpd_enable_ftp_server" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">httpd_enable_ftp_server SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_httpd_enable_homedirs" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">httpd_enable_homedirs SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_httpd_execmem" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">httpd_execmem SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_httpd_graceful_shutdown" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">httpd_graceful_shutdown SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>true</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_httpd_manage_ipa" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">httpd_manage_ipa SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_httpd_mod_auth_ntlm_winbind" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">httpd_mod_auth_ntlm_winbind SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_httpd_mod_auth_pam" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">httpd_mod_auth_pam SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_httpd_read_user_content" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">httpd_read_user_content SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_httpd_run_ipa" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">httpd_run_ipa SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_httpd_run_preupgrade" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">httpd_run_preupgrade SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_httpd_run_stickshift" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">httpd_run_stickshift SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_httpd_serve_cobbler_files" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">httpd_serve_cobbler_files SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_httpd_setrlimit" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">httpd_setrlimit SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_httpd_ssi_exec" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">httpd_ssi_exec SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_httpd_sys_script_anon_write" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">httpd_sys_script_anon_write SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_httpd_tmp_exec" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">httpd_tmp_exec SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_httpd_tty_comm" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">httpd_tty_comm SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_httpd_unified" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">httpd_unified SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_httpd_use_cifs" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">httpd_use_cifs SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_httpd_use_fusefs" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">httpd_use_fusefs SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_httpd_use_gpg" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">httpd_use_gpg SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_httpd_use_nfs" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">httpd_use_nfs SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_httpd_use_openstack" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">httpd_use_openstack SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_httpd_use_sasl" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">httpd_use_sasl SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_httpd_verify_dns" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">httpd_verify_dns SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_icecast_use_any_tcp_ports" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">icecast_use_any_tcp_ports SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_irc_use_any_tcp_ports" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">irc_use_any_tcp_ports SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_irssi_use_full_network" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">irssi_use_full_network SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_kdumpgui_run_bootloader" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">kdumpgui_run_bootloader SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_kerberos_enabled" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">kerberos_enabled SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>true</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_ksmtuned_use_cifs" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">ksmtuned_use_cifs SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_ksmtuned_use_nfs" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">ksmtuned_use_nfs SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_logadm_exec_content" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">logadm_exec_content SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>true</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_logging_syslogd_can_sendmail" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">logging_syslogd_can_sendmail SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_logging_syslogd_run_nagios_plugins" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">logging_syslogd_run_nagios_plugins SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_logging_syslogd_use_tty" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">logging_syslogd_use_tty SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>true</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_login_console_enabled" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">login_console_enabled SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>true</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_logrotate_use_nfs" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">logrotate_use_nfs SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_logwatch_can_network_connect_mail" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">logwatch_can_network_connect_mail SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_lsmd_plugin_connect_any" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">lsmd_plugin_connect_any SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_mailman_use_fusefs" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">mailman_use_fusefs SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_mcelog_client" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">mcelog_client SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_mcelog_exec_scripts" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">mcelog_exec_scripts SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>true</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_mcelog_foreground" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">mcelog_foreground SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_mcelog_server" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">mcelog_server SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_minidlna_read_generic_user_content" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">minidlna_read_generic_user_content SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_mmap_low_allowed" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">mmap_low_allowed SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_mock_enable_homedirs" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">mock_enable_homedirs SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_mount_anyfile" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">mount_anyfile SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>true</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_mozilla_plugin_bind_unreserved_ports" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">mozilla_plugin_bind_unreserved_ports SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_mozilla_plugin_can_network_connect" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">mozilla_plugin_can_network_connect SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_mozilla_plugin_use_bluejeans" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">mozilla_plugin_use_bluejeans SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_mozilla_plugin_use_gps" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">mozilla_plugin_use_gps SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_mozilla_plugin_use_spice" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">mozilla_plugin_use_spice SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_mozilla_read_content" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">mozilla_read_content SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_mpd_enable_homedirs" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">mpd_enable_homedirs SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_mpd_use_cifs" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">mpd_use_cifs SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_mpd_use_nfs" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">mpd_use_nfs SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_mplayer_execstack" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">mplayer_execstack SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_mysql_connect_any" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">mysql_connect_any SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_nagios_run_pnp4nagios" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">nagios_run_pnp4nagios SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_nagios_run_sudo" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">nagios_run_sudo SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_named_tcp_bind_http_port" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">named_tcp_bind_http_port SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_named_write_master_zones" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">named_write_master_zones SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_neutron_can_network" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">neutron_can_network SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_nfs_export_all_ro" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">nfs_export_all_ro SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>true</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_nfs_export_all_rw" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">nfs_export_all_rw SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>true</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_nfsd_anon_write" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">nfsd_anon_write SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_nis_enabled" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">nis_enabled SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_nscd_use_shm" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">nscd_use_shm SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>true</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_openshift_use_nfs" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">openshift_use_nfs SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_openvpn_can_network_connect" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">openvpn_can_network_connect SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>true</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_openvpn_enable_homedirs" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">openvpn_enable_homedirs SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>true</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_openvpn_run_unconfined" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">openvpn_run_unconfined SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_pcp_bind_all_unreserved_ports" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">pcp_bind_all_unreserved_ports SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_pcp_read_generic_logs" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">pcp_read_generic_logs SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_piranha_lvs_can_network_connect" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">piranha_lvs_can_network_connect SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_polipo_connect_all_unreserved" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">polipo_connect_all_unreserved SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_polipo_session_bind_all_unreserved_ports" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">polipo_session_bind_all_unreserved_ports SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_polipo_session_users" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">polipo_session_users SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_polipo_use_cifs" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">polipo_use_cifs SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_polipo_use_nfs" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">polipo_use_nfs SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_polyinstantiation_enabled" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">polyinstantiation_enabled SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_postfix_local_write_mail_spool" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">postfix_local_write_mail_spool SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>true</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_postgresql_can_rsync" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">postgresql_can_rsync SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_postgresql_selinux_transmit_client_label" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">postgresql_selinux_transmit_client_label SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_postgresql_selinux_unconfined_dbadm" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">postgresql_selinux_unconfined_dbadm SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>true</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_postgresql_selinux_users_ddl" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">postgresql_selinux_users_ddl SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>true</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_pppd_can_insmod" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">pppd_can_insmod SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_pppd_for_user" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">pppd_for_user SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_privoxy_connect_any" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">privoxy_connect_any SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>true</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_prosody_bind_http_port" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">prosody_bind_http_port SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_puppetagent_manage_all_files" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">puppetagent_manage_all_files SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_puppetmaster_use_db" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">puppetmaster_use_db SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_racoon_read_shadow" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">racoon_read_shadow SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_rsync_anon_write" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">rsync_anon_write SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_rsync_client" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">rsync_client SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_rsync_export_all_ro" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">rsync_export_all_ro SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_rsync_full_access" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">rsync_full_access SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_samba_create_home_dirs" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">samba_create_home_dirs SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_samba_domain_controller" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">samba_domain_controller SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_samba_enable_home_dirs" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">samba_enable_home_dirs SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_samba_export_all_ro" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">samba_export_all_ro SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_samba_export_all_rw" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">samba_export_all_rw SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_samba_load_libgfapi" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">samba_load_libgfapi SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_samba_portmapper" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">samba_portmapper SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_samba_run_unconfined" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">samba_run_unconfined SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_samba_share_fusefs" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">samba_share_fusefs SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_samba_share_nfs" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">samba_share_nfs SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_sanlock_use_fusefs" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">sanlock_use_fusefs SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_sanlock_use_nfs" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">sanlock_use_nfs SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_sanlock_use_samba" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">sanlock_use_samba SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_saslauthd_read_shadow" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">saslauthd_read_shadow SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_secadm_exec_content" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">secadm_exec_content SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>true</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_secure_mode" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">secure_mode SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_secure_mode_insmod" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">secure_mode_insmod SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_secure_mode_policyload" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">secure_mode_policyload SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_selinuxuser_direct_dri_enabled" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">selinuxuser_direct_dri_enabled SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>true</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_selinuxuser_execheap" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">selinuxuser_execheap SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_selinuxuser_execmod" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">selinuxuser_execmod SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>true</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_selinuxuser_execstack" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">selinuxuser_execstack SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_selinuxuser_mysql_connect_enabled" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">selinuxuser_mysql_connect_enabled SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_selinuxuser_ping" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">selinuxuser_ping SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>true</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_selinuxuser_postgresql_connect_enabled" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">selinuxuser_postgresql_connect_enabled SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_selinuxuser_rw_noexattrfile" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">selinuxuser_rw_noexattrfile SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>true</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_selinuxuser_share_music" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">selinuxuser_share_music SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_selinuxuser_tcp_server" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">selinuxuser_tcp_server SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_selinuxuser_udp_server" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">selinuxuser_udp_server SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_selinuxuser_use_ssh_chroot" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">selinuxuser_use_ssh_chroot SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_sge_domain_can_network_connect" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">sge_domain_can_network_connect SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_sge_use_nfs" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">sge_use_nfs SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_smartmon_3ware" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">smartmon_3ware SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_smbd_anon_write" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">smbd_anon_write SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_spamassassin_can_network" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">spamassassin_can_network SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_spamd_enable_home_dirs" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">spamd_enable_home_dirs SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>true</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_squid_connect_any" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">squid_connect_any SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>true</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_squid_use_tproxy" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">squid_use_tproxy SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_ssh_chroot_rw_homedirs" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">ssh_chroot_rw_homedirs SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_ssh_keysign" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">ssh_keysign SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_ssh_sysadm_login" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">ssh_sysadm_login SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_staff_exec_content" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">staff_exec_content SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>true</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_staff_use_svirt" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">staff_use_svirt SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_swift_can_network" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">swift_can_network SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_sysadm_exec_content" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">sysadm_exec_content SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>true</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_telepathy_connect_all_ports" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">telepathy_connect_all_ports SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_telepathy_tcp_connect_generic_network_ports" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">telepathy_tcp_connect_generic_network_ports SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>true</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_tftp_anon_write" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">tftp_anon_write SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_tftp_home_dir" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">tftp_home_dir SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_tmpreaper_use_nfs" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">tmpreaper_use_nfs SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_tmpreaper_use_samba" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">tmpreaper_use_samba SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_tor_bind_all_unreserved_ports" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">tor_bind_all_unreserved_ports SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_tor_can_network_relay" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">tor_can_network_relay SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_unconfined_chrome_sandbox_transition" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">unconfined_chrome_sandbox_transition SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>true</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_unconfined_login" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">unconfined_login SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>true</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_unconfined_mozilla_plugin_transition" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">unconfined_mozilla_plugin_transition SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>true</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_unprivuser_use_svirt" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">unprivuser_use_svirt SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_use_ecryptfs_home_dirs" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">use_ecryptfs_home_dirs SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_use_fusefs_home_dirs" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">use_fusefs_home_dirs SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_use_lpd_server" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">use_lpd_server SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_use_nfs_home_dirs" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">use_nfs_home_dirs SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_use_samba_home_dirs" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">use_samba_home_dirs SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_user_exec_content" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">user_exec_content SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>true</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_varnishd_connect_any" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">varnishd_connect_any SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_virt_read_qemu_ga_data" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">virt_read_qemu_ga_data SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_virt_rw_qemu_ga_data" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">virt_rw_qemu_ga_data SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_virt_sandbox_use_all_caps" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">virt_sandbox_use_all_caps SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>true</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_virt_sandbox_use_audit" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">virt_sandbox_use_audit SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>true</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_virt_sandbox_use_mknod" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">virt_sandbox_use_mknod SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_virt_sandbox_use_netlink" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">virt_sandbox_use_netlink SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_virt_sandbox_use_sys_admin" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">virt_sandbox_use_sys_admin SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_virt_transition_userdomain" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">virt_transition_userdomain SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_virt_use_comm" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">virt_use_comm SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_virt_use_execmem" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">virt_use_execmem SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_virt_use_fusefs" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">virt_use_fusefs SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_virt_use_nfs" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">virt_use_nfs SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_virt_use_rawip" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">virt_use_rawip SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_virt_use_samba" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">virt_use_samba SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_virt_use_sanlock" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">virt_use_sanlock SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_virt_use_usb" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">virt_use_usb SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>true</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_virt_use_xserver" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">virt_use_xserver SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_webadm_manage_user_files" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">webadm_manage_user_files SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_webadm_read_user_files" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">webadm_read_user_files SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_wine_mmap_zero_ignore" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">wine_mmap_zero_ignore SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_xdm_bind_vnc_tcp_port" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">xdm_bind_vnc_tcp_port SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_xdm_exec_bootloader" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">xdm_exec_bootloader SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_xdm_sysadm_login" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">xdm_sysadm_login SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_xdm_write_home" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">xdm_write_home SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_xen_use_nfs" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">xen_use_nfs SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_xend_run_blktap" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">xend_run_blktap SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>true</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_xend_run_qemu" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">xend_run_qemu SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>true</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_xguest_connect_network" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">xguest_connect_network SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>true</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_xguest_exec_content" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">xguest_exec_content SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>true</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_xguest_mount_media" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">xguest_mount_media SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>true</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_xguest_use_bluetooth" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">xguest_use_bluetooth SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>true</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_xserver_clients_write_xshm" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">xserver_clients_write_xshm SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_xserver_execmem" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">xserver_execmem SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_xserver_object_manager" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">xserver_object_manager SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_zabbix_can_network" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">zabbix_can_network SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_zarafa_setrlimit" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">zarafa_setrlimit SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_zebra_write_config" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">zebra_write_config SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_zoneminder_anon_write" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">zoneminder_anon_write SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_zoneminder_run_sudo" type="boolean">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">zoneminder_run_sudo SELinux Boolean</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">default - Default SELinux boolean setting.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>on - SELinux boolean is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>off - SELinux boolean is disabled.</description>
          <value>false</value>
          <value selector="off">false</value>
          <value selector="on">true</value>
        </Value>
      </Group>
    </Group>
    <Group id="xccdf_org.ssgproject.content_group_entropy">
      <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Protect Random-Number Entropy Pool</title>
      <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The I/O operations of the Linux kernel block layer due to their inherently
unpredictable execution times have been traditionally considered as a reliable
source to contribute to random-number entropy pool of the Linux kernel. This
has changed with introduction of solid-state storage devices (SSDs) though.</description>
      <platform idref="cpe:/a:machine"/>
      <Rule id="xccdf_org.ssgproject.content_rule_kernel_disable_entropy_contribution_for_solid_state_drives" selected="false" role="full" severity="medium">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure Solid State Drives Do Not Contribute To Random-Number Entropy Pool</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">For each solid-state drive on the system, run:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml"> # echo 0 &gt; /sys/block/DRIVE/queue/add_random</html:pre></description>
        <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">In contrast to traditional electromechanical magnetic disks, containing
spinning disks and / or movable read / write heads, the solid-state storage
devices (SSDs) do not contain moving / mechanical components. Therefore the
I/O operation completion times are much more predictable for them.</rationale>
        <platform idref="cpe:/a:machine"/>
      </Rule>
    </Group>
    <Group id="xccdf_org.ssgproject.content_group_bootloader-grub2">
      <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">GRUB2 bootloader configuration</title>
      <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">During the boot process, the boot loader is
responsible for starting the execution of the kernel and passing
options to it. The boot loader allows for the selection of
different kernels - possibly on different partitions or media.
The default Fedora boot loader for x86 systems is called GRUB2.
Options it can pass to the kernel include <html:i xmlns:html="http://www.w3.org/1999/xhtml">single-user mode</html:i>, which
provides root access without any authentication, and the ability to
disable SELinux. To prevent local users from modifying the boot
parameters and endangering security, protect the boot loader configuration
with a password and ensure its configuration file's permissions
are set properly.</description>
      <platform idref="cpe:/a:grub2"/>
      <Rule id="xccdf_org.ssgproject.content_rule_grub2_enable_iommu_force" selected="false" role="full" severity="unknown">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">IOMMU configuration directive</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">On x86 architecture supporting VT-d, the IOMMU manages the access control policy between the hardware devices and some
    of the system critical units such as the memory.</description>
        <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="functionality">Depending on the hardware, devices and operating system used, enabling IOMMU can cause hardware instabilities. Proper function and stability should be assessed before applying remediation to production systems.</warning>
        <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R11)</reference>
        <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">On x86 architectures, activating the I/OMMU prevents the system from arbritrary accesses potentially made by
    hardware devices.</rationale>
        <platform idref="cpe:/a:machine"/>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="grub2_enable_iommu_force" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q grub2-common &amp;&amp; { [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; }; then

# Correct grub2 kernelopts value using grub2-editenv
if ! grub2-editenv - list | grep -qE '^kernelopts=(.*\s)?iommu=force(\s.*)?$'; then
  grub2-editenv - set "$(grub2-editenv - list | grep kernelopts) iommu=force"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="grub2_enable_iommu_force" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="medium" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - grub2_enable_iommu_force
    - low_disruption
    - medium_complexity
    - reboot_required
    - restrict_strategy
    - unknown_severity

- name: get current kernel parameters
  command: /usr/bin/grub2-editenv - list
  register: kernelopts
  changed_when: false
  when:
    - '"grub2-common" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - grub2_enable_iommu_force
    - low_disruption
    - medium_complexity
    - reboot_required
    - restrict_strategy
    - unknown_severity

- name: Update the bootloader menu
  command: /usr/bin/grub2-editenv - set "{{ item }} iommu=force"
  with_items: '{{ kernelopts.stdout_lines | select(''match'', ''^kernelopts.*'') |
    list }}'
  when:
    - '"grub2-common" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - kernelopts.stdout_lines is defined
    - kernelopts.stdout_lines | length &gt; 0
    - kernelopts.stdout | regex_search('^kernelopts=(?:.*\s)?iommu=force(?:\s.*)?$',
      multiline=True) is none
  tags:
    - grub2_enable_iommu_force
    - low_disruption
    - medium_complexity
    - reboot_required
    - restrict_strategy
    - unknown_severity
</fix>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref name="oval:ssg-grub2_enable_iommu_force:def:1" href="ssg-fedora-oval.xml"/>
        </check>
      </Rule>
      <Rule id="xccdf_org.ssgproject.content_rule_grub2_vsyscall_argument" selected="false" role="full" severity="medium">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable vsyscalls</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To disable use of virtual syscalls,
add the argument <html:code xmlns:html="http://www.w3.org/1999/xhtml">vsyscall=none</html:code> to the default
GRUB 2 command line for the Linux operating system in
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/default/grub</html:code>, in the manner below:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">GRUB_CMDLINE_LINUX="vsyscall=none"</html:pre></description>
        <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="management">The GRUB 2 configuration file, <html:code xmlns:html="http://www.w3.org/1999/xhtml">grub.cfg</html:code>,
is automatically updated each time a new kernel is installed. Note that any
changes to <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/default/grub</html:code> require rebuilding the <html:code xmlns:html="http://www.w3.org/1999/xhtml">grub.cfg</html:code>
file. To update the GRUB 2 configuration file manually, use the
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">grub2-mkconfig -o</html:pre> command as follows:
<html:ul xmlns:html="http://www.w3.org/1999/xhtml"><html:li>On BIOS-based machines, issue the following command as <html:code>root</html:code>:
<html:pre>~]# grub2-mkconfig -o /boot/grub2/grub.cfg</html:pre></html:li><html:li>On UEFI-based machines, issue the following command as <html:code>root</html:code>:

<html:pre>~]# grub2-mkconfig -o /boot/efi/EFI/fedora/grub.cfg</html:pre></html:li></html:ul></warning>
        <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
        <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000134-GPOS-00068</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
        <reference href="https://public.cyber.mil/stigs/cci/">CCI-001084</reference>
        <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Virtual Syscalls provide an opportunity of attack for a user who has control
of the return instruction pointer.</rationale>
        <platform idref="cpe:/a:machine"/>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="grub2_vsyscall_argument" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q grub2-common &amp;&amp; { [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; }; then

# Correct grub2 kernelopts value using grub2-editenv
if ! grub2-editenv - list | grep -qE '^kernelopts=(.*\s)?vsyscall=none(\s.*)?$'; then
  grub2-editenv - set "$(grub2-editenv - list | grep kernelopts) vsyscall=none"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="grub2_vsyscall_argument" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="medium" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-53-CM-7(a)
    - grub2_vsyscall_argument
    - low_disruption
    - medium_complexity
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: get current kernel parameters
  command: /usr/bin/grub2-editenv - list
  register: kernelopts
  changed_when: false
  when:
    - '"grub2-common" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-CM-7(a)
    - grub2_vsyscall_argument
    - low_disruption
    - medium_complexity
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Update the bootloader menu
  command: /usr/bin/grub2-editenv - set "{{ item }} vsyscall=none"
  with_items: '{{ kernelopts.stdout_lines | select(''match'', ''^kernelopts.*'') |
    list }}'
  when:
    - '"grub2-common" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - kernelopts.stdout_lines is defined
    - kernelopts.stdout_lines | length &gt; 0
    - kernelopts.stdout | regex_search('^kernelopts=(?:.*\s)?vsyscall=none(?:\s.*)?$',
      multiline=True) is none
  tags:
    - NIST-800-53-CM-7(a)
    - grub2_vsyscall_argument
    - low_disruption
    - medium_complexity
    - medium_severity
    - reboot_required
    - restrict_strategy
</fix>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref name="oval:ssg-grub2_vsyscall_argument:def:1" href="ssg-fedora-oval.xml"/>
        </check>
        <check system="http://scap.nist.gov/schema/ocil/2">
          <check-content-ref name="ocil:ssg-grub2_vsyscall_argument_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
        </check>
      </Rule>
      <Rule id="xccdf_org.ssgproject.content_rule_grub2_pti_argument" selected="false" role="full" severity="high">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Enable Kernel Page-Table Isolation (KPTI)</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To enable Kernel page-table isolation,
add the argument <html:code xmlns:html="http://www.w3.org/1999/xhtml">pti=on</html:code> to the default
GRUB 2 command line for the Linux operating system in
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/default/grub</html:code>, in the manner below:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">GRUB_CMDLINE_LINUX="pti=on"</html:pre></description>
        <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="management">The GRUB 2 configuration file, <html:code xmlns:html="http://www.w3.org/1999/xhtml">grub.cfg</html:code>,
is automatically updated each time a new kernel is installed. Note that any
changes to <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/default/grub</html:code> require rebuilding the <html:code xmlns:html="http://www.w3.org/1999/xhtml">grub.cfg</html:code>
file. To update the GRUB 2 configuration file manually, use the
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">grub2-mkconfig -o</html:pre> command as follows:
<html:ul xmlns:html="http://www.w3.org/1999/xhtml"><html:li>On BIOS-based machines, issue the following command as <html:code>root</html:code>:
<html:pre>~]# grub2-mkconfig -o /boot/grub2/grub.cfg</html:pre></html:li><html:li>On UEFI-based machines, issue the following command as <html:code>root</html:code>:

<html:pre>~]# grub2-mkconfig -o /boot/efi/EFI/fedora/grub.cfg</html:pre></html:li></html:ul></warning>
        <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000433-GPOS-00193</reference>
        <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000095-GPOS-00049</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SI-16</reference>
        <reference href="https://public.cyber.mil/stigs/cci/">CCI-000381</reference>
        <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Kernel page-table isolation is a kernel feature that mitigates
the Meltdown security vulnerability and hardens the kernel
against attempts to bypass kernel address space layout
randomization (KASLR).</rationale>
        <platform idref="cpe:/a:machine"/>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="grub2_pti_argument" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q grub2-common &amp;&amp; { [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; }; then

# Correct grub2 kernelopts value using grub2-editenv
if ! grub2-editenv - list | grep -qE '^kernelopts=(.*\s)?pti=on(\s.*)?$'; then
  grub2-editenv - set "$(grub2-editenv - list | grep kernelopts) pti=on"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="grub2_pti_argument" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="medium" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-53-SI-16
    - grub2_pti_argument
    - high_severity
    - low_disruption
    - medium_complexity
    - reboot_required
    - restrict_strategy

- name: get current kernel parameters
  command: /usr/bin/grub2-editenv - list
  register: kernelopts
  changed_when: false
  when:
    - '"grub2-common" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-SI-16
    - grub2_pti_argument
    - high_severity
    - low_disruption
    - medium_complexity
    - reboot_required
    - restrict_strategy

- name: Update the bootloader menu
  command: /usr/bin/grub2-editenv - set "{{ item }} pti=on"
  with_items: '{{ kernelopts.stdout_lines | select(''match'', ''^kernelopts.*'') |
    list }}'
  when:
    - '"grub2-common" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - kernelopts.stdout_lines is defined
    - kernelopts.stdout_lines | length &gt; 0
    - kernelopts.stdout | regex_search('^kernelopts=(?:.*\s)?pti=on(?:\s.*)?$', multiline=True)
      is none
  tags:
    - NIST-800-53-SI-16
    - grub2_pti_argument
    - high_severity
    - low_disruption
    - medium_complexity
    - reboot_required
    - restrict_strategy
</fix>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref name="oval:ssg-grub2_pti_argument:def:1" href="ssg-fedora-oval.xml"/>
        </check>
        <check system="http://scap.nist.gov/schema/ocil/2">
          <check-content-ref name="ocil:ssg-grub2_pti_argument_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
        </check>
      </Rule>
      <Group id="xccdf_org.ssgproject.content_group_uefi">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">UEFI GRUB2 bootloader configuration</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">UEFI GRUB2 bootloader configuration</description>
        <platform idref="cpe:/a:uefi"/>
        <Rule id="xccdf_org.ssgproject.content_rule_file_permissions_efi_grub2_cfg" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Verify the UEFI Boot Loader grub.cfg Permissions</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">File permissions for <html:code xmlns:html="http://www.w3.org/1999/xhtml">/boot/efi/EFI/fedora/grub.cfg</html:code> should be set to 700.

To properly set the permissions of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/boot/efi/EFI/fedora/grub.cfg</html:code>, run the command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo chmod 700 /boot/efi/EFI/fedora/grub.cfg</html:pre></description>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.4.5</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-000225</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.10.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.11.1.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.11.1.5</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.11.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.1.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.2.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.6.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.7.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.7.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.7.3.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.8.2.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.8.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.5</reference>
          <reference href="https://www.cisecurity.org/controls/">12</reference>
          <reference href="https://www.cisecurity.org/controls/">13</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">16</reference>
          <reference href="https://www.cisecurity.org/controls/">18</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">5</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Proper permissions ensure that only the root user can modify important boot
parameters.</rationale>
          <platform idref="cpe:/a:machine"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_permissions_efi_grub2_cfg" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="configure"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

chmod 0700 /boot/efi/EFI/fedora/grub.cfg

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_permissions_efi_grub2_cfg" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: Test for existence /boot/efi/EFI/fedora/grub.cfg
  stat:
    path: /boot/efi/EFI/fedora/grub.cfg
  register: file_exists
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.4.5
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - configure_strategy
    - file_permissions_efi_grub2_cfg
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Ensure permission 0700 on /boot/efi/EFI/fedora/grub.cfg
  file:
    path: /boot/efi/EFI/fedora/grub.cfg
    mode: '0700'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - file_exists.stat is defined and file_exists.stat.exists
  tags:
    - NIST-800-171-3.4.5
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - configure_strategy
    - file_permissions_efi_grub2_cfg
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-file_permissions_efi_grub2_cfg:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-file_permissions_efi_grub2_cfg_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_grub2_uefi_password" selected="false" role="full" severity="high">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Set the UEFI Boot Loader Password</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The grub2 boot loader should have a superuser account and password
protection enabled to protect boot-time settings.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Since plaintext passwords are a security risk, generate a hash for the password
by running the following command:

<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ grub2-setpassword</html:pre>

When prompted, enter the password that was selected.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>

Once the superuser password has been added,
update the
<html:code xmlns:html="http://www.w3.org/1999/xhtml">grub.cfg</html:code> file by running:

<html:pre xmlns:html="http://www.w3.org/1999/xhtml">grub2-mkconfig -o /boot/efi/EFI/redhat/grub.cfg</html:pre></description>
          <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">To prevent hard-coded passwords, automatic remediation of this control is not available. Remediation
must be automated as a component of machine provisioning, or followed manually as outlined above.

Also, do NOT manually add the superuser account and password to the
<html:code xmlns:html="http://www.w3.org/1999/xhtml">grub.cfg</html:code> file as the grub2-mkconfig command overwrites this file.</warning>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.4.5</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-000213</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(B)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(7)(i)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(7)(ii)(A)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(1)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(i)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(ii)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(iii)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(c)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(1)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(2)(iii)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
          <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FIA_UAU.1</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000080-GPOS-00048</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.11</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.12</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.2.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.06</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.6.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.7.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.5</reference>
          <reference href="https://www.cisecurity.org/controls/">11</reference>
          <reference href="https://www.cisecurity.org/controls/">12</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">16</reference>
          <reference href="https://www.cisecurity.org/controls/">18</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">5</reference>
          <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R17)</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Password protection on the boot loader configuration ensures
users with physical access cannot trivially alter
important bootloader settings. These include which kernel to use,
and whether to enter single-user mode.</rationale>
          <platform idref="cpe:/a:machine"/>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-grub2_uefi_password:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-grub2_uefi_password_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_file_owner_efi_grub2_cfg" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Verify the UEFI Boot Loader grub.cfg User Ownership</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The file <html:code xmlns:html="http://www.w3.org/1999/xhtml">/boot/efi/EFI/fedora/grub.cfg</html:code> should
be owned by the <html:code xmlns:html="http://www.w3.org/1999/xhtml">root</html:code> user to prevent destruction
or modification of the file.

To properly set the owner of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/boot/efi/EFI/fedora/grub.cfg</html:code>, run the command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo chown root /boot/efi/EFI/fedora/grub.cfg </html:pre></description>
          <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.2.2</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.4.5</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-000225</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</reference>
          <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-7.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.10.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.11.1.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.11.1.5</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.11.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.1.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.2.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.6.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.7.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.7.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.7.3.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.8.2.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.8.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.5</reference>
          <reference href="https://www.cisecurity.org/controls/">12</reference>
          <reference href="https://www.cisecurity.org/controls/">13</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">16</reference>
          <reference href="https://www.cisecurity.org/controls/">18</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">5</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Only root should be able to modify important boot parameters.</rationale>
          <platform idref="cpe:/a:machine"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_owner_efi_grub2_cfg" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="configure"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

chown 0 /boot/efi/EFI/fedora/grub.cfg

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_owner_efi_grub2_cfg" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: Test for existence /boot/efi/EFI/fedora/grub.cfg
  stat:
    path: /boot/efi/EFI/fedora/grub.cfg
  register: file_exists
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.5.2.2
    - NIST-800-171-3.4.5
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-7.1
    - configure_strategy
    - file_owner_efi_grub2_cfg
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Ensure owner 0 on /boot/efi/EFI/fedora/grub.cfg
  file:
    path: /boot/efi/EFI/fedora/grub.cfg
    owner: '0'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - file_exists.stat is defined and file_exists.stat.exists
  tags:
    - CJIS-5.5.2.2
    - NIST-800-171-3.4.5
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-7.1
    - configure_strategy
    - file_owner_efi_grub2_cfg
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-file_owner_efi_grub2_cfg:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-file_owner_efi_grub2_cfg_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_grub2_uefi_admin_username" selected="false" role="full" severity="low">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Set the UEFI Boot Loader Admin Username to a Non-Default Value</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The grub2 boot loader should have a superuser account and password
protection enabled to protect boot-time settings.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
To maximize the protection, select a password-protected superuser account with unique name, and modify the
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/grub.d/01_users</html:code> configuration file to reflect the account name change.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
It is highly suggested not to use common administrator account names like root,
admin, or administrator for the grub2 superuser account.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Change the superuser to a different username (The default is 'root').
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sed -i 's/\(set superuser=\).*/\1"&lt;unique user ID&gt;"/g' /etc/grub.d/01_users</html:pre>
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Once the superuser account has been added,
update the
<html:code xmlns:html="http://www.w3.org/1999/xhtml">grub.cfg</html:code> file by running:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">grub2-mkconfig -o /boot/efi/EFI/redhat/grub.cfg</html:pre></description>
          <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">To prevent hard-coded admin usernames, automatic remediation of this control is not available. Remediation
must be automated as a component of machine provisioning, or followed manually as outlined above.

Also, do NOT manually add the superuser account and password to the
<html:code xmlns:html="http://www.w3.org/1999/xhtml">grub.cfg</html:code> file as the grub2-mkconfig command overwrites this file.</warning>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.4.5</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-000213</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(B)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(7)(i)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(7)(ii)(A)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(1)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(i)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(ii)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(iii)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(c)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(1)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(2)(iii)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
          <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FIA_UAU.1</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000080-GPOS-00048</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.11</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.12</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.2.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.06</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.6.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.7.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.5</reference>
          <reference href="https://www.cisecurity.org/controls/">11</reference>
          <reference href="https://www.cisecurity.org/controls/">12</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">16</reference>
          <reference href="https://www.cisecurity.org/controls/">18</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">5</reference>
          <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R17)</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Having a non-default grub superuser username makes password-guessing attacks less effective.</rationale>
          <platform idref="cpe:/a:machine"/>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-grub2_uefi_admin_username:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-grub2_uefi_admin_username_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_file_groupowner_efi_grub2_cfg" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Verify the UEFI Boot Loader grub.cfg Group Ownership</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The file <html:code xmlns:html="http://www.w3.org/1999/xhtml">/boot/efi/EFI/fedora/grub.cfg</html:code> should
be group-owned by the <html:code xmlns:html="http://www.w3.org/1999/xhtml">root</html:code> group to prevent
destruction or modification of the file.

To properly set the group owner of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/boot/efi/EFI/fedora/grub.cfg</html:code>, run the command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo chgrp root /boot/efi/EFI/fedora/grub.cfg</html:pre></description>
          <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.2.2</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.4.5</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-000225</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</reference>
          <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-7.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.10.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.11.1.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.11.1.5</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.11.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.1.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.2.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.6.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.7.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.7.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.7.3.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.8.2.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.8.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.5</reference>
          <reference href="https://www.cisecurity.org/controls/">12</reference>
          <reference href="https://www.cisecurity.org/controls/">13</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">16</reference>
          <reference href="https://www.cisecurity.org/controls/">18</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">5</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">root</html:code> group is a highly-privileged group. Furthermore, the group-owner of this
file should not have any access privileges anyway.</rationale>
          <platform idref="cpe:/a:machine"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_groupowner_efi_grub2_cfg" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="configure"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

chgrp 0 /boot/efi/EFI/fedora/grub.cfg

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_groupowner_efi_grub2_cfg" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: Test for existence /boot/efi/EFI/fedora/grub.cfg
  stat:
    path: /boot/efi/EFI/fedora/grub.cfg
  register: file_exists
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.5.2.2
    - NIST-800-171-3.4.5
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-7.1
    - configure_strategy
    - file_groupowner_efi_grub2_cfg
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Ensure group owner 0 on /boot/efi/EFI/fedora/grub.cfg
  file:
    path: /boot/efi/EFI/fedora/grub.cfg
    group: '0'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - file_exists.stat is defined and file_exists.stat.exists
  tags:
    - CJIS-5.5.2.2
    - NIST-800-171-3.4.5
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-7.1
    - configure_strategy
    - file_groupowner_efi_grub2_cfg
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-file_groupowner_efi_grub2_cfg:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-file_groupowner_efi_grub2_cfg_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
      </Group>
      <Group id="xccdf_org.ssgproject.content_group_non-uefi">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Non-UEFI GRUB2 bootloader configuration</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Non-UEFI GRUB2 bootloader configuration</description>
        <platform idref="cpe:/a:non-uefi"/>
        <Rule id="xccdf_org.ssgproject.content_rule_grub2_password" selected="false" role="full" severity="high">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Set Boot Loader Password in grub2</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The grub2 boot loader should have a superuser account and password
protection enabled to protect boot-time settings.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Since plaintext passwords are a security risk, generate a hash for the password
by running the following command:

<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ grub2-setpassword</html:pre>

When prompted, enter the password that was selected.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>

<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Once the superuser password has been added,
update the
<html:code xmlns:html="http://www.w3.org/1999/xhtml">grub.cfg</html:code> file by running:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">grub2-mkconfig -o /boot/grub2/grub.cfg</html:pre></description>
          <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">To prevent hard-coded passwords, automatic remediation of this control is not available. Remediation
must be automated as a component of machine provisioning, or followed manually as outlined above.

Also, do NOT manually add the superuser account and password to the
<html:code xmlns:html="http://www.w3.org/1999/xhtml">grub.cfg</html:code> file as the grub2-mkconfig command overwrites this file.</warning>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.4.5</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-000213</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(B)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(7)(i)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(7)(ii)(A)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(1)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(i)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(ii)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(iii)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(c)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(1)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(2)(iii)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
          <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FIA_UAU.1</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000080-GPOS-00048</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.11</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.12</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.2.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.10</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.06</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.10</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.18.1.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.6.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.7.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.6</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.3.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.5</reference>
          <reference href="https://www.cisecurity.org/controls/">1</reference>
          <reference href="https://www.cisecurity.org/controls/">11</reference>
          <reference href="https://www.cisecurity.org/controls/">12</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">16</reference>
          <reference href="https://www.cisecurity.org/controls/">18</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">5</reference>
          <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R17)</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Password protection on the boot loader configuration ensures
users with physical access cannot trivially alter
important bootloader settings. These include which kernel to use,
and whether to enter single-user mode.</rationale>
          <platform idref="cpe:/a:machine"/>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-grub2_password:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-grub2_password_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_file_groupowner_grub2_cfg" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Verify /boot/grub2/grub.cfg Group Ownership</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The file <html:code xmlns:html="http://www.w3.org/1999/xhtml">/boot/grub2/grub.cfg</html:code> should
be group-owned by the <html:code xmlns:html="http://www.w3.org/1999/xhtml">root</html:code> group to prevent
destruction or modification of the file.

To properly set the group owner of <html:code xmlns:html="http://www.w3.org/1999/xhtml">{{{ grub2_boot_path }}}/grub.cfg</html:code>, run the command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo chgrp root {{{ grub2_boot_path }}}/grub.cfg</html:pre></description>
          <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.2.2</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.4.5</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-000225</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(B)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(7)(i)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(7)(ii)(A)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(1)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(i)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(ii)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(iii)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(c)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(1)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(2)(iii)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</reference>
          <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-7.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.10.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.11.1.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.11.1.5</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.11.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.1.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.2.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.6.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.7.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.7.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.7.3.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.8.2.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.8.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.5</reference>
          <reference href="https://www.cisecurity.org/controls/">12</reference>
          <reference href="https://www.cisecurity.org/controls/">13</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">16</reference>
          <reference href="https://www.cisecurity.org/controls/">18</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">5</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">root</html:code> group is a highly-privileged group. Furthermore, the group-owner of this
file should not have any access privileges anyway.</rationale>
          <platform idref="cpe:/a:machine"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_groupowner_grub2_cfg" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="configure"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

chgrp 0 /boot/grub2/grub.cfg

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_groupowner_grub2_cfg" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: Test for existence /boot/grub2/grub.cfg
  stat:
    path: /boot/grub2/grub.cfg
  register: file_exists
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.5.2.2
    - NIST-800-171-3.4.5
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-7.1
    - configure_strategy
    - file_groupowner_grub2_cfg
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Ensure group owner 0 on /boot/grub2/grub.cfg
  file:
    path: /boot/grub2/grub.cfg
    group: '0'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - file_exists.stat is defined and file_exists.stat.exists
  tags:
    - CJIS-5.5.2.2
    - NIST-800-171-3.4.5
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-7.1
    - configure_strategy
    - file_groupowner_grub2_cfg
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-file_groupowner_grub2_cfg:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-file_groupowner_grub2_cfg_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_file_owner_grub2_cfg" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Verify /boot/grub2/grub.cfg User Ownership</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The file <html:code xmlns:html="http://www.w3.org/1999/xhtml">/boot/grub2/grub.cfg</html:code> should
be owned by the <html:code xmlns:html="http://www.w3.org/1999/xhtml">root</html:code> user to prevent destruction
or modification of the file.

To properly set the owner of <html:code xmlns:html="http://www.w3.org/1999/xhtml">{{{ grub2_boot_path }}}/grub.cfg</html:code>, run the command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo chown root {{{ grub2_boot_path }}}/grub.cfg </html:pre></description>
          <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.2.2</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.4.5</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-000225</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(B)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(7)(i)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(7)(ii)(A)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(1)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(i)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(ii)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(iii)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(c)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(1)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(2)(iii)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</reference>
          <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-7.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.10.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.11.1.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.11.1.5</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.11.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.1.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.2.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.6.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.7.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.7.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.7.3.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.8.2.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.8.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.5</reference>
          <reference href="https://www.cisecurity.org/controls/">12</reference>
          <reference href="https://www.cisecurity.org/controls/">13</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">16</reference>
          <reference href="https://www.cisecurity.org/controls/">18</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">5</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Only root should be able to modify important boot parameters.</rationale>
          <platform idref="cpe:/a:machine"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_owner_grub2_cfg" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="configure"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

chown 0 /boot/grub2/grub.cfg

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_owner_grub2_cfg" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: Test for existence /boot/grub2/grub.cfg
  stat:
    path: /boot/grub2/grub.cfg
  register: file_exists
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.5.2.2
    - NIST-800-171-3.4.5
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-7.1
    - configure_strategy
    - file_owner_grub2_cfg
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Ensure owner 0 on /boot/grub2/grub.cfg
  file:
    path: /boot/grub2/grub.cfg
    owner: '0'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - file_exists.stat is defined and file_exists.stat.exists
  tags:
    - CJIS-5.5.2.2
    - NIST-800-171-3.4.5
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-7.1
    - configure_strategy
    - file_owner_grub2_cfg
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-file_owner_grub2_cfg:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-file_owner_grub2_cfg_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_file_permissions_grub2_cfg" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Verify /boot/grub2/grub.cfg Permissions</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">File permissions for <html:code xmlns:html="http://www.w3.org/1999/xhtml">/boot/grub2/grub.cfg</html:code> should be set to 600.

To properly set the permissions of <html:code xmlns:html="http://www.w3.org/1999/xhtml">{{{ grub2_boot_path }}}/grub.cfg</html:code>, run the command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo chmod 600 {{{ grub2_boot_path }}}/grub.cfg</html:pre></description>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.4.5</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-000225</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(B)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(7)(i)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(7)(ii)(A)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(1)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(i)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(ii)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(iii)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(c)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(1)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(2)(iii)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.10.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.11.1.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.11.1.5</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.11.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.1.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.2.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.6.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.7.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.7.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.7.3.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.8.2.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.8.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.5</reference>
          <reference href="https://www.cisecurity.org/controls/">12</reference>
          <reference href="https://www.cisecurity.org/controls/">13</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">16</reference>
          <reference href="https://www.cisecurity.org/controls/">18</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">5</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Proper permissions ensure that only the root user can modify important boot
parameters.</rationale>
          <platform idref="cpe:/a:machine"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_permissions_grub2_cfg" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="configure"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

chmod 0600 /boot/grub2/grub.cfg

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_permissions_grub2_cfg" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: Test for existence /boot/grub2/grub.cfg
  stat:
    path: /boot/grub2/grub.cfg
  register: file_exists
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.4.5
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - configure_strategy
    - file_permissions_grub2_cfg
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Ensure permission 0600 on /boot/grub2/grub.cfg
  file:
    path: /boot/grub2/grub.cfg
    mode: '0600'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - file_exists.stat is defined and file_exists.stat.exists
  tags:
    - NIST-800-171-3.4.5
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - configure_strategy
    - file_permissions_grub2_cfg
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-file_permissions_grub2_cfg:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-file_permissions_grub2_cfg_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_grub2_admin_username" selected="false" role="full" severity="low">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Set the Boot Loader Admin Username to a Non-Default Value</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The grub2 boot loader should have a superuser account and password
protection enabled to protect boot-time settings.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
To maximize the protection, select a password-protected superuser account with unique name, and modify the
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/grub.d/01_users</html:code> configuration file to reflect the account name change.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Do not to use common administrator account names like root,
admin, or administrator for the grub2 superuser account.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Change the superuser to a different username (The default is 'root').
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sed -i 's/\(set superuser=\).*/\1"&lt;unique user ID&gt;"/g' /etc/grub.d/01_users</html:pre>
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Once the superuser account has been added,
update the
<html:code xmlns:html="http://www.w3.org/1999/xhtml">grub.cfg</html:code> file by running:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">grub2-mkconfig -o /boot/grub2/grub.cfg</html:pre></description>
          <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">To prevent hard-coded admin usernames, automatic remediation of this control is not available. Remediation
must be automated as a component of machine provisioning, or followed manually as outlined above.

Also, do NOT manually add the superuser account and password to the
<html:code xmlns:html="http://www.w3.org/1999/xhtml">grub.cfg</html:code> file as the grub2-mkconfig command overwrites this file.</warning>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.4.5</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-000213</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(B)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(7)(i)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(7)(ii)(A)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(1)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(i)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(ii)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(iii)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(c)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(1)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(2)(iii)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
          <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FIA_UAU.1</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000080-GPOS-00048</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.11</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.12</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.2.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.10</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.06</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.10</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.18.1.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.6.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.7.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.6</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.3.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.5</reference>
          <reference href="https://www.cisecurity.org/controls/">1</reference>
          <reference href="https://www.cisecurity.org/controls/">11</reference>
          <reference href="https://www.cisecurity.org/controls/">12</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">16</reference>
          <reference href="https://www.cisecurity.org/controls/">18</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">5</reference>
          <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R17)</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Having a non-default grub superuser username makes password-guessing attacks less effective.</rationale>
          <platform idref="cpe:/a:machine"/>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-grub2_admin_username:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-grub2_admin_username_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
      </Group>
    </Group>
    <Group id="xccdf_org.ssgproject.content_group_bootloader-zipl">
      <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">zIPL bootloader configuration</title>
      <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">During the boot process, the bootloader is
responsible for starting the execution of the kernel and passing
options to it.
The default Fedora boot loader for s390x systems is called zIPL.</description>
      <platform idref="cpe:/a:zipl"/>
    </Group>
  </Group>
  <Group id="xccdf_org.ssgproject.content_group_services">
    <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Services</title>
    <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The best protection against vulnerable software is running less software. This section describes how to review
the software which Fedora installs on a system and disable software which is not needed. It
then enumerates the software packages installed on a default Fedora system and provides guidance about which
ones can be safely disabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Fedora provides a convenient minimal install option that essentially installs the bare necessities for a functional
system. When building Fedora systems, it is highly recommended to select the minimal packages and then build up
the system from there.</description>
    <Group id="xccdf_org.ssgproject.content_group_cron_and_at">
      <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Cron and At Daemons</title>
      <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The cron and at services are used to allow commands to
be executed at a later time. The cron service is required by almost
all systems to perform necessary maintenance tasks, while at may or
may not be required on a given system. Both daemons should be
configured defensively.</description>
      <platform idref="cpe:/a:machine"/>
      <Rule id="xccdf_org.ssgproject.content_rule_package_cron_installed" selected="false" role="full" severity="medium">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Install the cron service</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The Cron service should be installed.</description>
        <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R50)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.11</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.12</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.6</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.2</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.3</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.4</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.5</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.7</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.3</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.4</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.5</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.6</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.7</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.2</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.3</reference>
        <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
        <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
        <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
        <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS06.06</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.12.1.2</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.12.5.1</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.12.6.2</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.14.2.2</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.14.2.3</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.14.2.4</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
        <reference href="https://www.cisecurity.org/controls/">11</reference>
        <reference href="https://www.cisecurity.org/controls/">14</reference>
        <reference href="https://www.cisecurity.org/controls/">3</reference>
        <reference href="https://www.cisecurity.org/controls/">9</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
        <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The cron service allow periodic job execution, needed for almost all administrative tasks and services (software update, log rotating, etc.). Access to cron service should be restricted to administrative accounts only.</rationale>
        <platform idref="cpe:/a:machine"/>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_cron_installed" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="enable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

if ! rpm -q --quiet "cron" ; then
    dnf install -y "cron"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_cron_installed" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="enable">- name: Ensure cron is installed
  package:
    name: cron
    state: present
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-CM-6(a)
    - enable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - package_cron_installed
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_cron_installed" system="urn:xccdf:fix:script:puppet" complexity="low" disruption="low" strategy="enable">include install_cron

class install_cron {
  package { 'cron':
    ensure =&gt; 'installed',
  }
}
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_cron_installed" system="urn:redhat:anaconda:pre" complexity="low" disruption="low" strategy="enable">
package --add=cron
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_cron_installed" system="urn:redhat:osbuild:blueprint">
[[packages]]
name = "cron"
version = "*"
</fix>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref name="oval:ssg-package_cron_installed:def:1" href="ssg-fedora-oval.xml"/>
        </check>
      </Rule>
      <Rule id="xccdf_org.ssgproject.content_rule_service_cron_enabled" selected="false" role="full" severity="medium">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Enable cron Service</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">crond</html:code> service is used to execute commands at
preconfigured times. It is required by almost all systems to perform necessary
maintenance tasks, such as notifying root of system activity.

The <html:code xmlns:html="http://www.w3.org/1999/xhtml">cron</html:code> service can be enabled with the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo systemctl enable cron.service</html:pre></description>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.11</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.12</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.6</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.2</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.3</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.4</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.5</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.7</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.3</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.4</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.5</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.6</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.7</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.2</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.3</reference>
        <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
        <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
        <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
        <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS06.06</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.12.1.2</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.12.5.1</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.12.6.2</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.14.2.2</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.14.2.3</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.14.2.4</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
        <reference href="https://www.cisecurity.org/controls/">11</reference>
        <reference href="https://www.cisecurity.org/controls/">14</reference>
        <reference href="https://www.cisecurity.org/controls/">3</reference>
        <reference href="https://www.cisecurity.org/controls/">9</reference>
        <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Due to its usage for maintenance and security-supporting tasks,
enabling the cron daemon is essential.</rationale>
        <platform idref="cpe:/a:machine"/>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="service_cron_enabled" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="enable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

SYSTEMCTL_EXEC='/usr/bin/systemctl'
"$SYSTEMCTL_EXEC" unmask 'cron.service'
"$SYSTEMCTL_EXEC" start 'cron.service'
"$SYSTEMCTL_EXEC" enable 'cron.service'

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="service_cron_enabled" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="enable">- name: Enable service cron
  block:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: Enable service cron
      service:
        name: cron
        enabled: 'yes'
        state: started
        masked: 'no'
      when:
        - '"cron" in ansible_facts.packages'
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-CM-6(a)
    - enable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - service_cron_enabled
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="service_cron_enabled" system="urn:xccdf:fix:script:puppet" complexity="low" disruption="low" strategy="enable">include enable_cron

class enable_cron {
  service {'cron':
    enable =&gt; true,
    ensure =&gt; 'running',
  }
}
</fix>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref name="oval:ssg-service_cron_enabled:def:1" href="ssg-fedora-oval.xml"/>
        </check>
        <check system="http://scap.nist.gov/schema/ocil/2">
          <check-content-ref name="ocil:ssg-service_cron_enabled_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
        </check>
      </Rule>
      <Rule id="xccdf_org.ssgproject.content_rule_service_crond_enabled" selected="false" role="full" severity="medium">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Enable cron Service</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">crond</html:code> service is used to execute commands at
preconfigured times. It is required by almost all systems to perform necessary
maintenance tasks, such as notifying root of system activity.

The <html:code xmlns:html="http://www.w3.org/1999/xhtml">crond</html:code> service can be enabled with the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo systemctl enable crond.service</html:pre></description>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(4)(i)</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(1)</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(3)</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(1)</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(2)(ii)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.11</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.12</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.6</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.2</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.3</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.4</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.5</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.7</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.3</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.4</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.5</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.6</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.7</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.2</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.3</reference>
        <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
        <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
        <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
        <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS06.06</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.12.1.2</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.12.5.1</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.12.6.2</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.14.2.2</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.14.2.3</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.14.2.4</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
        <reference href="https://www.cisecurity.org/controls/">11</reference>
        <reference href="https://www.cisecurity.org/controls/">14</reference>
        <reference href="https://www.cisecurity.org/controls/">3</reference>
        <reference href="https://www.cisecurity.org/controls/">9</reference>
        <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Due to its usage for maintenance and security-supporting tasks,
enabling the cron daemon is essential.</rationale>
        <platform idref="cpe:/a:machine"/>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="service_crond_enabled" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="enable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

SYSTEMCTL_EXEC='/usr/bin/systemctl'
"$SYSTEMCTL_EXEC" unmask 'crond.service'
"$SYSTEMCTL_EXEC" start 'crond.service'
"$SYSTEMCTL_EXEC" enable 'crond.service'

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="service_crond_enabled" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="enable">- name: Enable service crond
  block:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: Enable service crond
      service:
        name: crond
        enabled: 'yes'
        state: started
        masked: 'no'
      when:
        - '"cronie" in ansible_facts.packages'
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-CM-6(a)
    - enable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - service_crond_enabled
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="service_crond_enabled" system="urn:xccdf:fix:script:puppet" complexity="low" disruption="low" strategy="enable">include enable_crond

class enable_crond {
  service {'crond':
    enable =&gt; true,
    ensure =&gt; 'running',
  }
}
</fix>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref name="oval:ssg-service_crond_enabled:def:1" href="ssg-fedora-oval.xml"/>
        </check>
        <check system="http://scap.nist.gov/schema/ocil/2">
          <check-content-ref name="ocil:ssg-service_crond_enabled_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
        </check>
      </Rule>
      <Rule id="xccdf_org.ssgproject.content_rule_service_atd_disabled" selected="false" role="full" severity="medium">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable At Service (atd)</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">at</html:code> and <html:code xmlns:html="http://www.w3.org/1999/xhtml">batch</html:code> commands can be used to
schedule tasks that are meant to be executed only once. This allows delayed
execution in a manner similar to cron, except that it is not
recurring. The daemon <html:code xmlns:html="http://www.w3.org/1999/xhtml">atd</html:code> keeps track of tasks scheduled via
<html:code xmlns:html="http://www.w3.org/1999/xhtml">at</html:code> and <html:code xmlns:html="http://www.w3.org/1999/xhtml">batch</html:code>, and executes them at the specified time.

The <html:code xmlns:html="http://www.w3.org/1999/xhtml">atd</html:code> service can be disabled with the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo systemctl mask --now atd.service</html:pre></description>
        <reference href="https://public.cyber.mil/stigs/cci/">CCI-000381</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.11</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.12</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.6</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.2</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.3</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.4</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.5</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.7</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.3</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.4</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.5</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.6</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.7</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.2</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.3</reference>
        <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
        <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
        <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
        <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS06.06</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.12.1.2</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.12.5.1</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.12.6.2</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.14.2.2</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.14.2.3</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.14.2.4</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
        <reference href="https://www.cisecurity.org/controls/">11</reference>
        <reference href="https://www.cisecurity.org/controls/">14</reference>
        <reference href="https://www.cisecurity.org/controls/">3</reference>
        <reference href="https://www.cisecurity.org/controls/">9</reference>
        <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">atd</html:code> service could be used by an unsophisticated insider to carry
out activities outside of a normal login session, which could complicate
accountability. Furthermore, the need to schedule tasks with <html:code xmlns:html="http://www.w3.org/1999/xhtml">at</html:code> or
<html:code xmlns:html="http://www.w3.org/1999/xhtml">batch</html:code> is not common.</rationale>
        <platform idref="cpe:/a:machine"/>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="service_atd_disabled" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

SYSTEMCTL_EXEC='/usr/bin/systemctl'
"$SYSTEMCTL_EXEC" stop 'atd.service'
"$SYSTEMCTL_EXEC" disable 'atd.service'
"$SYSTEMCTL_EXEC" mask 'atd.service'
# Disable socket activation if we have a unit file for it
if "$SYSTEMCTL_EXEC" list-unit-files | grep -q '^atd.socket'; then
    "$SYSTEMCTL_EXEC" stop 'atd.socket'
    "$SYSTEMCTL_EXEC" mask 'atd.socket'
fi
# The service may not be running because it has been started and failed,
# so let's reset the state so OVAL checks pass.
# Service should be 'inactive', not 'failed' after reboot though.
"$SYSTEMCTL_EXEC" reset-failed 'atd.service' || true

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="service_atd_disabled" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="disable">- name: Disable service atd
  block:

    - name: Gather the service facts
      service_facts: null

    - name: Disable service atd
      systemd:
        name: atd.service
        enabled: 'no'
        state: stopped
        masked: 'yes'
      when: '"atd.service" in ansible_facts.services'
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - disable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - service_atd_disabled

- name: Unit Socket Exists - atd.socket
  command: systemctl list-unit-files atd.socket
  args:
    warn: false
  register: socket_file_exists
  changed_when: false
  ignore_errors: true
  check_mode: false
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - disable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - service_atd_disabled

- name: Disable socket atd
  systemd:
    name: atd.socket
    enabled: 'no'
    state: stopped
    masked: 'yes'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - '"atd.socket" in socket_file_exists.stdout_lines[1]'
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - disable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - service_atd_disabled
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="service_atd_disabled" system="urn:xccdf:fix:script:puppet" complexity="low" disruption="low" strategy="enable">include disable_atd

class disable_atd {
  service {'atd':
    enable =&gt; false,
    ensure =&gt; 'stopped',
  }
}
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="service_atd_disabled" system="urn:xccdf:fix:script:kubernetes" reboot="true" complexity="low" disruption="medium" strategy="disable">apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    systemd:
      units:
      - name: atd.service
        enabled: false
        mask: true
      - name: atd.socket
        enabled: false
        mask: true
</fix>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref name="oval:ssg-service_atd_disabled:def:1" href="ssg-fedora-oval.xml"/>
        </check>
        <check system="http://scap.nist.gov/schema/ocil/2">
          <check-content-ref name="ocil:ssg-service_atd_disabled_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
        </check>
      </Rule>
      <Rule id="xccdf_org.ssgproject.content_rule_disable_anacron" selected="false" role="full" severity="unknown">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable anacron Service</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">cronie-anacron</html:code> package, which provides <html:code xmlns:html="http://www.w3.org/1999/xhtml">anacron</html:code>
functionality, is installed by default. 
The <html:code xmlns:html="http://www.w3.org/1999/xhtml">cronie-anacron</html:code> package can be removed with the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">
$ sudo dnf erase cronie-anacron</html:pre></description>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.11</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.12</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.6</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.2</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.3</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.4</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.5</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.7</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.3</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.4</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.5</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.6</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.7</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.2</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.3</reference>
        <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
        <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
        <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
        <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS06.06</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.12.1.2</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.12.5.1</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.12.6.2</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.14.2.2</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.14.2.3</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.14.2.4</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
        <reference href="https://www.cisecurity.org/controls/">11</reference>
        <reference href="https://www.cisecurity.org/controls/">14</reference>
        <reference href="https://www.cisecurity.org/controls/">3</reference>
        <reference href="https://www.cisecurity.org/controls/">9</reference>
        <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">anacron</html:code> service provides <html:code xmlns:html="http://www.w3.org/1999/xhtml">cron</html:code> functionality for systems
such as laptops and workstations that may be shut down during the normal times
that <html:code xmlns:html="http://www.w3.org/1999/xhtml">cron</html:code> jobs are scheduled to run. On systems which do not require this
additional functionality, <html:code xmlns:html="http://www.w3.org/1999/xhtml">anacron</html:code> could needlessly increase the possible
attack surface for an intruder.</rationale>
        <platform idref="cpe:/a:machine"/>
        <check system="http://scap.nist.gov/schema/ocil/2">
          <check-content-ref name="ocil:ssg-disable_anacron_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
        </check>
      </Rule>
      <Group id="xccdf_org.ssgproject.content_group_restrict_at_cron_users">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Restrict at and cron to Authorized Users if Necessary</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/cron.allow</html:code> and <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/at.allow</html:code> files contain lists of
users who are allowed to use <html:code xmlns:html="http://www.w3.org/1999/xhtml">cron</html:code> and at to delay execution of
processes. If these files exist and if the corresponding files
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/cron.deny</html:code> and <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/at.deny</html:code> do not exist, then only users
listed in the relevant allow files can run the crontab and <html:code xmlns:html="http://www.w3.org/1999/xhtml">at</html:code> commands
to submit jobs to be run at scheduled intervals. On many systems, only the
system administrator needs the ability to schedule jobs. Note that even if a
given user is not listed in <html:code xmlns:html="http://www.w3.org/1999/xhtml">cron.allow</html:code>, cron jobs can still be run as
that user. The <html:code xmlns:html="http://www.w3.org/1999/xhtml">cron.allow</html:code> file controls only administrative access
to the crontab command for scheduling and modifying cron jobs.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
To restrict <html:code xmlns:html="http://www.w3.org/1999/xhtml">at</html:code> and <html:code xmlns:html="http://www.w3.org/1999/xhtml">cron</html:code> to only authorized users:
<html:ul xmlns:html="http://www.w3.org/1999/xhtml"><html:li>Remove the <html:code>cron.deny</html:code> file:<html:pre>$ sudo rm /etc/cron.deny</html:pre></html:li><html:li>Edit <html:code>/etc/cron.allow</html:code>, adding one line for each user allowed to use
the crontab command to create cron jobs.</html:li><html:li>Remove the <html:code>at.deny</html:code> file:<html:pre>$ sudo rm /etc/at.deny</html:pre></html:li><html:li>Edit <html:code>/etc/at.allow</html:code>, adding one line for each user allowed to use
the at command to create at jobs.</html:li></html:ul></description>
        <platform idref="cpe:/a:machine"/>
      </Group>
    </Group>
    <Group id="xccdf_org.ssgproject.content_group_mail">
      <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Mail Server Software</title>
      <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Mail servers are used to send and receive email over the network.
Mail is a very common service, and Mail Transfer Agents (MTAs) are obvious
targets of network attack.
Ensure that systems are not running MTAs unnecessarily,
and configure needed MTAs as defensively as possible.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Very few systems at any site should be configured to directly receive email over the
network. Users should instead use mail client programs to retrieve email
from a central server that supports protocols such as IMAP or POP3.
However, it is normal for most systems to be independently capable of sending email,
for instance so that cron jobs can report output to an administrator.
Most MTAs, including Postfix, support a submission-only mode in which mail can be sent from
the local system to a central site MTA (or directly delivered to a local account),
but the system still cannot receive mail directly over a network.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
The <html:code xmlns:html="http://www.w3.org/1999/xhtml">alternatives</html:code> program in Fedora permits selection of other mail server software
(such as Sendmail), but Postfix is the default and is preferred.
Postfix was coded with security in mind and can also be more effectively contained by
SELinux as its modular design has resulted in separate processes performing specific actions.
More information is available on its website, 
    <html:a xmlns:html="http://www.w3.org/1999/xhtml" href="http://www.postfix.org">http://www.postfix.org</html:a>.</description>
      <platform idref="cpe:/a:machine"/>
      <Rule id="xccdf_org.ssgproject.content_rule_package_sendmail_removed" selected="false" role="full" severity="medium">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Uninstall Sendmail Package</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Sendmail is not the default mail transfer agent and is
not installed by default.
The <html:code xmlns:html="http://www.w3.org/1999/xhtml">sendmail</html:code> package can be removed with the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">
$ sudo dnf erase sendmail</html:pre></description>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.11</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.12</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.6</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.2</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.3</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.4</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.5</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.7</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.3</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.4</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.5</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.6</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.7</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.2</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.3</reference>
        <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
        <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
        <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
        <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS06.06</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.12.1.2</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.12.5.1</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.12.6.2</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.14.2.2</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.14.2.3</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.14.2.4</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
        <reference href="https://www.cisecurity.org/controls/">11</reference>
        <reference href="https://www.cisecurity.org/controls/">14</reference>
        <reference href="https://www.cisecurity.org/controls/">3</reference>
        <reference href="https://www.cisecurity.org/controls/">9</reference>
        <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R1)</reference>
        <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
        <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000095-GPOS-00049</reference>
        <reference href="https://public.cyber.mil/stigs/cci/">CCI-000381</reference>
        <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The sendmail software was not developed with security in mind and
its design prevents it from being effectively contained by SELinux.  Postfix
should be used instead.</rationale>
        <platform idref="cpe:/a:machine"/>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_sendmail_removed" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

# CAUTION: This remediation script will remove sendmail
#	   from the system, and may remove any packages
#	   that depend on sendmail. Execute this
#	   remediation AFTER testing on a non-production
#	   system!

if rpm -q --quiet "sendmail" ; then
    dnf remove -y "sendmail"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_sendmail_removed" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="disable">- name: Ensure sendmail is removed
  package:
    name: sendmail
    state: absent
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - disable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - package_sendmail_removed
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_sendmail_removed" system="urn:xccdf:fix:script:puppet" complexity="low" disruption="low" strategy="disable">include remove_sendmail

class remove_sendmail {
  package { 'sendmail':
    ensure =&gt; 'purged',
  }
}
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_sendmail_removed" system="urn:redhat:anaconda:pre" complexity="low" disruption="low" strategy="disable">
package --remove=sendmail
</fix>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref name="oval:ssg-package_sendmail_removed:def:1" href="ssg-fedora-oval.xml"/>
        </check>
        <check system="http://scap.nist.gov/schema/ocil/2">
          <check-content-ref name="ocil:ssg-package_sendmail_removed_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
        </check>
      </Rule>
      <Group id="xccdf_org.ssgproject.content_group_postfix_client">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Configure SMTP For Mail Clients</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">This section discusses settings for Postfix in a submission-only
e-mail configuration.</description>
        <platform idref="cpe:/a:machine"/>
        <Value id="xccdf_org.ssgproject.content_value_var_postfix_inet_interfaces" type="string">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Postfix Network Interfaces</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The setting for inet_interfaces in /etc/postfix/main.cf</description>
          <value selector="loopback-only">loopback-only</value>
          <value>loopback-only</value>
          <value selector="localhost">localhost</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_postfix_relayhost" type="string">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Postfix relayhost</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Specify the host all outbound email should be routed into.</description>
          <value>smtp.$mydomain</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_postfix_root_mail_alias" type="string" interactive="true">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Postfix Root Mail Alias</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Specify an email address (string) for a root mail alias.</description>
          <value>system.administrator@mail.mil</value>
        </Value>
        <Rule id="xccdf_org.ssgproject.content_rule_postfix_client_configure_mail_alias" selected="false" role="full" severity="low">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Configure System to Forward All Mail For The Root Account</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Make sure that mails delivered to root user are forwarded to a monitored
email address. Make sure that the address
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_postfix_root_mail_alias" use="legacy"/> is a valid email address
reachable from the system in question. Use the following command to
configure the alias:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml" xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2">$ sudo echo "root: <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_postfix_root_mail_alias" use="legacy"/>" &gt;&gt; /etc/aliases
$ sudo newaliases</html:pre></description>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-000139</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000046-GPOS-00022</reference>
          <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R49)</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">A number of system services utilize email messages sent to the root user to
notify system administrators of active or impending issues.  These messages must
be forwarded to at least one monitored email address.</rationale>
          <platform idref="cpe:/a:machine"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="postfix_client_configure_mail_alias" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then


var_postfix_root_mail_alias="<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_postfix_root_mail_alias" use="legacy"/>"
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_replace_or_append" use="legacy"/>
replace_or_append '/etc/aliases' '^root' "$var_postfix_root_mail_alias" '' '%s: %s'

newaliases

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="postfix_client_configure_mail_alias" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: XCCDF Value var_postfix_root_mail_alias # promote to variable
  set_fact:
    var_postfix_root_mail_alias: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_postfix_root_mail_alias" use="legacy"/>
  tags:
    - always

- name: Make sure that that "/etc/aliases" has a defined value for root
  lineinfile:
    path: /etc/aliases
    line: 'root: {{ var_postfix_root_mail_alias }}'
    regexp: ^(?:[rR][oO][oO][tT]|"[rR][oO][oO][tT]")\s*:\s*(.+)$
    create: true
    state: present
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-CM-6(a)
    - configure_strategy
    - low_complexity
    - low_disruption
    - low_severity
    - no_reboot_needed
    - postfix_client_configure_mail_alias
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export export-name="oval:ssg-var_postfix_root_mail_alias:var:1" value-id="xccdf_org.ssgproject.content_value_var_postfix_root_mail_alias"/>
            <check-content-ref name="oval:ssg-postfix_client_configure_mail_alias:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-postfix_client_configure_mail_alias_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_postfix_client_configure_relayhost" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Configure System to Forward All Mail through a specific host</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Set up a relay host that will act as a gateway for all outbound email.
Edit the file <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/postfix/main.cf</html:code> to ensure that only the following
<html:code xmlns:html="http://www.w3.org/1999/xhtml">relayhost</html:code> line appears:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml" xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2">relayhost = <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_postfix_relayhost" use="legacy"/></html:pre></description>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">A central outbound email location ensures messages sent from any network host
can be audited for potential unexpected content.  Tooling on the central server
may help prevent spam or viruses from being delivered.</rationale>
          <platform idref="cpe:/a:machine"/>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-postfix_client_configure_relayhost_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
      </Group>
      <Group id="xccdf_org.ssgproject.content_group_postfix_harden_os">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Configure Operating System to Protect Mail Server</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The guidance in this section is appropriate for any host which is
operating as a site MTA, whether the mail server runs using Sendmail, Postfix,
or some other software.</description>
        <platform idref="cpe:/a:machine"/>
        <Group id="xccdf_org.ssgproject.content_group_postfix_configure_ssl_certs">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Configure SSL Certificates for Use with SMTP AUTH</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">If SMTP AUTH is to be used, the use of SSL to protect credentials in transit is strongly recommended.
There are also configurations for which it may be desirable to encrypt all mail in transit from one MTA to another,
though such configurations are beyond the scope of this guide. In either event, the steps for creating and installing
an SSL certificate are independent of the MTA in use, and are described here.</description>
          <platform idref="cpe:/a:machine"/>
          <Group id="xccdf_org.ssgproject.content_group_postfix_install_ssl_cert">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure Security of Postfix SSL Certificate</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Create the PKI directory for mail certificates, if it does not already exist:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo mkdir /etc/pki/tls/mail
$ sudo chown root:root /etc/pki/tls/mail
$ sudo chmod 755 /etc/pki/tls/mail</html:pre>
Using removable media or some other secure transmission format, install the files generated in the previous
step onto the mail server:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">/etc/pki/tls/mail/serverkey.pem: the private key mailserverkey.pem
/etc/pki/tls/mail/servercert.pem: the certificate file mailservercert.pem</html:pre>
Verify the ownership and permissions of these files:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo chown root:root /etc/pki/tls/mail/serverkey.pem
$ sudo chown root:root /etc/pki/tls/mail/servercert.pem
$ sudo chmod 600 /etc/pki/tls/mail/serverkey.pem
$ sudo chmod 644 /etc/pki/tls/mail/servercert.pem</html:pre>
Verify that the CA's public certificate file has been installed as <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/pki/tls/CA/cacert.pem</html:code>, and has the
correct permissions:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo chown root:root /etc/pki/tls/CA/cacert.pem
$ sudo chmod 644 /etc/pki/tls/CA/cacert.pem</html:pre></description>
            <platform idref="cpe:/a:machine"/>
          </Group>
        </Group>
        <Group id="xccdf_org.ssgproject.content_group_postfix_server_cfg">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Configure Postfix if Necessary</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Postfix stores its configuration files in the directory
/etc/postfix by default. The primary configuration file is
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/postfix/main.cf</html:code>.</description>
          <platform idref="cpe:/a:machine"/>
          <Group id="xccdf_org.ssgproject.content_group_postfix_server_relay">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Control Mail Relaying</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Postfix's mail relay controls are implemented with the help of the
smtpd recipient restrictions option, which controls the restrictions placed on
the SMTP dialogue once the sender and recipient envelope addresses are known.
The guidance in the following sections should be applied to all systems. If
there are systems which must be allowed to relay mail, but which cannot be
trusted to relay unconditionally, configure SMTP AUTH with SSL support.</description>
            <platform idref="cpe:/a:machine"/>
            <Group id="xccdf_org.ssgproject.content_group_postfix_server_relay_smtp_auth_for_untrusted">
              <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Require SMTP AUTH Before Relaying from Untrusted Clients</title>
              <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">SMTP authentication allows remote clients to relay mail safely by
requiring them to authenticate before submitting mail. Postfix's SMTP AUTH uses
an authentication library called SASL, which is not part of Postfix itself.  To
enable the use of SASL authentication, see

    <html:a xmlns:html="http://www.w3.org/1999/xhtml" href="http://www.postfix.org/SASL_README.html">http://www.postfix.org/SASL_README.html</html:a></description>
              <platform idref="cpe:/a:machine"/>
            </Group>
            <Group id="xccdf_org.ssgproject.content_group_postfix_server_mail_smtpd_recipient_restrictions">
              <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Enact SMTP Recipient Restrictions</title>
              <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To configure Postfix to restrict addresses to which it
will send mail, see:

    <html:a xmlns:html="http://www.w3.org/1999/xhtml" href="http://www.postfix.org/SMTPD_ACCESS_README.html#danger">http://www.postfix.org/SMTPD_ACCESS_README.html#danger</html:a>
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
The full contents of <html:code xmlns:html="http://www.w3.org/1999/xhtml">smtpd_recipient_restrictions</html:code> will
vary by site, since this is a common place to put spam restrictions and other
site-specific options. The <html:code xmlns:html="http://www.w3.org/1999/xhtml">permit_mynetworks</html:code> option allows all mail to
be relayed from the systems in <html:code xmlns:html="http://www.w3.org/1999/xhtml">mynetworks</html:code>. Then, the
<html:code xmlns:html="http://www.w3.org/1999/xhtml">reject_unauth_destination</html:code> option denies all mail whose destination
address is not local, preventing any other systems from relaying. These two
options should always appear in this order, and should usually follow one
another immediately unless SMTP AUTH is used.</description>
              <platform idref="cpe:/a:machine"/>
            </Group>
            <Group id="xccdf_org.ssgproject.content_group_postfix_server_relay_set_trusted">
              <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Configure Trusted Networks and Hosts</title>
              <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Edit <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/postfix/main.cf</html:code>, and configure the contents of
the <html:code xmlns:html="http://www.w3.org/1999/xhtml">mynetworks</html:code> variable in one of the following ways:
<html:ul xmlns:html="http://www.w3.org/1999/xhtml"><html:li>If any system in the subnet containing the MTA may be trusted to relay
messages, add or correct the following line:
<html:pre>mynetworks_style = subnet</html:pre>
This is also the default setting, and is in effect if all
<html:code>my_networks_style</html:code> directives are commented.</html:li><html:li>If only the MTA host itself is trusted to relay messages, add or correct
the following line:
<html:pre>mynetworks_style = host</html:pre></html:li><html:li>If the set of systems which can relay is more complicated, manually
specify an entry for each netblock or IP address which is trusted to relay by
setting the <html:code>mynetworks</html:code> variable directly:
<html:pre>mynetworks = 10.0.0.0/16, 192.168.1.0/24, 127.0.0.1</html:pre></html:li></html:ul></description>
              <platform idref="cpe:/a:machine"/>
            </Group>
            <Group id="xccdf_org.ssgproject.content_group_postfix_server_relay_require_tls">
              <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Use TLS for SMTP AUTH</title>
              <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Postfix provides options to use TLS for certificate-based
authentication and encrypted sessions. An encrypted session protects the
information that is transmitted with SMTP mail or with SASL authentication.
To configure Postfix to protect all SMTP AUTH transactions
using TLS, see 
    <html:a xmlns:html="http://www.w3.org/1999/xhtml" href="http://www.postfix.org/TLS_README.html">http://www.postfix.org/TLS_README.html</html:a>.</description>
              <platform idref="cpe:/a:machine"/>
            </Group>
            <Group id="xccdf_org.ssgproject.content_group_postfix_server_mail_smtpd_relay_restrictions">
              <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Enact SMTP Relay Restrictions</title>
              <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To configure Postfix to restrict addresses to which it
will send mail, see:

    <html:a xmlns:html="http://www.w3.org/1999/xhtml" href="http://www.postfix.org/SMTPD_ACCESS_README.html#danger">http://www.postfix.org/SMTPD_ACCESS_README.html#danger</html:a>
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
The full contents of <html:code xmlns:html="http://www.w3.org/1999/xhtml">smtpd_recipient_restrictions</html:code> will
vary by site, since this is a common place to put spam restrictions and other
site-specific options. The <html:code xmlns:html="http://www.w3.org/1999/xhtml">permit_mynetworks</html:code> option allows all mail to
be relayed from the systems in <html:code xmlns:html="http://www.w3.org/1999/xhtml">mynetworks</html:code>. Then, the
<html:code xmlns:html="http://www.w3.org/1999/xhtml">reject_unauth_destination</html:code> option denies all mail whose destination
address is not local, preventing any other systems from relaying. These two
options should always appear in this order, and should usually follow one
another immediately unless SMTP AUTH is used.</description>
              <platform idref="cpe:/a:machine"/>
            </Group>
          </Group>
          <Group id="xccdf_org.ssgproject.content_group_postfix_server_dos">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Configure Postfix Resource Usage to Limit Denial of Service Attacks</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Edit <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/postfix/main.cf</html:code>. Edit the following lines to
configure the amount of system resources Postfix can consume:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">default_process_limit = 100
smtpd_client_connection_count_limit = 10
smtpd_client_connection_rate_limit = 30
queue_minfree = 20971520
header_size_limit = 51200
message_size_limit = 10485760
smtpd_recipient_limit = 100</html:pre>
The values here are examples.</description>
            <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">Note: The values given here are examples, and may
need to be modified for any particular site. By default, the Postfix anvil
process gathers mail receipt statistics. To get information about about what
connection rates are typical at your site, look in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/var/log/maillog</html:code>
for lines with the daemon name postfix/anvil.</warning>
            <platform idref="cpe:/a:machine"/>
          </Group>
        </Group>
      </Group>
    </Group>
    <Group id="xccdf_org.ssgproject.content_group_snmp">
      <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">SNMP Server</title>
      <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The Simple Network Management Protocol allows
administrators to monitor the state of network devices, including
computers. Older versions of SNMP were well-known for weak
security, such as plaintext transmission of the community string
(used for authentication) and usage of easily-guessable
choices for the community string.</description>
      <Group id="xccdf_org.ssgproject.content_group_disabling_snmp_service">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable SNMP Server if Possible</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The system includes an SNMP daemon that allows for its remote
monitoring, though it not installed by default. If it was installed and
activated but is not needed, the software should be disabled and removed.</description>
        <Rule id="xccdf_org.ssgproject.content_rule_package_net-snmp_removed" selected="false" role="full" severity="unknown">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Uninstall net-snmp Package</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">net-snmp</html:code> package provides the snmpd service.
The <html:code xmlns:html="http://www.w3.org/1999/xhtml">net-snmp</html:code> package can be removed with the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">
$ sudo dnf erase net-snmp</html:pre></description>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">If there is no need to run SNMP server software,
removing the package provides a safeguard against its
activation.</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_net-snmp_removed" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="disable">
# CAUTION: This remediation script will remove net-snmp
#	   from the system, and may remove any packages
#	   that depend on net-snmp. Execute this
#	   remediation AFTER testing on a non-production
#	   system!

if rpm -q --quiet "net-snmp" ; then
    dnf remove -y "net-snmp"
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_net-snmp_removed" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="disable">- name: Ensure net-snmp is removed
  package:
    name: net-snmp
    state: absent
  tags:
    - disable_strategy
    - low_complexity
    - low_disruption
    - no_reboot_needed
    - package_net-snmp_removed
    - unknown_severity
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_net-snmp_removed" system="urn:xccdf:fix:script:puppet" complexity="low" disruption="low" strategy="disable">include remove_net-snmp

class remove_net-snmp {
  package { 'net-snmp':
    ensure =&gt; 'purged',
  }
}
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_net-snmp_removed" system="urn:redhat:anaconda:pre" complexity="low" disruption="low" strategy="disable">
package --remove=net-snmp
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-package_net-snmp_removed:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-package_net-snmp_removed_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
      </Group>
      <Group id="xccdf_org.ssgproject.content_group_snmp_configure_server">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Configure SNMP Server if Necessary</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">If it is necessary to run the snmpd agent on the system, some best
practices should be followed to minimize the security risk from the
installation. The multiple security models implemented by SNMP cannot be fully
covered here so only the following general configuration advice can be offered:
<html:ul xmlns:html="http://www.w3.org/1999/xhtml"><html:li>use only SNMP version 3 security models and enable the use of authentication and encryption</html:li><html:li>write access to the MIB (Management Information Base) should be allowed only if necessary</html:li><html:li>all access to the MIB should be restricted following a principle of least privilege</html:li><html:li>network access should be limited to the maximum extent possible including restricting to expected network
addresses both in the configuration files and in the system firewall rules</html:li><html:li>ensure SNMP agents send traps only to, and accept SNMP queries only from, authorized management
stations</html:li><html:li>ensure that permissions on the <html:code>snmpd.conf</html:code> configuration file (by default, in <html:code>/etc/snmp</html:code>) are 640 or more restrictive</html:li><html:li>ensure that any MIB files' permissions are also 640 or more restrictive</html:li></html:ul></description>
        <Value id="xccdf_org.ssgproject.content_value_var_snmpd_ro_string" type="string" interactive="true">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">SNMP read-only community string</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Specify the SNMP community string used for read-only access.</description>
          <value>changemero</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_snmpd_rw_string" type="string" interactive="true">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">SNMP read-write community string</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Specify the SNMP community string used for read-write access.</description>
          <value>changemerw</value>
        </Value>
        <Rule id="xccdf_org.ssgproject.content_rule_snmpd_no_rwusers" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure SNMP Read Write is disabled</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Edit <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/snmp/snmpd.conf</html:code>, remove any <html:code xmlns:html="http://www.w3.org/1999/xhtml">rwuser</html:code> entries.
Once the read write users have been removed, restart the SNMP service:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo service snmpd restart</html:pre></description>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Certain SNMP settings can permit users to execute system behaviors from user
writes to the community strings.
This may permit a compromised account to execute commands on a remote system.</rationale>
          <platform idref="cpe:/a:net-snmp"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="snmpd_no_rwusers" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q net-snmp; then

if grep -s "rwuser" /etc/snmp/snmpd.conf | grep -qv "^#"; then
	sed -i "/^\s*#/b;/rwuser/ s/^/#/" /etc/snmp/snmpd.conf
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-snmpd_no_rwusers_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_snmpd_not_default_password" selected="false" role="full" severity="high">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure Default SNMP Password Is Not Used</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Edit <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/snmp/snmpd.conf</html:code>, remove or change the default community strings of
<html:code xmlns:html="http://www.w3.org/1999/xhtml">public</html:code> and <html:code xmlns:html="http://www.w3.org/1999/xhtml">private</html:code>.
This profile configures new read-only community string to <html:code xmlns:html="http://www.w3.org/1999/xhtml" xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2"><xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_snmpd_ro_string" use="legacy"/></html:code> and read-write community string to <html:code xmlns:html="http://www.w3.org/1999/xhtml" xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2"><xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_snmpd_rw_string" use="legacy"/></html:code>.
Once the default community strings have been changed, restart the SNMP service:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo service snmpd restart</html:pre></description>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(e)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.2.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.10</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.10</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.18.1.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.7.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.6</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.3.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.3</reference>
          <reference href="https://www.cisecurity.org/controls/">1</reference>
          <reference href="https://www.cisecurity.org/controls/">12</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">16</reference>
          <reference href="https://www.cisecurity.org/controls/">5</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Whether active or not, default simple network management protocol (SNMP) community
strings must be changed to maintain security. If the service is running with the
default authenticators, then anyone can gather data about the system and the network
and use the information to potentially compromise the integrity of the system and
network(s).</rationale>
          <platform idref="cpe:/a:net-snmp"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="snmpd_not_default_password" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q net-snmp; then

#!/bin/bash


var_snmpd_ro_string="<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_snmpd_ro_string" use="legacy"/>"

var_snmpd_rw_string="<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_snmpd_rw_string" use="legacy"/>"



# remediate read-only community string
if grep -q 'public' /etc/snmp/snmpd.conf; then
    sed -i "s/public/$var_snmpd_ro_string/" /etc/snmp/snmpd.conf
fi

# remediate read-write community string
if grep -q 'private' /etc/snmp/snmpd.conf; then
    sed -i "s/private/$var_snmpd_rw_string/" /etc/snmp/snmpd.conf
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="snmpd_not_default_password" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="medium" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-53-IA-5(e)
    - configure_strategy
    - high_severity
    - low_complexity
    - medium_disruption
    - no_reboot_needed
    - snmpd_not_default_password
- name: XCCDF Value var_snmpd_ro_string # promote to variable
  set_fact:
    var_snmpd_ro_string: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_snmpd_ro_string" use="legacy"/>
  tags:
    - always
- name: XCCDF Value var_snmpd_rw_string # promote to variable
  set_fact:
    var_snmpd_rw_string: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_snmpd_rw_string" use="legacy"/>
  tags:
    - always

- name: Check if file /etc/snmp/snmpd.conf exists
  stat:
    path: /etc/snmp/snmpd.conf
  register: snmpd
  when: '"net-snmp" in ansible_facts.packages'
  tags:
    - NIST-800-53-IA-5(e)
    - configure_strategy
    - high_severity
    - low_complexity
    - medium_disruption
    - no_reboot_needed
    - snmpd_not_default_password

- name: Replace all instances of SNMP RO strings
  replace:
    path: /etc/snmp/snmpd.conf
    regexp: public
    replace: '{{ var_snmpd_ro_string }}'
  when:
    - '"net-snmp" in ansible_facts.packages'
    - (snmpd.stat.exists is defined and snmpd.stat.exists)
  tags:
    - NIST-800-53-IA-5(e)
    - configure_strategy
    - high_severity
    - low_complexity
    - medium_disruption
    - no_reboot_needed
    - snmpd_not_default_password

- name: Replace all instances of SNMP RW strings
  replace:
    path: /etc/snmp/snmpd.conf
    regexp: private
    replace: '{{ var_snmpd_rw_string }}'
  when:
    - '"net-snmp" in ansible_facts.packages'
    - (snmpd.stat.exists is defined and snmpd.stat.exists)
  tags:
    - NIST-800-53-IA-5(e)
    - configure_strategy
    - high_severity
    - low_complexity
    - medium_disruption
    - no_reboot_needed
    - snmpd_not_default_password
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-snmpd_not_default_password:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-snmpd_not_default_password_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_snmpd_use_newer_protocol" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Configure SNMP Service to Use Only SNMPv3 or Newer</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Edit <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/snmp/snmpd.conf</html:code>, removing any references to <html:code xmlns:html="http://www.w3.org/1999/xhtml">rocommunity</html:code>, <html:code xmlns:html="http://www.w3.org/1999/xhtml">rwcommunity</html:code>, or <html:code xmlns:html="http://www.w3.org/1999/xhtml">com2sec</html:code>.
Upon doing that, restart the SNMP service:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo service snmpd restart</html:pre></description>
          <reference href="">1311</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Earlier versions of SNMP are considered insecure, as they potentially allow
unauthorized access to detailed system management information.</rationale>
          <platform idref="cpe:/a:net-snmp"/>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-snmpd_use_newer_protocol:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-snmpd_use_newer_protocol_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
      </Group>
    </Group>
    <Group id="xccdf_org.ssgproject.content_group_routing">
      <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Network Routing</title>
      <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">A router is a very desirable target for a
potential adversary because they fulfill a variety of 
infrastructure networking roles such as access to network segments,
gateways to other networks, filtering, etc. Therefore, if one is
required, the system acting as a router should be dedicated
to that purpose alone and be stored in a physically secure
location. The system's default routing software is Quagga, and
provided in an RPM package of the same name.</description>
      <Group id="xccdf_org.ssgproject.content_group_disabling_quagga">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable Quagga if Possible</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">If Quagga was installed and activated, but the system
does not need to act as a router, then it should be disabled
and removed.</description>
      </Group>
    </Group>
    <Group id="xccdf_org.ssgproject.content_group_proxy">
      <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Proxy Server</title>
      <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">A proxy server is a very desirable target for a
potential adversary because much (or all) sensitive data for a
given infrastructure may flow through it. Therefore, if one is
required, the system acting as a proxy server should be dedicated
to that purpose alone and be stored in a physically secure
location. The system's default proxy server software is Squid, and
provided in an RPM package of the same name.</description>
      <Group id="xccdf_org.ssgproject.content_group_disabling_squid">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable Squid if Possible</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">If Squid was installed and activated, but the system
does not need to act as a proxy server, then it should be disabled
and removed.</description>
      </Group>
    </Group>
    <Group id="xccdf_org.ssgproject.content_group_radius">
      <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Remote Authentication Dial-In User Service (RADIUS)</title>
      <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Remote Authentication Dial-In User Service (RADIUS) is a networking
protocol, operating on port 1812 that provides centralized
Authentication, Authorization, and Accounting (AAA or Triple A)
management for users who connect and use a network service. </description>
    </Group>
    <Group id="xccdf_org.ssgproject.content_group_apport">
      <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Apport Service</title>
      <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The Apport service provides debugging and crash reporting
features on Ubuntu distributions.</description>
    </Group>
    <Group id="xccdf_org.ssgproject.content_group_deprecated">
      <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Deprecated services</title>
      <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Some deprecated software services impact the overall system security due to their behavior (leak of
confidentiality in network exchange, usage as uncontrolled communication channel, risk associated with the service due to its old age, etc.</description>
      <Rule id="xccdf_org.ssgproject.content_rule_package_inetutils-telnetd_removed" selected="false" role="full" severity="high">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Uninstall the inet-based telnet server</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The inet-based telnet daemon should be uninstalled.</description>
        <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">NT007(R03)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.11</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.12</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.6</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.2</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.3</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.4</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.5</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.7</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.5</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.3</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.3</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.3</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.4</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.5</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.6</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.7</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.2</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.3</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
        <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
        <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
        <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
        <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS01.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.03</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS06.06</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.11.2.6</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.12.1.2</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.12.5.1</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.12.6.2</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.14.2.2</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.14.2.3</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.14.2.4</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.6.2.1</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.6.2.2</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
        <reference href="https://www.cisecurity.org/controls/">11</reference>
        <reference href="https://www.cisecurity.org/controls/">12</reference>
        <reference href="https://www.cisecurity.org/controls/">14</reference>
        <reference href="https://www.cisecurity.org/controls/">15</reference>
        <reference href="https://www.cisecurity.org/controls/">3</reference>
        <reference href="https://www.cisecurity.org/controls/">8</reference>
        <reference href="https://www.cisecurity.org/controls/">9</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
        <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US"><html:code xmlns:html="http://www.w3.org/1999/xhtml">telnet</html:code> allows clear text communications, and does not protect any
data transmission between client and server. Any confidential data can be
listened and no integrity checking is made.</rationale>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_inetutils-telnetd_removed" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="disable">
# CAUTION: This remediation script will remove inetutils-telnetd
#	   from the system, and may remove any packages
#	   that depend on inetutils-telnetd. Execute this
#	   remediation AFTER testing on a non-production
#	   system!

if rpm -q --quiet "inetutils-telnetd" ; then
    dnf remove -y "inetutils-telnetd"
fi
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_inetutils-telnetd_removed" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="disable">- name: Ensure inetutils-telnetd is removed
  package:
    name: inetutils-telnetd
    state: absent
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - disable_strategy
    - high_severity
    - low_complexity
    - low_disruption
    - no_reboot_needed
    - package_inetutils-telnetd_removed
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_inetutils-telnetd_removed" system="urn:xccdf:fix:script:puppet" complexity="low" disruption="low" strategy="disable">include remove_inetutils-telnetd

class remove_inetutils-telnetd {
  package { 'inetutils-telnetd':
    ensure =&gt; 'purged',
  }
}
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_inetutils-telnetd_removed" system="urn:redhat:anaconda:pre" complexity="low" disruption="low" strategy="disable">
package --remove=inetutils-telnetd
</fix>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref name="oval:ssg-package_inetutils-telnetd_removed:def:1" href="ssg-fedora-oval.xml"/>
        </check>
      </Rule>
      <Rule id="xccdf_org.ssgproject.content_rule_package_nis_removed" selected="false" role="full" severity="low">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Uninstall the nis package</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The support for Yellowpages should not be installed unless it is required.</description>
        <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">NIS is the historical SUN service for central account management, more and more replaced by LDAP.
NIS does not support efficiently security constraints, ACL, etc. and should not be used.</rationale>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_nis_removed" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="disable">
# CAUTION: This remediation script will remove nis
#	   from the system, and may remove any packages
#	   that depend on nis. Execute this
#	   remediation AFTER testing on a non-production
#	   system!

if rpm -q --quiet "nis" ; then
    dnf remove -y "nis"
fi
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_nis_removed" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="disable">- name: Ensure nis is removed
  package:
    name: nis
    state: absent
  tags:
    - disable_strategy
    - low_complexity
    - low_disruption
    - low_severity
    - no_reboot_needed
    - package_nis_removed
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_nis_removed" system="urn:xccdf:fix:script:puppet" complexity="low" disruption="low" strategy="disable">include remove_nis

class remove_nis {
  package { 'nis':
    ensure =&gt; 'purged',
  }
}
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_nis_removed" system="urn:redhat:anaconda:pre" complexity="low" disruption="low" strategy="disable">
package --remove=nis
</fix>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref name="oval:ssg-package_nis_removed:def:1" href="ssg-fedora-oval.xml"/>
        </check>
      </Rule>
      <Rule id="xccdf_org.ssgproject.content_rule_package_ntpdate_removed" selected="false" role="full" severity="low">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Uninstall the ntpdate package</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">ntpdate is a historical ntp synchronization client for unixes. It sould be uninstalled.</description>
        <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">ntpdate is an old not security-compliant ntp client. It should be replaced by modern ntp clients such as ntpd, able to use cryptographic mechanisms integrated in NTP.</rationale>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_ntpdate_removed" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="disable">
# CAUTION: This remediation script will remove ntpdate
#	   from the system, and may remove any packages
#	   that depend on ntpdate. Execute this
#	   remediation AFTER testing on a non-production
#	   system!

if rpm -q --quiet "ntpdate" ; then
    dnf remove -y "ntpdate"
fi
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_ntpdate_removed" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="disable">- name: Ensure ntpdate is removed
  package:
    name: ntpdate
    state: absent
  tags:
    - disable_strategy
    - low_complexity
    - low_disruption
    - low_severity
    - no_reboot_needed
    - package_ntpdate_removed
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_ntpdate_removed" system="urn:xccdf:fix:script:puppet" complexity="low" disruption="low" strategy="disable">include remove_ntpdate

class remove_ntpdate {
  package { 'ntpdate':
    ensure =&gt; 'purged',
  }
}
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_ntpdate_removed" system="urn:redhat:anaconda:pre" complexity="low" disruption="low" strategy="disable">
package --remove=ntpdate
</fix>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref name="oval:ssg-package_ntpdate_removed:def:1" href="ssg-fedora-oval.xml"/>
        </check>
      </Rule>
      <Rule id="xccdf_org.ssgproject.content_rule_package_telnetd-ssl_removed" selected="false" role="full" severity="high">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Uninstall the ssl compliant telnet server</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">telnet</html:code> daemon, even with ssl support, should be uninstalled.</description>
        <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">NT007(R02)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.11</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.12</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.6</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.2</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.3</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.4</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.5</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.7</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.5</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.3</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.3</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.3</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.4</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.5</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.6</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.7</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.2</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.3</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
        <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
        <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
        <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
        <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS01.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.03</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS06.06</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.11.2.6</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.12.1.2</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.12.5.1</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.12.6.2</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.14.2.2</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.14.2.3</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.14.2.4</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.6.2.1</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.6.2.2</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
        <reference href="https://www.cisecurity.org/controls/">11</reference>
        <reference href="https://www.cisecurity.org/controls/">12</reference>
        <reference href="https://www.cisecurity.org/controls/">14</reference>
        <reference href="https://www.cisecurity.org/controls/">15</reference>
        <reference href="https://www.cisecurity.org/controls/">3</reference>
        <reference href="https://www.cisecurity.org/controls/">8</reference>
        <reference href="https://www.cisecurity.org/controls/">9</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
        <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US"><html:code xmlns:html="http://www.w3.org/1999/xhtml">telnet</html:code>, even with ssl support, should not be installed.
When remote shell is required, up-to-date ssh daemon can be used.</rationale>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_telnetd-ssl_removed" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="disable">
# CAUTION: This remediation script will remove telnetd-ssl
#	   from the system, and may remove any packages
#	   that depend on telnetd-ssl. Execute this
#	   remediation AFTER testing on a non-production
#	   system!

if rpm -q --quiet "telnetd-ssl" ; then
    dnf remove -y "telnetd-ssl"
fi
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_telnetd-ssl_removed" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="disable">- name: Ensure telnetd-ssl is removed
  package:
    name: telnetd-ssl
    state: absent
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - disable_strategy
    - high_severity
    - low_complexity
    - low_disruption
    - no_reboot_needed
    - package_telnetd-ssl_removed
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_telnetd-ssl_removed" system="urn:xccdf:fix:script:puppet" complexity="low" disruption="low" strategy="disable">include remove_telnetd-ssl

class remove_telnetd-ssl {
  package { 'telnetd-ssl':
    ensure =&gt; 'purged',
  }
}
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_telnetd-ssl_removed" system="urn:redhat:anaconda:pre" complexity="low" disruption="low" strategy="disable">
package --remove=telnetd-ssl
</fix>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref name="oval:ssg-package_telnetd-ssl_removed:def:1" href="ssg-fedora-oval.xml"/>
        </check>
      </Rule>
      <Rule id="xccdf_org.ssgproject.content_rule_package_telnetd_removed" selected="false" role="full" severity="high">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Uninstall the telnet server</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The telnet daemon should be uninstalled.</description>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.11</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.12</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.6</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.2</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.3</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.4</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.5</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.7</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.5</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.3</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.3</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.3</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.4</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.5</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.6</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.7</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.2</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.3</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
        <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
        <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
        <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
        <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS01.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.03</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS06.06</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.11.2.6</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.12.1.2</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.12.5.1</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.12.6.2</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.14.2.2</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.14.2.3</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.14.2.4</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.6.2.1</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.6.2.2</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
        <reference href="https://www.cisecurity.org/controls/">11</reference>
        <reference href="https://www.cisecurity.org/controls/">12</reference>
        <reference href="https://www.cisecurity.org/controls/">14</reference>
        <reference href="https://www.cisecurity.org/controls/">15</reference>
        <reference href="https://www.cisecurity.org/controls/">3</reference>
        <reference href="https://www.cisecurity.org/controls/">8</reference>
        <reference href="https://www.cisecurity.org/controls/">9</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
        <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R1)</reference>
        <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">NT007(R03)</reference>
        <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US"><html:code xmlns:html="http://www.w3.org/1999/xhtml">telnet</html:code> allows clear text communications, and does not protect
any data transmission between client and server. Any confidential data
can be listened and no integrity checking is made.'</rationale>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_telnetd_removed" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="disable">
# CAUTION: This remediation script will remove telnetd
#	   from the system, and may remove any packages
#	   that depend on telnetd. Execute this
#	   remediation AFTER testing on a non-production
#	   system!

if rpm -q --quiet "telnetd" ; then
    dnf remove -y "telnetd"
fi
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_telnetd_removed" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="disable">- name: Ensure telnetd is removed
  package:
    name: telnetd
    state: absent
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - disable_strategy
    - high_severity
    - low_complexity
    - low_disruption
    - no_reboot_needed
    - package_telnetd_removed
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_telnetd_removed" system="urn:xccdf:fix:script:puppet" complexity="low" disruption="low" strategy="disable">include remove_telnetd

class remove_telnetd {
  package { 'telnetd':
    ensure =&gt; 'purged',
  }
}
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_telnetd_removed" system="urn:redhat:anaconda:pre" complexity="low" disruption="low" strategy="disable">
package --remove=telnetd
</fix>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref name="oval:ssg-package_telnetd_removed:def:1" href="ssg-fedora-oval.xml"/>
        </check>
      </Rule>
    </Group>
    <Group id="xccdf_org.ssgproject.content_group_docker">
      <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Docker Service</title>
      <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The docker service is necessary to create containers, which are
  self-sufficient and self-contained applications using the resource
  isolation features of the kernel.</description>
    </Group>
    <Group id="xccdf_org.ssgproject.content_group_apt">
      <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">APT service configuration</title>
      <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The apt service manage the package management and update of the whole system. Its configuration need to be properly defined to ensure efficient security updates, packages and repository authentication and proper lifecycle management.</description>
    </Group>
    <Group id="xccdf_org.ssgproject.content_group_fapolicyd">
      <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Application Whitelisting Daemon</title>
      <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Fapolicyd (File Access Policy Daemon) implements application whitelisting
to decide file access rights. Applications that are known via a reputation
source are allowed access while unknown applications are not. The daemon
makes use of the kernel's <html:code xmlns:html="http://www.w3.org/1999/xhtml">fanotify</html:code> interface to determine file access rights.</description>
      <platform idref="cpe:/a:machine"/>
      <Rule id="xccdf_org.ssgproject.content_rule_package_fapolicyd_installed" selected="false" role="full" severity="medium">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Install fapolicyd Package</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">fapolicyd</html:code> package can be installed with the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">
$ sudo dnf install fapolicyd</html:pre></description>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SI-4(22)</reference>
        <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000370-GPOS-00155</reference>
        <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000368-GPOS-00154</reference>
        <reference href="https://public.cyber.mil/stigs/cci/">CCI-001764</reference>
        <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US"><html:code xmlns:html="http://www.w3.org/1999/xhtml">fapolicyd</html:code> (File Access Policy Daemon)
implements application whitelisting to decide file access rights.</rationale>
        <platform idref="cpe:/a:machine"/>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_fapolicyd_installed" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="enable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

if ! rpm -q --quiet "fapolicyd" ; then
    dnf install -y "fapolicyd"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_fapolicyd_installed" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="enable">- name: Ensure fapolicyd is installed
  package:
    name: fapolicyd
    state: present
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-SI-4(22)
    - enable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - package_fapolicyd_installed
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_fapolicyd_installed" system="urn:xccdf:fix:script:puppet" complexity="low" disruption="low" strategy="enable">include install_fapolicyd

class install_fapolicyd {
  package { 'fapolicyd':
    ensure =&gt; 'installed',
  }
}
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_fapolicyd_installed" system="urn:redhat:anaconda:pre" complexity="low" disruption="low" strategy="enable">
package --add=fapolicyd
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_fapolicyd_installed" system="urn:redhat:osbuild:blueprint">
[[packages]]
name = "fapolicyd"
version = "*"
</fix>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref name="oval:ssg-package_fapolicyd_installed:def:1" href="ssg-fedora-oval.xml"/>
        </check>
        <check system="http://scap.nist.gov/schema/ocil/2">
          <check-content-ref name="ocil:ssg-package_fapolicyd_installed_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
        </check>
      </Rule>
    </Group>
    <Group id="xccdf_org.ssgproject.content_group_nfs_and_rpc">
      <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">NFS and RPC</title>
      <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The Network File System is a popular distributed filesystem for
the Unix environment, and is very widely deployed.  This section discusses the
circumstances under which it is possible to disable NFS and its dependencies,
and then details steps which should be taken to secure
NFS's configuration. This section is relevant to systems operating as NFS
clients, as well as to those operating as NFS servers.</description>
      <Rule id="xccdf_org.ssgproject.content_rule_package_nfs-utils_removed" selected="false" role="full" severity="low">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Uninstall nfs-utils Package</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">nfs-utils</html:code> package can be removed with the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">
$ sudo dnf erase nfs-utils</html:pre></description>
        <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000095-GPOS-00049</reference>
        <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US"><html:code xmlns:html="http://www.w3.org/1999/xhtml">nfs-utils</html:code> provides a daemon for the kernel NFS server and related tools. This
package also contains the <html:code xmlns:html="http://www.w3.org/1999/xhtml">showmount</html:code> program. <html:code xmlns:html="http://www.w3.org/1999/xhtml">showmount</html:code> queries the mount
daemon on a remote host for information about the Network File System (NFS) server on the
remote host. For example, <html:code xmlns:html="http://www.w3.org/1999/xhtml">showmount</html:code> can display the clients which are mounted on
that host.</rationale>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_nfs-utils_removed" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="disable">
# CAUTION: This remediation script will remove nfs-utils
#	   from the system, and may remove any packages
#	   that depend on nfs-utils. Execute this
#	   remediation AFTER testing on a non-production
#	   system!

if rpm -q --quiet "nfs-utils" ; then
    dnf remove -y "nfs-utils"
fi
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_nfs-utils_removed" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="disable">- name: Ensure nfs-utils is removed
  package:
    name: nfs-utils
    state: absent
  tags:
    - disable_strategy
    - low_complexity
    - low_disruption
    - low_severity
    - no_reboot_needed
    - package_nfs-utils_removed
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_nfs-utils_removed" system="urn:xccdf:fix:script:puppet" complexity="low" disruption="low" strategy="disable">include remove_nfs-utils

class remove_nfs-utils {
  package { 'nfs-utils':
    ensure =&gt; 'purged',
  }
}
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_nfs-utils_removed" system="urn:redhat:anaconda:pre" complexity="low" disruption="low" strategy="disable">
package --remove=nfs-utils
</fix>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref name="oval:ssg-package_nfs-utils_removed:def:1" href="ssg-fedora-oval.xml"/>
        </check>
        <check system="http://scap.nist.gov/schema/ocil/2">
          <check-content-ref name="ocil:ssg-package_nfs-utils_removed_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
        </check>
      </Rule>
      <Group id="xccdf_org.ssgproject.content_group_nfs_configuring_all_machines">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Configure All Systems which Use NFS</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The steps in this section are appropriate for all systems which
run NFS, whether they operate as clients or as servers.</description>
        <Group id="xccdf_org.ssgproject.content_group_nfs_client_or_server_not_both">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Make Each System a Client or a Server, not Both</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">If NFS must be used, it should be deployed in the simplest
configuration possible to avoid maintainability problems which may lead to
unnecessary security exposure. Due to the reliability and security problems
caused by NFS (specially NFSv3 and NFSv2), it is not a good idea for systems
which act as NFS servers to also mount filesystems via NFS. At the least,
crossed mounts (the situation in which each of two servers mounts a filesystem
from the other) should never be used.</description>
        </Group>
        <Group id="xccdf_org.ssgproject.content_group_nfs_configure_fixed_ports">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Configure NFS Services to Use Fixed Ports (NFSv3 and NFSv2)</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Firewalling should be done at each host and at the border
firewalls to protect the NFS daemons from remote access, since NFS servers
should never be accessible from outside the organization. However, by default
for NFSv3 and NFSv2, the RPC Bind service assigns each NFS service to a port
dynamically at service startup time. Dynamic ports cannot be protected by port

filtering firewalls such as <html:code xmlns:html="http://www.w3.org/1999/xhtml">iptables</html:code>.

<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Therefore, restrict each service to always use a given port, so that
firewalling can be done effectively. Note that, because of the way RPC is
implemented, it is not possible to disable the RPC Bind service even if ports
are assigned statically to all RPC services.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
In NFSv4, the mounting and locking protocols have been incorporated into the
protocol, and the server listens on the the well-known TCP port 2049. As such,
NFSv4 does not need to interact with the <html:code xmlns:html="http://www.w3.org/1999/xhtml">rpcbind, lockd, and rpc.statd</html:code>
daemons, which can and should be disabled in a pure NFSv4 environment. The
<html:code xmlns:html="http://www.w3.org/1999/xhtml">rpc.mountd</html:code> daemon is still required on the NFS server to setup
exports, but is not involved in any over-the-wire operations.</description>
          <Rule id="xccdf_org.ssgproject.content_rule_nfs_fixed_lockd_tcp_port" selected="false" role="full" severity="unknown">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Configure lockd to use static TCP port</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Configure the <html:code xmlns:html="http://www.w3.org/1999/xhtml">lockd</html:code> daemon to use a static TCP port as
opposed to letting the RPC Bind service dynamically assign a port. Edit the
file <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/sysconfig/nfs</html:code>. Add or correct the following line:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">LOCKD_TCPPORT=lockd-port</html:pre>
Where <html:code xmlns:html="http://www.w3.org/1999/xhtml">lockd-port</html:code> is a port which is not used by any other service on
your network.</description>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Restrict service to always use a given port, so that firewalling can be done
effectively.</rationale>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_nfs_fixed_statd_port" selected="false" role="full" severity="unknown">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Configure statd to use static port</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Configure the <html:code xmlns:html="http://www.w3.org/1999/xhtml">statd</html:code> daemon to use a static port as
opposed to letting the RPC Bind service dynamically assign a port. Edit the
file <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/sysconfig/nfs</html:code>. Add or correct the following line:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">STATD_PORT=statd-port</html:pre>
Where <html:code xmlns:html="http://www.w3.org/1999/xhtml">statd-port</html:code> is a port which is not used by any other service on your network.</description>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Restricting services to always use a given port enables firewalling
to be done more effectively.</rationale>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_nfs_fixed_lockd_udp_port" selected="false" role="full" severity="unknown">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Configure lockd to use static UDP port</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Configure the <html:code xmlns:html="http://www.w3.org/1999/xhtml">lockd</html:code> daemon to use a static UDP port as
opposed to letting the RPC Bind service dynamically assign a port. Edit the
file <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/sysconfig/nfs</html:code>. Add or correct the following line:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">LOCKD_UDPPORT=lockd-port</html:pre>
Where <html:code xmlns:html="http://www.w3.org/1999/xhtml">lockd-port</html:code> is a port which is not used by any other service on
your network.</description>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Restricting services to always use a given port enables firewalling
to be done more effectively.</rationale>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_nfs_fixed_mountd_port" selected="false" role="full" severity="unknown">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Configure mountd to use static port</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Configure the <html:code xmlns:html="http://www.w3.org/1999/xhtml">mountd</html:code> daemon to use a static port as
opposed to letting the RPC Bind service dynamically assign a port. Edit the
file <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/sysconfig/nfs</html:code>. Add or correct the following line:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">MOUNTD_PORT=statd-port</html:pre>
Where <html:code xmlns:html="http://www.w3.org/1999/xhtml">mountd-port</html:code> is a port which is not used by any other service on your network.</description>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Restricting services to always use a given port enables firewalling
to be done more effectively.</rationale>
          </Rule>
        </Group>
      </Group>
      <Group id="xccdf_org.ssgproject.content_group_nfs_configuring_clients">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Configure NFS Clients</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The steps in this section are appropriate for systems which operate as NFS clients.</description>
        <Group id="xccdf_org.ssgproject.content_group_disabling_nfsd">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable NFS Server Daemons</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">There is no need to run the NFS server daemons <html:code xmlns:html="http://www.w3.org/1999/xhtml">nfs</html:code> and
<html:code xmlns:html="http://www.w3.org/1999/xhtml">rpcsvcgssd</html:code> except on a small number of properly secured systems
designated as NFS servers. Ensure that these daemons are turned off on
clients.</description>
          <Rule id="xccdf_org.ssgproject.content_rule_service_nfs_disabled" selected="false" role="full" severity="unknown">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable Network File System (nfs)</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The Network File System (NFS) service allows remote hosts to mount
and interact with shared filesystems on the local system. If the local system
is not designated as a NFS server then this service should be disabled.

The <html:code xmlns:html="http://www.w3.org/1999/xhtml">nfs-server</html:code> service can be disabled with the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo systemctl mask --now nfs-server.service</html:pre></description>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.11</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.12</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.2.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.06</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.7.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.5</reference>
            <reference href="https://www.cisecurity.org/controls/">11</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">18</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">5</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Unnecessary services should be disabled to decrease the attack surface of the system.</rationale>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="service_nfs_disabled" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

SYSTEMCTL_EXEC='/usr/bin/systemctl'
"$SYSTEMCTL_EXEC" stop 'nfs-server.service'
"$SYSTEMCTL_EXEC" disable 'nfs-server.service'
"$SYSTEMCTL_EXEC" mask 'nfs-server.service'
# Disable socket activation if we have a unit file for it
if "$SYSTEMCTL_EXEC" list-unit-files | grep -q '^nfs-server.socket'; then
    "$SYSTEMCTL_EXEC" stop 'nfs-server.socket'
    "$SYSTEMCTL_EXEC" mask 'nfs-server.socket'
fi
# The service may not be running because it has been started and failed,
# so let's reset the state so OVAL checks pass.
# Service should be 'inactive', not 'failed' after reboot though.
"$SYSTEMCTL_EXEC" reset-failed 'nfs-server.service' || true

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="service_nfs_disabled" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="disable">- name: Disable service nfs-server
  block:

    - name: Gather the service facts
      service_facts: null

    - name: Disable service nfs-server
      systemd:
        name: nfs-server.service
        enabled: 'no'
        state: stopped
        masked: 'yes'
      when: '"nfs-server.service" in ansible_facts.services'
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - disable_strategy
    - low_complexity
    - low_disruption
    - no_reboot_needed
    - service_nfs_disabled
    - unknown_severity

- name: Unit Socket Exists - nfs-server.socket
  command: systemctl list-unit-files nfs-server.socket
  args:
    warn: false
  register: socket_file_exists
  changed_when: false
  ignore_errors: true
  check_mode: false
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - disable_strategy
    - low_complexity
    - low_disruption
    - no_reboot_needed
    - service_nfs_disabled
    - unknown_severity

- name: Disable socket nfs-server
  systemd:
    name: nfs-server.socket
    enabled: 'no'
    state: stopped
    masked: 'yes'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - '"nfs-server.socket" in socket_file_exists.stdout_lines[1]'
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - disable_strategy
    - low_complexity
    - low_disruption
    - no_reboot_needed
    - service_nfs_disabled
    - unknown_severity
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="service_nfs_disabled" system="urn:xccdf:fix:script:puppet" complexity="low" disruption="low" strategy="enable">include disable_nfs-server

class disable_nfs-server {
  service {'nfs-server':
    enable =&gt; false,
    ensure =&gt; 'stopped',
  }
}
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="service_nfs_disabled" system="urn:xccdf:fix:script:kubernetes" reboot="true" complexity="low" disruption="medium" strategy="disable">apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    systemd:
      units:
      - name: nfs-server.service
        enabled: false
        mask: true
      - name: nfs-server.socket
        enabled: false
        mask: true
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-service_nfs_disabled:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-service_nfs_disabled_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_service_rpcsvcgssd_disabled" selected="false" role="full" severity="unknown">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable Secure RPC Server Service (rpcsvcgssd)</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The rpcsvcgssd service manages RPCSEC GSS contexts required to
secure protocols that use RPC (most often Kerberos and NFS). The rpcsvcgssd
service is the server-side of RPCSEC GSS. If the system does not require secure
RPC then this service should be disabled.

The <html:code xmlns:html="http://www.w3.org/1999/xhtml">rpcsvcgssd</html:code> service can be disabled with the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo systemctl mask --now rpcsvcgssd.service</html:pre></description>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Unnecessary services should be disabled to decrease the attack surface of the system.</rationale>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="service_rpcsvcgssd_disabled" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

SYSTEMCTL_EXEC='/usr/bin/systemctl'
"$SYSTEMCTL_EXEC" stop 'rpcsvcgssd.service'
"$SYSTEMCTL_EXEC" disable 'rpcsvcgssd.service'
"$SYSTEMCTL_EXEC" mask 'rpcsvcgssd.service'
# Disable socket activation if we have a unit file for it
if "$SYSTEMCTL_EXEC" list-unit-files | grep -q '^rpcsvcgssd.socket'; then
    "$SYSTEMCTL_EXEC" stop 'rpcsvcgssd.socket'
    "$SYSTEMCTL_EXEC" mask 'rpcsvcgssd.socket'
fi
# The service may not be running because it has been started and failed,
# so let's reset the state so OVAL checks pass.
# Service should be 'inactive', not 'failed' after reboot though.
"$SYSTEMCTL_EXEC" reset-failed 'rpcsvcgssd.service' || true

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="service_rpcsvcgssd_disabled" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="disable">- name: Disable service rpcsvcgssd
  block:

    - name: Gather the service facts
      service_facts: null

    - name: Disable service rpcsvcgssd
      systemd:
        name: rpcsvcgssd.service
        enabled: 'no'
        state: stopped
        masked: 'yes'
      when: '"rpcsvcgssd.service" in ansible_facts.services'
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - disable_strategy
    - low_complexity
    - low_disruption
    - no_reboot_needed
    - service_rpcsvcgssd_disabled
    - unknown_severity

- name: Unit Socket Exists - rpcsvcgssd.socket
  command: systemctl list-unit-files rpcsvcgssd.socket
  args:
    warn: false
  register: socket_file_exists
  changed_when: false
  ignore_errors: true
  check_mode: false
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - disable_strategy
    - low_complexity
    - low_disruption
    - no_reboot_needed
    - service_rpcsvcgssd_disabled
    - unknown_severity

- name: Disable socket rpcsvcgssd
  systemd:
    name: rpcsvcgssd.socket
    enabled: 'no'
    state: stopped
    masked: 'yes'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - '"rpcsvcgssd.socket" in socket_file_exists.stdout_lines[1]'
  tags:
    - disable_strategy
    - low_complexity
    - low_disruption
    - no_reboot_needed
    - service_rpcsvcgssd_disabled
    - unknown_severity
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="service_rpcsvcgssd_disabled" system="urn:xccdf:fix:script:puppet" complexity="low" disruption="low" strategy="enable">include disable_rpcsvcgssd

class disable_rpcsvcgssd {
  service {'rpcsvcgssd':
    enable =&gt; false,
    ensure =&gt; 'stopped',
  }
}
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="service_rpcsvcgssd_disabled" system="urn:xccdf:fix:script:kubernetes" reboot="true" complexity="low" disruption="medium" strategy="disable">apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    systemd:
      units:
      - name: rpcsvcgssd.service
        enabled: false
        mask: true
      - name: rpcsvcgssd.socket
        enabled: false
        mask: true
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-service_rpcsvcgssd_disabled:def:1" href="ssg-fedora-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-service_rpcsvcgssd_disabled_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_nfs_no_anonymous" selected="false" role="full" severity="unknown">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Specify UID and GID for Anonymous NFS Connections</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To specify the UID and GID for remote root users, edit the <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/exports</html:code> file and add the following for each export:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">
anonuid=<html:code>value greater than UID_MAX from /etc/login.defs</html:code>
anongid=<html:code>value greater than GID_MAX from /etc/login.defs</html:code>
</html:pre>
Note that a value of "-1" is technically acceptable as this will randomize the <html:code xmlns:html="http://www.w3.org/1999/xhtml">anonuid</html:code> and
<html:code xmlns:html="http://www.w3.org/1999/xhtml">anongid</html:code> values on a Red Hat Enterprise Linux based NFS server. While acceptable from a security perspective,
a value of <html:code xmlns:html="http://www.w3.org/1999/xhtml">-1</html:code>  may cause interoperability issues, particularly with Red Hat Enterprise Linux 7 client systems.
Alternatively, functionally equivalent values of 60001, 65534, 65535 may be used.</description>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Specifying the anonymous UID and GID ensures that the remote root user is mapped
to a local account which has no permissions on the system.</rationale>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-nfs_no_anonymous_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </check>
          </Rule>
        </Group>
        <Group id="xccdf_org.ssgproject.content_group_mounting_remote_filesystems">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Mount Remote Filesystems with Restrictive Options</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Edit the file <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/fstab</html:code>. For each filesystem whose type
(column 3) is <html:code xmlns:html="http://www.w3.org/1999/xhtml">nfs</html:code> or <html:code xmlns:html="http://www.w3.org/1999/xhtml">nfs4</html:code>, add the text
<html:code xmlns:html="http://www.w3.org/1999/xhtml">,nodev,nosuid</html:code> to the list of mount options in column 4. If
appropriate, also add <html:code xmlns:html="http://www.w3.org/1999/xhtml">,noexec</html:code>.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
See the section titled "Restrict Partition Mount Options" for a description of
the effects of these options. In general, execution of files mounted via NFS
should be considered risky because of the possibility that an adversary could
intercept the request and substitute a malicious file. Allowing setuid files to
be executed from remote servers is particularly risky, both for this reason and
because it requires the clients to extend root-level trust to the NFS
server.</description>
          <platform idref="cpe:/a:machine"/>
        </Group>
      </Group>
      <Group id="xccdf_org.ssgproject.content_group_nfs_configuring_servers">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Configure NFS Servers</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The steps in this section are appropriate for systems which operate as NFS servers.</description>
        <Rule id="xccdf_org.ssgproject.content_rule_no_insecure_locks_exports" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure Insecure File Locking is Not Allowed</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">By default the NFS server requires secure file-lock requests, which require
credentials from the client in order to lock a file. Most NFS clients send
credentials with file lock requests, however, there are a few clients that
do not send credentials when requesting a file-lock, allowing the client to
only be able to lock world-readable files. To get around this, the
<html:code xmlns:html="http://www.w3.org/1999/xhtml">insecure_locks</html:code> option can be used so these clients can access the
desired export. This poses a security risk by potentially allowing the
client access to data for which it does not have authorization. Remove any
instances of the <html:code xmlns:html="http://www.w3.org/1999/xhtml">insecure_locks</html:code> option from the file
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/exports</html:code>.</description>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-000764</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Allowing insecure file locking could allow for sensitive data to be
viewed or edited by an unauthorized user.</rationale>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-no_insecure_locks_exports:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-no_insecure_locks_exports_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_restrict_nfs_clients_to_privileged_ports" selected="false" role="full" severity="unknown">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Restrict NFS Clients to Privileged Ports</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">By default, the server NFS implementation requires that all client requests be made
from ports less than 1024. If your organization has control over systems connected to its
network, and if NFS requests are prohibited at the border firewall, this offers some protection
against malicious requests from unprivileged users. Therefore, the default should not be changed.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
To ensure that the default has not been changed, ensure no line in
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/exports</html:code> contains the option <html:code xmlns:html="http://www.w3.org/1999/xhtml">insecure</html:code>.</description>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.11</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.12</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.2.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.06</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.6.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.7.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.5</reference>
          <reference href="https://www.cisecurity.org/controls/">11</reference>
          <reference href="https://www.cisecurity.org/controls/">12</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">16</reference>
          <reference href="https://www.cisecurity.org/controls/">18</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">5</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Allowing client requests to be made from ports higher than 1024 could allow a unprivileged
user to initiate an NFS connection. If the unprivileged user account has been compromised, an
attacker could gain access to data on the NFS server.</rationale>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_use_root_squashing_all_exports" selected="false" role="full" severity="unknown">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Use Root-Squashing on All Exports</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">If a filesystem is exported using root squashing, requests from root on the client
are considered to be unprivileged (mapped to a user such as nobody). This provides some mild
protection against remote abuse of an NFS server. Root squashing is enabled by default, and
should not be disabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Ensure that no line in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/exports</html:code> contains the option <html:code xmlns:html="http://www.w3.org/1999/xhtml">no_root_squash</html:code>.</description>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">If the NFS server allows root access to local file systems from remote hosts, this
access could be used to compromise the system.</rationale>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_no_all_squash_exports" selected="false" role="full" severity="low">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure All-Squashing Disabled On All Exports</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">all_squash</html:code> maps all uids and gids to an anonymous user.
This should be disabled by removing any instances of the
<html:code xmlns:html="http://www.w3.org/1999/xhtml">all_squash</html:code> option from the file <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/exports</html:code>.</description>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The all_squash option maps all client requests to a single anonymous
uid/gid on the NFS server, negating the ability to track file access
by user ID.</rationale>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-no_all_squash_exports_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Group id="xccdf_org.ssgproject.content_group_export_filesystems_read_only">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Export Filesystems Read-Only if Possible</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">If a filesystem is being exported so that users can view the files in a convenient
fashion, but there is no need for users to edit those files, exporting the filesystem read-only
removes an attack vector against the server. The default filesystem export mode is <html:code xmlns:html="http://www.w3.org/1999/xhtml">ro</html:code>,
so do not specify <html:code xmlns:html="http://www.w3.org/1999/xhtml">rw</html:code> without a good reason.</description>
        </Group>
        <Group id="xccdf_org.ssgproject.content_group_use_acl_enforce_auth_restrictions">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Use Access Lists to Enforce Authorization Restrictions</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">When configuring NFS exports, ensure that each export line in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/exports</html:code> contains
a list of hosts which are allowed to access that export. If no hosts are specified on an export line,
then that export is available to any remote host which requests it. All lines of the exports file should
specify the hosts (or subnets, if needed) which are allowed to access the exported directory, so that
unknown or remote hosts will be denied.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Authorized hosts can be specified in several different formats:
<html:ul xmlns:html="http://www.w3.org/1999/xhtml"><html:li>Name or alias that is recognized by the resolver</html:li><html:li>Fully qualified domain name</html:li><html:li>IP address</html:li><html:li>IP subnets in the format <html:code>address/netmask</html:code> or <html:code>address/CIDR</html:code></html:li></html:ul></description>
        </Group>
        <Group id="xccdf_org.ssgproject.content_group_configure_exports_restrictively">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Configure the Exports File Restrictively</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Linux's NFS implementation uses the file <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/exports</html:code> to control what filesystems
and directories may be accessed via NFS. (See the <html:code xmlns:html="http://www.w3.org/1999/xhtml">exports(5)</html:code> manpage for more information about the
format of this file.)
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
The syntax of the <html:code xmlns:html="http://www.w3.org/1999/xhtml">exports</html:code> file is not necessarily checked fully on reload, and syntax errors
can leave your NFS configuration more open than intended. Therefore, exercise caution when modifying
the file.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
The syntax of each line in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/exports</html:code> is:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">/DIR	host1(opt1,opt2) host2(opt3)</html:pre>
where <html:code xmlns:html="http://www.w3.org/1999/xhtml">/DIR</html:code> is a directory or filesystem to export, <html:code xmlns:html="http://www.w3.org/1999/xhtml">hostN</html:code> is an IP address, netblock,
hostname, domain, or netgroup to which to export, and <html:code xmlns:html="http://www.w3.org/1999/xhtml">optN</html:code> is an option.</description>
        </Group>
      </Group>
      <Group id="xccdf_org.ssgproject.content_group_disabling_nfs">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable All NFS Services if Possible</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">If there is not a reason for the system to operate as either an
NFS client or an NFS server, follow all instructions in this section to disable
subsystems required by NFS.</description>
        <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">The steps in this section will prevent a system
from operating as either an NFS client or an NFS server. Only perform these
steps on systems which do not need NFS at all.</warning>
        <platform idref="cpe:/a:machine"/>
        <Group id="xccdf_org.ssgproject.content_group_disabling_nfs_services">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable Services Used Only by NFS</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">If NFS is not needed, disable the NFS client daemons nfslock, rpcgssd, and rpcidmapd.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
All of these daemons run with elevated privileges, and many listen for network
connections. If they are not needed, they should be disabled to improve system
security posture.</description>
          <platform idref="cpe:/a:machine"/>
          <Rule id="xccdf_org.ssgproject.content_rule_service_nfslock_disabled" selected="false" role="full" severity="unknown">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable Network File System Lock Service (nfslock)</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The Network File System Lock (nfslock) service starts the required
remote procedure call (RPC) processes which allow clients to lock files on the
server. If the local system is not configured to mount NFS filesystems then
this service should be disabled.

The <html:code xmlns:html="http://www.w3.org/1999/xhtml">nfslock</html:code> service can be disabled with the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo systemctl mask --now nfslock.service</html:pre></description>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US"/>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="service_nfslock_disabled" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

SYSTEMCTL_EXEC='/usr/bin/systemctl'
"$SYSTEMCTL_EXEC" stop 'nfslock.service'
"$SYSTEMCTL_EXEC" disable 'nfslock.service'
"$SYSTEMCTL_EXEC" mask 'nfslock.service'
# Disable socket activation if we have a unit file for it
if "$SYSTEMCTL_EXEC" list-unit-files | grep -q '^nfslock.socket'; then
    "$SYSTEMCTL_EXEC" stop 'nfslock.socket'
    "$SYSTEMCTL_EXEC" mask 'nfslock.socket'
fi
# The service may not be running because it has been started and failed,
# so let's reset the state so OVAL checks pass.
# Service should be 'inactive', not 'failed' after reboot though.
"$SYSTEMCTL_EXEC" reset-failed 'nfslock.service' || true

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="service_nfslock_disabled" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="disable">- name: Disable service nfslock
  block:

    - name: Gather the service facts
      service_facts: null

    - name: Disable service nfslock
      systemd:
        name: nfslock.service
        enabled: 'no'
        state: stopped
        masked: 'yes'
      when: '"nfslock.service" in ansible_facts.services'
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - disable_strategy
    - low_complexity
    - low_disruption
    - no_reboot_needed
    - service_nfslock_disabled
    - unknown_severity

- name: Unit Socket Exists - nfslock.socket
  command: systemctl list-unit-files nfslock.socket
  args:
    warn: false
  register: socket_file_exists
  changed_when: false
  ignore_errors: true
  check_mode: false
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - disable_strategy
    - low_complexity
    - low_disruption
    - no_reboot_needed
    - service_nfslock_disabled
    - unknown_severity

- name: Disable socket nfslock
  systemd:
    name: nfslock.socket
    enabled: 'no'
    state: stopped
    masked: 'yes'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - '"nfslock.socket" in socket_file_exists.stdout_lines[1]'
  tags:
    - disable_strategy
    - low_complexity
    - low_disruption
    - no_reboot_needed
    - service_nfslock_disabled
    - unknown_severity
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="service_nfslock_disabled" system="urn:xccdf:fix:script:puppet" complexity="low" disruption="low" strategy="enable">include disable_nfslock

class disable_nfslock {
  service {'nfslock':
    enable =&gt; false,
    ensure =&gt; 'stopped',
  }
}
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="service_nfslock_disabled" system="urn:xccdf:fix:script:kubernetes" reboot="true" complexity="low" disruption="medium" strategy="disable">apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    systemd:
      units:
      - name: nfslock.service
        enabled: false
        mask: true
      - name: nfslock.socket
        enabled: false
        mask: true
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-service_nfslock_disabled:def:1" href="ssg-fedora-oval.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_service_rpcgssd_disabled" selected="false" role="full" severity="unknown">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable Secure RPC Client Service (rpcgssd)</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The rpcgssd service manages RPCSEC GSS contexts required to secure protocols
that use RPC (most often Kerberos and NFS). The rpcgssd service is the
client-side of RPCSEC GSS. If the system does not require secure RPC then this
service should be disabled.

The <html:code xmlns:html="http://www.w3.org/1999/xhtml">rpcgssd</html:code> service can be disabled with the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo systemctl mask --now rpcgssd.service</html:pre></description>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US"/>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="service_rpcgssd_disabled" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

SYSTEMCTL_EXEC='/usr/bin/systemctl'
"$SYSTEMCTL_EXEC" stop 'rpcgssd.service'
"$SYSTEMCTL_EXEC" disable 'rpcgssd.service'
"$SYSTEMCTL_EXEC" mask 'rpcgssd.service'
# Disable socket activation if we have a unit file for it
if "$SYSTEMCTL_EXEC" list-unit-files | grep -q '^rpcgssd.socket'; then
    "$SYSTEMCTL_EXEC" stop 'rpcgssd.socket'
    "$SYSTEMCTL_EXEC" mask 'rpcgssd.socket'
fi
# The service may not be running because it has been started and failed,
# so let's reset the state so OVAL checks pass.
# Service should be 'inactive', not 'failed' after reboot though.
"$SYSTEMCTL_EXEC" reset-failed 'rpcgssd.service' || true

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="service_rpcgssd_disabled" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="disable">- name: Disable service rpcgssd
  block:

    - name: Gather the service facts
      service_facts: null

    - name: Disable service rpcgssd
      systemd:
        name: rpcgssd.service
        enabled: 'no'
        state: stopped
        masked: 'yes'
      when: '"rpcgssd.service" in ansible_facts.services'
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - disable_strategy
    - low_complexity
    - low_disruption
    - no_reboot_needed
    - service_rpcgssd_disabled
    - unknown_severity

- name: Unit Socket Exists - rpcgssd.socket
  command: systemctl list-unit-files rpcgssd.socket
  args:
    warn: false
  register: socket_file_exists
  changed_when: false
  ignore_errors: true
  check_mode: false
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - disable_strategy
    - low_complexity
    - low_disruption
    - no_reboot_needed
    - service_rpcgssd_disabled
    - unknown_severity

- name: Disable socket rpcgssd
  systemd:
    name: rpcgssd.socket
    enabled: 'no'
    state: stopped
    masked: 'yes'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - '"rpcgssd.socket" in socket_file_exists.stdout_lines[1]'
  tags:
    - disable_strategy
    - low_complexity
    - low_disruption
    - no_reboot_needed
    - service_rpcgssd_disabled
    - unknown_severity
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="service_rpcgssd_disabled" system="urn:xccdf:fix:script:puppet" complexity="low" disruption="low" strategy="enable">include disable_rpcgssd

class disable_rpcgssd {
  service {'rpcgssd':
    enable =&gt; false,
    ensure =&gt; 'stopped',
  }
}
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="service_rpcgssd_disabled" system="urn:xccdf:fix:script:kubernetes" reboot="true" complexity="low" disruption="medium" strategy="disable">apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    systemd:
      units:
      - name: rpcgssd.service
        enabled: false
        mask: true
      - name: rpcgssd.socket
        enabled: false
        mask: true
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-service_rpcgssd_disabled:def:1" href="ssg-fedora-oval.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_service_rpcidmapd_disabled" selected="false" role="full" severity="unknown">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable RPC ID Mapping Service (rpcidmapd)</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The rpcidmapd service is used to map user names and groups to UID
and GID numbers on NFSv4 mounts. If NFS is not in use on the local system then
this service should be disabled.

The <html:code xmlns:html="http://www.w3.org/1999/xhtml">rpcidmapd</html:code> service can be disabled with the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo systemctl mask --now rpcidmapd.service</html:pre></description>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US"/>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="service_rpcidmapd_disabled" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

SYSTEMCTL_EXEC='/usr/bin/systemctl'
"$SYSTEMCTL_EXEC" stop 'rpcidmapd.service'
"$SYSTEMCTL_EXEC" disable 'rpcidmapd.service'
"$SYSTEMCTL_EXEC" mask 'rpcidmapd.service'
# Disable socket activation if we have a unit file for it
if "$SYSTEMCTL_EXEC" list-unit-files | grep -q '^rpcidmapd.socket'; then
    "$SYSTEMCTL_EXEC" stop 'rpcidmapd.socket'
    "$SYSTEMCTL_EXEC" mask 'rpcidmapd.socket'
fi
# The service may not be running because it has been started and failed,
# so let's reset the state so OVAL checks pass.
# Service should be 'inactive', not 'failed' after reboot though.
"$SYSTEMCTL_EXEC" reset-failed 'rpcidmapd.service' || true

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="service_rpcidmapd_disabled" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="disable">- name: Disable service rpcidmapd
  block:

    - name: Gather the service facts
      service_facts: null

    - name: Disable service rpcidmapd
      systemd:
        name: rpcidmapd.service
        enabled: 'no'
        state: stopped
        masked: 'yes'
      when: '"rpcidmapd.service" in ansible_facts.services'
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - disable_strategy
    - low_complexity
    - low_disruption
    - no_reboot_needed
    - service_rpcidmapd_disabled
    - unknown_severity

- name: Unit Socket Exists - rpcidmapd.socket
  command: systemctl list-unit-files rpcidmapd.socket
  args:
    warn: false
  register: socket_file_exists
  changed_when: false
  ignore_errors: true
  check_mode: false
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - disable_strategy
    - low_complexity
    - low_disruption
    - no_reboot_needed
    - service_rpcidmapd_disabled
    - unknown_severity

- name: Disable socket rpcidmapd
  systemd:
    name: rpcidmapd.socket
    enabled: 'no'
    state: stopped
    masked: 'yes'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - '"rpcidmapd.socket" in socket_file_exists.stdout_lines[1]'
  tags:
    - disable_strategy
    - low_complexity
    - low_disruption
    - no_reboot_needed
    - service_rpcidmapd_disabled
    - unknown_severity
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="service_rpcidmapd_disabled" system="urn:xccdf:fix:script:puppet" complexity="low" disruption="low" strategy="enable">include disable_rpcidmapd

class disable_rpcidmapd {
  service {'rpcidmapd':
    enable =&gt; false,
    ensure =&gt; 'stopped',
  }
}
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="service_rpcidmapd_disabled" system="urn:xccdf:fix:script:kubernetes" reboot="true" complexity="low" disruption="medium" strategy="disable">apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    systemd:
      units:
      - name: rpcidmapd.service
        enabled: false
        mask: true
      - name: rpcidmapd.socket
        enabled: false
        mask: true
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-service_rpcidmapd_disabled:def:1" href="ssg-fedora-oval.xml"/>
            </check>
          </Rule>
        </Group>
        <Group id="xccdf_org.ssgproject.content_group_disabling_netfs">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable netfs if Possible</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To determine if any network filesystems handled by netfs are
currently mounted on the system execute the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ mount -t nfs,nfs4,smbfs,cifs,ncpfs</html:pre>
If the command did not return any output then disable netfs.</description>
          <platform idref="cpe:/a:machine"/>
          <Rule id="xccdf_org.ssgproject.content_rule_service_netfs_disabled" selected="false" role="full" severity="unknown">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable Network File Systems (netfs)</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The netfs script manages the boot-time mounting of several types
of networked filesystems, of which NFS and Samba are the most common. If these
filesystem types are not in use, the script can be disabled, protecting the
system somewhat against accidental or malicious changes to <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/fstab</html:code>
and against flaws in the netfs script itself.

The <html:code xmlns:html="http://www.w3.org/1999/xhtml">netfs</html:code> service can be disabled with the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo systemctl mask --now netfs.service</html:pre></description>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US"/>
            <platform idref="cpe:/a:machine"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="service_netfs_disabled" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

SYSTEMCTL_EXEC='/usr/bin/systemctl'
"$SYSTEMCTL_EXEC" stop 'netfs.service'
"$SYSTEMCTL_EXEC" disable 'netfs.service'
"$SYSTEMCTL_EXEC" mask 'netfs.service'
# Disable socket activation if we have a unit file for it
if "$SYSTEMCTL_EXEC" list-unit-files | grep -q '^netfs.socket'; then
    "$SYSTEMCTL_EXEC" stop 'netfs.socket'
    "$SYSTEMCTL_EXEC" mask 'netfs.socket'
fi
# The service may not be running because it has been started and failed,
# so let's reset the state so OVAL checks pass.
# Service should be 'inactive', not 'failed' after reboot though.
"$SYSTEMCTL_EXEC" reset-failed 'netfs.service' || true

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="service_netfs_disabled" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="disable">- name: Disable service netfs
  block:

    - name: Gather the service facts
      service_facts: null

    - name: Disable service netfs
      systemd:
        name: netfs.service
        enabled: 'no'
        state: stopped
        masked: 'yes'
      when: '"netfs.service" in ansible_facts.services'
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - disable_strategy
    - low_complexity
    - low_disruption
    - no_reboot_needed
    - service_netfs_disabled
    - unknown_severity

- name: Unit Socket Exists - netfs.socket
  command: systemctl list-unit-files netfs.socket
  args:
    warn: false
  register: socket_file_exists
  changed_when: false
  ignore_errors: true
  check_mode: false
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - disable_strategy
    - low_complexity
    - low_disruption
    - no_reboot_needed
    - service_netfs_disabled
    - unknown_severity

- name: Disable socket netfs
  systemd:
    name: netfs.socket
    enabled: 'no'
    state: stopped
    masked: 'yes'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - '"netfs.socket" in socket_file_exists.stdout_lines[1]'
  tags:
    - disable_strategy
    - low_complexity
    - low_disruption
    - no_reboot_needed
    - service_netfs_disabled
    - unknown_severity
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="service_netfs_disabled" system="urn:xccdf:fix:script:puppet" complexity="low" disruption="low" strategy="enable">include disable_netfs

class disable_netfs {
  service {'netfs':
    enable =&gt; false,
    ensure =&gt; 'stopped',
  }
}
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="service_netfs_disabled" system="urn:xccdf:fix:script:kubernetes" reboot="true" complexity="low" disruption="medium" strategy="disable">apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    systemd:
      units:
      - name: netfs.service
        enabled: false
        mask: true
      - name: netfs.socket
        enabled: false
        mask: true
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-service_netfs_disabled:def:1" href="ssg-fedora-oval.xml"/>
            </check>
          </Rule>
        </Group>
      </Group>
    </Group>
    <Group id="xccdf_org.ssgproject.content_group_smb">
      <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Samba(SMB) Microsoft Windows File Sharing Server</title>
      <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">When properly configured, the Samba service allows
Linux systems to provide file and print sharing to Microsoft
Windows systems. There are two software packages that provide
Samba support. The first, <html:code xmlns:html="http://www.w3.org/1999/xhtml">samba-client</html:code>, provides a series of
command line tools that enable a client system to access Samba
shares. The second, simply labeled <html:code xmlns:html="http://www.w3.org/1999/xhtml">samba</html:code>, provides the Samba
service. It is this second package that allows a Linux system to
act as an Active Directory server, a domain controller, or as a
domain member. Only the <html:code xmlns:html="http://www.w3.org/1999/xhtml">samba-client</html:code> package is installed by
default.</description>
      <Group id="xccdf_org.ssgproject.content_group_configuring_samba">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Configure Samba if Necessary</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">All settings for the Samba daemon can be found in
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/samba/smb.conf</html:code>. Settings are divided between a
<html:code xmlns:html="http://www.w3.org/1999/xhtml">[global]</html:code> configuration section and a series of user
created share definition sections meant to describe file or print
shares on the system. By default, Samba will operate in user mode
and allow client systems to access local home directories and
printers. It is recommended that these settings be changed or that
additional limitations be set in place.</description>
        <Group id="xccdf_org.ssgproject.content_group_smb_disable_printing">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Restrict Printer Sharing</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">By default, Samba utilizes the CUPS printing service to enable
printer sharing with Microsoft Windows workstations. If there are no printers
on the local system, or if printer sharing with Microsoft Windows is not
required, disable the printer sharing capability by commenting out the
following lines, found in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/samba/smb.conf</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">[global]
  load printers = yes
  cups options = raw
[printers]
  comment = All Printers
  path = /usr/spool/samba
  browseable = no
  guest ok = no
  writable = no
  printable = yes</html:pre>
There may be other options present, but these are the only options enabled and
uncommented by default. Removing the <html:code xmlns:html="http://www.w3.org/1999/xhtml">[printers]</html:code> share should be enough
for most users.  If the Samba printer sharing capability is needed, consider
disabling the Samba network browsing capability or restricting access to a
particular set of users or network addresses. Set the <html:code xmlns:html="http://www.w3.org/1999/xhtml">valid users</html:code>
parameter to a small subset of users or restrict it to a particular group of
users with the shorthand <html:code xmlns:html="http://www.w3.org/1999/xhtml">@</html:code>. Separate each user or group of users with
a space. For example, under the <html:code xmlns:html="http://www.w3.org/1999/xhtml">[printers]</html:code> share:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">[printers]
  valid users = user @printerusers</html:pre></description>
        </Group>
        <Group id="xccdf_org.ssgproject.content_group_smb_restrict_file_sharing">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Restrict SMB File Sharing to Configured Networks</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Only users with local user accounts will be able to log in to
Samba shares by default. Shares can be limited to particular users or network
addresses. Use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">hosts allow</html:code> and <html:code xmlns:html="http://www.w3.org/1999/xhtml">hosts deny</html:code> directives
accordingly, and consider setting the valid users directive to a limited subset
of users or to a group of users. Separate each address, user, or user group
with a space as follows for a particular <html:i xmlns:html="http://www.w3.org/1999/xhtml">share</html:i> or global:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">[<html:i>share</html:i>]
  hosts allow = 192.168.1. 127.0.0.1
  valid users = userone usertwo @usergroup</html:pre>
It is also possible to limit read and write access to particular users with the
read list and write list options, though the permissions set by the system
itself will override these settings. Set the read only attribute for each share
to ensure that global settings will not accidentally override the individual
share settings. Then, as with the valid users directive, separate each user or
group of users with a space:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">[<html:i>share</html:i>]
  read only = yes
  write list = userone usertwo @usergroup</html:pre></description>
        </Group>
      </Group>
      <Group id="xccdf_org.ssgproject.content_group_disabling_samba">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable Samba if Possible</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Even after the Samba server package has been installed, it
will remain disabled. Do not enable this service unless it is
absolutely necessary to provide Microsoft Windows file and print
sharing functionality.</description>
      </Group>
    </Group>
    <Group id="xccdf_org.ssgproject.content_group_http">
      <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Web Server</title>
      <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The web server is responsible for providing access to
content via the HTTP protocol. Web servers represent a significant
security risk because:
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
<html:ul xmlns:html="http://www.w3.org/1999/xhtml"><html:li>The HTTP port is commonly probed by malicious sources</html:li><html:li>Web server software is very complex, and includes a long
history of vulnerabilities</html:li><html:li>The HTTP protocol is unencrypted and vulnerable to passive
monitoring</html:li></html:ul>
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
The system's default web server software is Apache 2 and is
provided in the RPM package <html:code xmlns:html="http://www.w3.org/1999/xhtml">httpd</html:code>.</description>
      <Group id="xccdf_org.ssgproject.content_group_disabling_httpd">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable Apache if Possible</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">If Apache was installed and activated, but the system
does not need to act as a web server, then it should be disabled
and removed from the system.</description>
      </Group>
      <Group id="xccdf_org.ssgproject.content_group_installing_httpd">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Install Apache if Necessary</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">If <html:code xmlns:html="http://www.w3.org/1999/xhtml">httpd</html:code> was not installed and activated, but the system
needs to act as a web server, then it should be installed on the system. Follow these
guidelines to install it defensively. The <html:code xmlns:html="http://www.w3.org/1999/xhtml">httpd</html:code> package can be installed with
the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo yum install httpd</html:pre>
This method of installation is recommended over installing the "Web Server"
package group during the system installation process. The Web Server package
group includes many packages which are likely extraneous, while the
command-line method installs only the required <html:code xmlns:html="http://www.w3.org/1999/xhtml">httpd</html:code> package itself.</description>
        <Group id="xccdf_org.ssgproject.content_group_httpd_minimal_modules_installed">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Confirm Minimal Built-in Modules Installed</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The default <html:code xmlns:html="http://www.w3.org/1999/xhtml">httpd</html:code> installation minimizes the number of
modules that are compiled directly into the binary (<html:code xmlns:html="http://www.w3.org/1999/xhtml">core prefork http_core
mod_so</html:code>). This minimizes risk by limiting the capabilities allowed by the
web server.

Query the set of compiled-in modules using the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ httpd -l</html:pre>
If the number of compiled-in modules is significantly larger than the
aforementioned set, this guide recommends re-installing <html:code xmlns:html="http://www.w3.org/1999/xhtml">httpd</html:code> with a
reduced configuration. Minimizing the number of modules that are compiled into
the <html:code xmlns:html="http://www.w3.org/1999/xhtml">httpd</html:code> binary, reduces risk by limiting the capabilities allowed by
the webserver.</description>
        </Group>
      </Group>
      <Group id="xccdf_org.ssgproject.content_group_securing_httpd">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Secure Apache Configuration</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">httpd</html:code> configuration file is
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/httpd/conf/httpd.conf</html:code>. Apply the recommendations in the remainder
of this section to this file.</description>
        <Value id="xccdf_org.ssgproject.content_value_var_httpd_loglevel" type="string">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">HTTPD Log Level</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The setting for LogLevel in /etc/httpd/conf/httpd.conf</description>
          <value selector="alert">alert</value>
          <value selector="crit">crit</value>
          <value>warn</value>
          <value selector="emerg">emerg</value>
          <value selector="error">error</value>
          <value selector="warn">warn</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_max_keepalive_requests" type="number">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Maximum KeepAlive Requests for HTTPD</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The setting for MaxKeepAliveRequests in httpd.conf</description>
          <value selector="100">100</value>
          <value selector="1000">1000</value>
          <value selector="10000">10000</value>
          <value selector="100000">100000</value>
          <value selector="500">500</value>
          <value>100</value>
        </Value>
        <Group id="xccdf_org.ssgproject.content_group_httpd_configure_php_securely">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Configure PHP Securely</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">PHP is a widely-used and often misconfigured server-side scripting language. It should
be used with caution, but configured appropriately when needed.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Review <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/php.ini</html:code> and make the following changes if possible:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml"># Do not expose PHP error messages to external users
display_errors = Off

# Enable safe mode
safe_mode = On

# Only allow access to executables in isolated directory
safe_mode_exec_dir = php-required-executables-path

# Limit external access to PHP environment
safe_mode_allowed_env_vars = PHP_

# Restrict PHP information leakage
expose_php = Off

# Log all errors
log_errors = On

# Do not register globals for input data
register_globals = Off

# Minimize allowable PHP post size
post_max_size = 1K

# Ensure PHP redirects appropriately
cgi.force_redirect = 0

# Disallow uploading unless necessary
file_uploads = Off

# Disallow treatment of file requests as fopen calls
allow_url_fopen = Off

# Enable SQL safe mode
sql.safe_mode = On
</html:pre></description>
        </Group>
        <Group id="xccdf_org.ssgproject.content_group_httpd_configure_os_protect_web_server">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Configure Operating System to Protect Web Server</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The following configuration steps should be taken on the system which hosts the
web server, in order to provide as safe an environment as possible for the web server.</description>
          <Group id="xccdf_org.ssgproject.content_group_httpd_restrict_file_dir_access">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Restrict File and Directory Access</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Minimize access to critical <html:code xmlns:html="http://www.w3.org/1999/xhtml">httpd</html:code> files and directories.</description>
          </Group>
          <Group id="xccdf_org.ssgproject.content_group_httpd_chroot">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Run httpd in a chroot Jail if Practical</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Running <html:code xmlns:html="http://www.w3.org/1999/xhtml">httpd</html:code> inside a <html:code xmlns:html="http://www.w3.org/1999/xhtml">chroot</html:code> jail is designed to isolate the
web server process to a small section of the filesystem, limiting the damage if
it is compromised. Versions of Apache greater than 2.2.10 (such as the one
included with Fedora) provide the <html:code xmlns:html="http://www.w3.org/1999/xhtml">ChrootDir</html:code> directive. To run Apache
inside a chroot jail in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/chroot/apache</html:code>, add the following line to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/httpd/conf/httpd.conf</html:code>: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">ChrootDir /chroot/apache</html:pre> This
necessitates placing all files required by <html:code xmlns:html="http://www.w3.org/1999/xhtml">httpd</html:code> inside
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/chroot/apache</html:code> , including <html:code xmlns:html="http://www.w3.org/1999/xhtml">httpd</html:code>'s binaries, modules,
configuration files, and served web pages. The details of this configuration
are beyond the scope of this guide. This may also require additional SELinux
configuration.</description>
          </Group>
        </Group>
        <Group id="xccdf_org.ssgproject.content_group_httpd_restrict_info_leakage">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Restrict Web Server Information Leakage</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">ServerTokens</html:code> and <html:code xmlns:html="http://www.w3.org/1999/xhtml">ServerSignature</html:code> directives determine how
much information the web server discloses about the configuration of the
system.</description>
        </Group>
        <Group id="xccdf_org.ssgproject.content_group_httpd_use_dos_protection_modules">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Use Denial-of-Service Protection Modules</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Denial-of-service attacks are difficult to detect and prevent while maintaining
acceptable access to authorized users. However, some traffic-shaping
modules can be used to address the problem. Well-known DoS protection modules include:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">mod_cband mod_bwshare mod_limitipconn mod_evasive</html:pre>
Denial-of-service prevention should be implemented for a web server if such a threat exists.
However, specific configuration details are very dependent on the environment and often best left
at the discretion of the administrator.</description>
        </Group>
        <Group id="xccdf_org.ssgproject.content_group_httpd_minimize_loadable_modules">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Minimize Web Server Loadable Modules</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">A default installation of <html:code xmlns:html="http://www.w3.org/1999/xhtml">httpd</html:code> includes a plethora of dynamically shared objects (DSO)
that are loaded at run-time. Unlike the aforementioned compiled-in modules, a DSO can be
disabled in the configuration file by removing the corresponding LoadModule directive.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Note: A DSO only provides additional functionality if associated directives are included
in the <html:code xmlns:html="http://www.w3.org/1999/xhtml">httpd</html:code> configuration file. It should also be noted that removing a DSO will produce
errors on <html:code xmlns:html="http://www.w3.org/1999/xhtml">httpd</html:code> startup if the configuration file contains directives that apply to that
module. Refer to <html:code xmlns:html="http://www.w3.org/1999/xhtml"><html:a href="http://httpd.apache.org/docs/">http://httpd.apache.org/docs/</html:a></html:code> for details on which directives
are associated with each DSO.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Following each DSO removal, the configuration can be tested with the following command
to check if everything still works:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo service httpd configtest</html:pre>
The purpose of each of the modules loaded by default will now be addressed one at a time.
If none of a module's directives are being used, remove it.</description>
          <Group id="xccdf_org.ssgproject.content_group_httpd_core_modules">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">httpd Core Modules</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">These modules comprise a basic subset of modules that are likely needed for base <html:code xmlns:html="http://www.w3.org/1999/xhtml">httpd</html:code>
functionality; ensure they are not commented out in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/httpd/conf/httpd.conf</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">LoadModule auth_basic_module modules/mod_auth_basic.so
LoadModule authn_default_module modules/mod_authn_default.so
LoadModule authz_host_module modules/mod_authz_host.so
LoadModule authz_user_module modules/mod_authz_user.so
LoadModule authz_groupfile_module modules/mod_authz_groupfile.so
LoadModule authz_default_module modules/mod_authz_default.so
LoadModule log_config_module modules/mod_log_config.so
LoadModule logio_module modules/mod_logio.so
LoadModule setenvif_module modules/mod_setenvif.so
LoadModule mime_module modules/mod_mome.so
LoadModule autoindex_module modules/mod_autoindex.so
LoadModule negotiation_module modules/mod_negotiation.so
LoadModule dir_module modules/mod_dir.so
LoadModule alias_module modules/mod_alias.so</html:pre>
Minimizing the number of loadable modules available to the web server reduces risk
by limiting the capabilities allowed by the web server.</description>
            <Group id="xccdf_org.ssgproject.content_group_httpd_optional_components">
              <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Minimize Various Optional Components</title>
              <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The following modules perform very specific tasks, sometimes providing access to
just a few additional directives. If such functionality is not required (or if you
are not using these directives), comment out the associated module:
<html:ul xmlns:html="http://www.w3.org/1999/xhtml"><html:li>External filtering (response passed through external program prior to client delivery)
<html:pre>#LoadModule ext_filter_module modules/mod_ext_filter.so</html:pre></html:li><html:li>User-specified Cache Control and Expiration
<html:pre>#LoadModule expires_module modules/mod_expires.so</html:pre></html:li><html:li>Compression Output Filter (provides content compression prior to client delivery)
<html:pre>#LoadModule deflate_module modules/mod_deflate.so</html:pre></html:li><html:li>HTTP Response/Request Header Customization
<html:pre>#LoadModule headers_module modules/mod_headers.so</html:pre></html:li><html:li>User activity monitoring via cookies
<html:pre>#LoadModule usertrack_module modules/mod_usertrack.so</html:pre></html:li><html:li>Dynamically configured mass virtual hosting
<html:pre>#LoadModule vhost_alias_module modules/mod_vhost_alias.so</html:pre></html:li></html:ul>
Minimizing the number of loadable modules available to the web server reduces risk
by limiting the capabilities allowed by the web server.</description>
            </Group>
            <Group id="xccdf_org.ssgproject.content_group_httpd_basic_authentication">
              <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Minimize Modules for HTTP Basic Authentication</title>
              <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The following modules are necessary if this web server will provide content that will
be restricted by a password.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Authentication can be performed using local plain text password files (<html:code xmlns:html="http://www.w3.org/1999/xhtml">authn_file</html:code>),
local DBM password files (<html:code xmlns:html="http://www.w3.org/1999/xhtml">authn_dbm</html:code>) or an LDAP directory. The only module required by
the web server depends on your choice of authentication. Comment out the modules you don't
need from the following:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">LoadModule authn_file_module modules/mod_authn_file.so
LoadModule authn_dbm_module modules/mod_authn_dbm.so</html:pre>
<html:code xmlns:html="http://www.w3.org/1999/xhtml">authn_alias</html:code> allows for authentication based on aliases. <html:code xmlns:html="http://www.w3.org/1999/xhtml">authn_anon</html:code>
allows anonymous authentication similar to that of anonymous ftp sites. <html:code xmlns:html="http://www.w3.org/1999/xhtml">authz_owner</html:code>
allows authorization based on file ownership. <html:code xmlns:html="http://www.w3.org/1999/xhtml">authz_dbm</html:code> allows for authorization
based on group membership if the web server is using DBM authentication.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
If the above functionality is unnecessary, comment out the related module:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">#LoadModule authn_alias_module modules/mod_authn_alias.so
#LoadModule authn_anon_module modules/mod_authn_anon.so
#LoadModule authz_owner_module modules/mod_authz_owner.so
#LoadModule authz_dbm_module modules/mod_authz_dbm.so</html:pre></description>
            </Group>
            <Group id="xccdf_org.ssgproject.content_group_httpd_minimize_config_files_included">
              <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Minimize Configuration Files Included</title>
              <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">Include</html:code> directive directs <html:code xmlns:html="http://www.w3.org/1999/xhtml">httpd</html:code> to load supplementary configuration files
from a provided path. The default configuration loads all files that end in <html:code xmlns:html="http://www.w3.org/1999/xhtml">.conf</html:code>
from the <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/httpd/conf.d</html:code> directory.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
To restrict excess configuration, the following line should be commented out and
replaced with <html:code xmlns:html="http://www.w3.org/1999/xhtml">Include</html:code> directives that only reference required configuration files:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">#Include conf.d/*.conf</html:pre>
If the above change was made, ensure that the SSL encryption remains loaded by
explicitly including the corresponding configuration file:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">Include conf.d/ssl.conf</html:pre>
If PHP is necessary, a similar alteration must be made:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">Include conf.d/php.conf</html:pre>

Explicitly listing the configuration files to be loaded during web server start-up avoids
the possibility of unwanted or malicious configuration files to be automatically included as
part of the server's running configuration.</description>
            </Group>
          </Group>
        </Group>
        <Group id="xccdf_org.ssgproject.content_group_httpd_modules_improve_security">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Use Appropriate Modules to Improve httpd's Security</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Among the modules available for <html:code xmlns:html="http://www.w3.org/1999/xhtml">httpd</html:code> are several whose use may improve the
security of the web server installation. This section recommends and discusses
the deployment of security-relevant modules.</description>
          <Group id="xccdf_org.ssgproject.content_group_httpd_deploy_mod_ssl">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Deploy mod_ssl</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Because HTTP is a plain text protocol, all traffic is susceptible to passive
monitoring. If there is a need for confidentiality, SSL should be configured
and enabled to encrypt content.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Note: <html:code xmlns:html="http://www.w3.org/1999/xhtml">mod_nss</html:code> is a FIPS 140-2 certified alternative to <html:code xmlns:html="http://www.w3.org/1999/xhtml">mod_ssl</html:code>.
The modules share a considerable amount of code and should be nearly identical
in functionality. If FIPS 140-2 validation is required, then <html:code xmlns:html="http://www.w3.org/1999/xhtml">mod_nss</html:code> should
be used. If it provides some feature or its greater compatibility is required,
then <html:code xmlns:html="http://www.w3.org/1999/xhtml">mod_ssl</html:code> should be used.</description>
          </Group>
          <Group id="xccdf_org.ssgproject.content_group_httpd_deploy_mod_security">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Deploy mod_security</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">security</html:code> module provides an application level firewall for <html:code xmlns:html="http://www.w3.org/1999/xhtml">httpd</html:code>.
Following its installation with the base ruleset, specific configuration advice can be found at

    <html:a xmlns:html="http://www.w3.org/1999/xhtml" href="http://www.modsecurity.org/">http://www.modsecurity.org/</html:a> to design a policy that best matches the security needs of
the web applications. Usage of <html:code xmlns:html="http://www.w3.org/1999/xhtml">mod_security</html:code> is highly recommended for some environments,
but it should be noted this module does not ship with Red Hat Enterprise Linux itself,
and instead is provided via Extra Packages for Enterprise Linux (EPEL).
For more information on EPEL please refer to 
    <html:a xmlns:html="http://www.w3.org/1999/xhtml" href="http://fedoraproject.org/wiki/EPEL">http://fedoraproject.org/wiki/EPEL</html:a>.</description>
          </Group>
        </Group>
        <Group id="xccdf_org.ssgproject.content_group_httpd_directory_restrictions">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Directory Restrictions</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The Directory tags in the web server configuration file allow finer grained access
control for a specified directory. All web directories should be configured on a
case-by-case basis, allowing access only where needed.</description>
        </Group>
        <Group id="xccdf_org.ssgproject.content_group_httpd_secure_content">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Configure HTTPD-Served Web Content Securely</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Running <html:code xmlns:html="http://www.w3.org/1999/xhtml">httpd</html:code> inside a <html:code xmlns:html="http://www.w3.org/1999/xhtml">chroot</html:code> jail is designed to isolate the
web server process to a small section of the filesystem, limiting the damage if
it is compromised. Versions of Apache greater than 2.2.10 (such as the one
included with Red Hat Enterprise Linux 7) provide the <html:code xmlns:html="http://www.w3.org/1999/xhtml">ChrootDir</html:code> directive. To run Apache
inside a chroot jail in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/chroot/apache</html:code>, add the following line to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/httpd/conf/httpd.conf</html:code>: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">ChrootDir /chroot/apache</html:pre> This
necessitates placing all files required by <html:code xmlns:html="http://www.w3.org/1999/xhtml">httpd</html:code> inside
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/chroot/apache</html:code> , including <html:code xmlns:html="http://www.w3.org/1999/xhtml">httpd</html:code>'s binaries, modules,
configuration files, and served web pages. The details of this configuration
are beyond the scope of this guide. This may also require additional SELinux
configuration.</description>
          <Value id="xccdf_org.ssgproject.content_value_var_web_login_banner_text" type="string">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Web Login Banner Verbiage</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Enter an appropriate login banner for your organization. Please note that new lines must
be expressed by the '\n' character and special characters like parentheses and quotation marks must be escaped with '\\'.</description>
            <value selector="dod_banners">^(You[\s\n]+are[\s\n]+accessing[\s\n]+a[\s\n]+U\.S\.[\s\n]+Government[\s\n]+\(USG\)[\s\n]+Information[\s\n]+System[\s\n]+\(IS\)[\s\n]+that[\s\n]+is[\s\n]+provided[\s\n]+for[\s\n]+USG\-authorized[\s\n]+use[\s\n]+only\.[\s\n]+By[\s\n]+using[\s\n]+this[\s\n]+IS[\s\n]+\(which[\s\n]+includes[\s\n]+any[\s\n]+device[\s\n]+attached[\s\n]+to[\s\n]+this[\s\n]+IS\)\,[\s\n]+you[\s\n]+consent[\s\n]+to[\s\n]+the[\s\n]+following[\s\n]+conditions\:(?:[\n]+|(?:\\n)+)\-The[\s\n]+USG[\s\n]+routinely[\s\n]+intercepts[\s\n]+and[\s\n]+monitors[\s\n]+communications[\s\n]+on[\s\n]+this[\s\n]+IS[\s\n]+for[\s\n]+purposes[\s\n]+including\,[\s\n]+but[\s\n]+not[\s\n]+limited[\s\n]+to\,[\s\n]+penetration[\s\n]+testing\,[\s\n]+COMSEC[\s\n]+monitoring\,[\s\n]+network[\s\n]+operations[\s\n]+and[\s\n]+defense\,[\s\n]+personnel[\s\n]+misconduct[\s\n]+\(PM\)\,[\s\n]+law[\s\n]+enforcement[\s\n]+\(LE\)\,[\s\n]+and[\s\n]+counterintelligence[\s\n]+\(CI\)[\s\n]+investigations\.(?:[\n]+|(?:\\n)+)\-At[\s\n]+any[\s\n]+time\,[\s\n]+the[\s\n]+USG[\s\n]+may[\s\n]+inspect[\s\n]+and[\s\n]+seize[\s\n]+data[\s\n]+stored[\s\n]+on[\s\n]+this[\s\n]+IS\.(?:[\n]+|(?:\\n)+)\-Communications[\s\n]+using\,[\s\n]+or[\s\n]+data[\s\n]+stored[\s\n]+on\,[\s\n]+this[\s\n]+IS[\s\n]+are[\s\n]+not[\s\n]+private\,[\s\n]+are[\s\n]+subject[\s\n]+to[\s\n]+routine[\s\n]+monitoring\,[\s\n]+interception\,[\s\n]+and[\s\n]+search\,[\s\n]+and[\s\n]+may[\s\n]+be[\s\n]+disclosed[\s\n]+or[\s\n]+used[\s\n]+for[\s\n]+any[\s\n]+USG\-authorized[\s\n]+purpose\.(?:[\n]+|(?:\\n)+)\-This[\s\n]+IS[\s\n]+includes[\s\n]+security[\s\n]+measures[\s\n]+\(e\.g\.\,[\s\n]+authentication[\s\n]+and[\s\n]+access[\s\n]+controls\)[\s\n]+to[\s\n]+protect[\s\n]+USG[\s\n]+interests\-\-not[\s\n]+for[\s\n]+your[\s\n]+personal[\s\n]+benefit[\s\n]+or[\s\n]+privacy\.(?:[\n]+|(?:\\n)+)\-Notwithstanding[\s\n]+the[\s\n]+above\,[\s\n]+using[\s\n]+this[\s\n]+IS[\s\n]+does[\s\n]+not[\s\n]+constitute[\s\n]+consent[\s\n]+to[\s\n]+PM\,[\s\n]+LE[\s\n]+or[\s\n]+CI[\s\n]+investigative[\s\n]+searching[\s\n]+or[\s\n]+monitoring[\s\n]+of[\s\n]+the[\s\n]+content[\s\n]+of[\s\n]+privileged[\s\n]+communications\,[\s\n]+or[\s\n]+work[\s\n]+product\,[\s\n]+related[\s\n]+to[\s\n]+personal[\s\n]+representation[\s\n]+or[\s\n]+services[\s\n]+by[\s\n]+attorneys\,[\s\n]+psychotherapists\,[\s\n]+or[\s\n]+clergy\,[\s\n]+and[\s\n]+their[\s\n]+assistants\.[\s\n]+Such[\s\n]+communications[\s\n]+and[\s\n]+work[\s\n]+product[\s\n]+are[\s\n]+private[\s\n]+and[\s\n]+confidential\.[\s\n]+See[\s\n]+User[\s\n]+Agreement[\s\n]+for[\s\n]+details\.|I've[\s\n]+read[\s\n]+\&amp;[\s\n]+consent[\s\n]+to[\s\n]+terms[\s\n]+in[\s\n]+IS[\s\n]+user[\s\n]+agreem't\.)$</value>
            <value selector="dod_default">^You[\s\n]+are[\s\n]+accessing[\s\n]+a[\s\n]+U\.S\.[\s\n]+Government[\s\n]+\(USG\)[\s\n]+Information[\s\n]+System[\s\n]+\(IS\)[\s\n]+that[\s\n]+is[\s\n]+provided[\s\n]+for[\s\n]+USG\-authorized[\s\n]+use[\s\n]+only\.[\s\n]+By[\s\n]+using[\s\n]+this[\s\n]+IS[\s\n]+\(which[\s\n]+includes[\s\n]+any[\s\n]+device[\s\n]+attached[\s\n]+to[\s\n]+this[\s\n]+IS\)\,[\s\n]+you[\s\n]+consent[\s\n]+to[\s\n]+the[\s\n]+following[\s\n]+conditions\:(?:[\n]+|(?:\\n)+)\-The[\s\n]+USG[\s\n]+routinely[\s\n]+intercepts[\s\n]+and[\s\n]+monitors[\s\n]+communications[\s\n]+on[\s\n]+this[\s\n]+IS[\s\n]+for[\s\n]+purposes[\s\n]+including\,[\s\n]+but[\s\n]+not[\s\n]+limited[\s\n]+to\,[\s\n]+penetration[\s\n]+testing\,[\s\n]+COMSEC[\s\n]+monitoring\,[\s\n]+network[\s\n]+operations[\s\n]+and[\s\n]+defense\,[\s\n]+personnel[\s\n]+misconduct[\s\n]+\(PM\)\,[\s\n]+law[\s\n]+enforcement[\s\n]+\(LE\)\,[\s\n]+and[\s\n]+counterintelligence[\s\n]+\(CI\)[\s\n]+investigations\.(?:[\n]+|(?:\\n)+)\-At[\s\n]+any[\s\n]+time\,[\s\n]+the[\s\n]+USG[\s\n]+may[\s\n]+inspect[\s\n]+and[\s\n]+seize[\s\n]+data[\s\n]+stored[\s\n]+on[\s\n]+this[\s\n]+IS\.(?:[\n]+|(?:\\n)+)\-Communications[\s\n]+using\,[\s\n]+or[\s\n]+data[\s\n]+stored[\s\n]+on\,[\s\n]+this[\s\n]+IS[\s\n]+are[\s\n]+not[\s\n]+private\,[\s\n]+are[\s\n]+subject[\s\n]+to[\s\n]+routine[\s\n]+monitoring\,[\s\n]+interception\,[\s\n]+and[\s\n]+search\,[\s\n]+and[\s\n]+may[\s\n]+be[\s\n]+disclosed[\s\n]+or[\s\n]+used[\s\n]+for[\s\n]+any[\s\n]+USG\-authorized[\s\n]+purpose\.(?:[\n]+|(?:\\n)+)\-This[\s\n]+IS[\s\n]+includes[\s\n]+security[\s\n]+measures[\s\n]+\(e\.g\.\,[\s\n]+authentication[\s\n]+and[\s\n]+access[\s\n]+controls\)[\s\n]+to[\s\n]+protect[\s\n]+USG[\s\n]+interests\-\-not[\s\n]+for[\s\n]+your[\s\n]+personal[\s\n]+benefit[\s\n]+or[\s\n]+privacy\.(?:[\n]+|(?:\\n)+)\-Notwithstanding[\s\n]+the[\s\n]+above\,[\s\n]+using[\s\n]+this[\s\n]+IS[\s\n]+does[\s\n]+not[\s\n]+constitute[\s\n]+consent[\s\n]+to[\s\n]+PM\,[\s\n]+LE[\s\n]+or[\s\n]+CI[\s\n]+investigative[\s\n]+searching[\s\n]+or[\s\n]+monitoring[\s\n]+of[\s\n]+the[\s\n]+content[\s\n]+of[\s\n]+privileged[\s\n]+communications\,[\s\n]+or[\s\n]+work[\s\n]+product\,[\s\n]+related[\s\n]+to[\s\n]+personal[\s\n]+representation[\s\n]+or[\s\n]+services[\s\n]+by[\s\n]+attorneys\,[\s\n]+psychotherapists\,[\s\n]+or[\s\n]+clergy\,[\s\n]+and[\s\n]+their[\s\n]+assistants\.[\s\n]+Such[\s\n]+communications[\s\n]+and[\s\n]+work[\s\n]+product[\s\n]+are[\s\n]+private[\s\n]+and[\s\n]+confidential\.[\s\n]+See[\s\n]+User[\s\n]+Agreement[\s\n]+for[\s\n]+details\.$</value>
            <value selector="dod_short">^I've[\s\n]+read[\s\n]+\&amp;[\s\n]+consent[\s\n]+to[\s\n]+terms[\s\n]+in[\s\n]+IS[\s\n]+user[\s\n]+agreem't\.$</value>
            <value selector="dss_odaa_default">^Use[\s\n]+of[\s\n]+this[\s\n]+or[\s\n]+any[\s\n]+other[\s\n]+DoD[\s\n]+interest[\s\n]+computer[\s\n]+system[\s\n]+constitutes[\s\n]+consent[\s\n]+to[\s\n]+monitoring[\s\n]+at[\s\n]+all[\s\n]+times\.[\s\n]+This[\s\n]+is[\s\n]+a[\s\n]+DoD[\s\n]+interest[\s\n]+computer[\s\n]+system\.[\s\n]+All[\s\n]+DoD[\s\n]+interest[\s\n]+computer[\s\n]+systems[\s\n]+and[\s\n]+related[\s\n]+equipment[\s\n]+are[\s\n]+intended[\s\n]+for[\s\n]+the[\s\n]+communication\,[\s\n]+transmission\,[\s\n]+processing\,[\s\n]+and[\s\n]+storage[\s\n]+of[\s\n]+official[\s\n]+U\.S\.[\s\n]+Government[\s\n]+or[\s\n]+other[\s\n]+authorized[\s\n]+information[\s\n]+only\.[\s\n]+All[\s\n]+DoD[\s\n]+interest[\s\n]+computer[\s\n]+systems[\s\n]+are[\s\n]+subject[\s\n]+to[\s\n]+monitoring[\s\n]+at[\s\n]+all[\s\n]+times[\s\n]+to[\s\n]+ensure[\s\n]+proper[\s\n]+functioning[\s\n]+of[\s\n]+equipment[\s\n]+and[\s\n]+systems[\s\n]+including[\s\n]+security[\s\n]+devices[\s\n]+and[\s\n]+systems\,[\s\n]+to[\s\n]+prevent[\s\n]+unauthorized[\s\n]+use[\s\n]+and[\s\n]+violations[\s\n]+of[\s\n]+statutes[\s\n]+and[\s\n]+security[\s\n]+regulations\,[\s\n]+to[\s\n]+deter[\s\n]+criminal[\s\n]+activity\,[\s\n]+and[\s\n]+for[\s\n]+other[\s\n]+similar[\s\n]+purposes\.[\s\n]+Any[\s\n]+user[\s\n]+of[\s\n]+a[\s\n]+DoD[\s\n]+interest[\s\n]+computer[\s\n]+system[\s\n]+should[\s\n]+be[\s\n]+aware[\s\n]+that[\s\n]+any[\s\n]+information[\s\n]+placed[\s\n]+in[\s\n]+the[\s\n]+system[\s\n]+is[\s\n]+subject[\s\n]+to[\s\n]+monitoring[\s\n]+and[\s\n]+is[\s\n]+not[\s\n]+subject[\s\n]+to[\s\n]+any[\s\n]+expectation[\s\n]+of[\s\n]+privacy\.[\s\n]+If[\s\n]+monitoring[\s\n]+of[\s\n]+this[\s\n]+or[\s\n]+any[\s\n]+other[\s\n]+DoD[\s\n]+interest[\s\n]+computer[\s\n]+system[\s\n]+reveals[\s\n]+possible[\s\n]+evidence[\s\n]+of[\s\n]+violation[\s\n]+of[\s\n]+criminal[\s\n]+statutes\,[\s\n]+this[\s\n]+evidence[\s\n]+and[\s\n]+any[\s\n]+other[\s\n]+related[\s\n]+information\,[\s\n]+including[\s\n]+identification[\s\n]+information[\s\n]+about[\s\n]+the[\s\n]+user\,[\s\n]+may[\s\n]+be[\s\n]+provided[\s\n]+to[\s\n]+law[\s\n]+enforcement[\s\n]+officials\.[\s\n]+If[\s\n]+monitoring[\s\n]+of[\s\n]+this[\s\n]+or[\s\n]+any[\s\n]+other[\s\n]+DoD[\s\n]+interest[\s\n]+computer[\s\n]+systems[\s\n]+reveals[\s\n]+violations[\s\n]+of[\s\n]+security[\s\n]+regulations[\s\n]+or[\s\n]+unauthorized[\s\n]+use\,[\s\n]+employees[\s\n]+who[\s\n]+violate[\s\n]+security[\s\n]+regulations[\s\n]+or[\s\n]+make[\s\n]+unauthorized[\s\n]+use[\s\n]+of[\s\n]+DoD[\s\n]+interest[\s\n]+computer[\s\n]+systems[\s\n]+are[\s\n]+subject[\s\n]+to[\s\n]+appropriate[\s\n]+disciplinary[\s\n]+action\.[\s\n]+Use[\s\n]+of[\s\n]+this[\s\n]+or[\s\n]+any[\s\n]+other[\s\n]+DoD[\s\n]+interest[\s\n]+computer[\s\n]+system[\s\n]+constitutes[\s\n]+consent[\s\n]+to[\s\n]+monitoring[\s\n]+at[\s\n]+all[\s\n]+times\.$</value>
            <value selector="usgcb_default">^\-\-[\s\n]+WARNING[\s\n]+\-\-[\s\n]+This[\s\n]+system[\s\n]+is[\s\n]+for[\s\n]+the[\s\n]+use[\s\n]+of[\s\n]+authorized[\s\n]+users[\s\n]+only\.[\s\n]+Individuals[\s\n]+using[\s\n]+this[\s\n]+computer[\s\n]+system[\s\n]+without[\s\n]+authority[\s\n]+or[\s\n]+in[\s\n]+excess[\s\n]+of[\s\n]+their[\s\n]+authority[\s\n]+are[\s\n]+subject[\s\n]+to[\s\n]+having[\s\n]+all[\s\n]+their[\s\n]+activities[\s\n]+on[\s\n]+this[\s\n]+system[\s\n]+monitored[\s\n]+and[\s\n]+recorded[\s\n]+by[\s\n]+system[\s\n]+personnel\.[\s\n]+Anyone[\s\n]+using[\s\n]+this[\s\n]+system[\s\n]+expressly[\s\n]+consents[\s\n]+to[\s\n]+such[\s\n]+monitoring[\s\n]+and[\s\n]+is[\s\n]+advised[\s\n]+that[\s\n]+if[\s\n]+such[\s\n]+monitoring[\s\n]+reveals[\s\n]+possible[\s\n]+evidence[\s\n]+of[\s\n]+criminal[\s\n]+activity[\s\n]+system[\s\n]+personal[\s\n]+may[\s\n]+provide[\s\n]+the[\s\n]+evidence[\s\n]+of[\s\n]+such[\s\n]+monitoring[\s\n]+to[\s\n]+law[\s\n]+enforcement[\s\n]+officials\.$</value>
          </Value>
        </Group>
        <Group id="xccdf_org.ssgproject.content_group_httpd_configure_perl_securely">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Configure PERL Securely</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">PERL (Practical Extraction and Report Language) is an interpreted language
optimized for scanning arbitrary text files, extracting information from those
text files, and printing reports based on that information. The language is
often used in shell scripting and is intended to be practical, easy to use, and
efficient means of generating interactive web pages for the user.</description>
        </Group>
      </Group>
    </Group>
    <Group id="xccdf_org.ssgproject.content_group_xwindows">
      <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">X Window System</title>
      <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The X Window System implementation included with the
system is called X.org.</description>
      <Group id="xccdf_org.ssgproject.content_group_disabling_xwindows">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable X Windows</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Unless there is a mission-critical reason for the
system to run a graphical user interface, ensure X is not set to start
automatically at boot and remove the X Windows software packages.
There is usually no reason to run X Windows
on a dedicated server system, as it increases the system's attack surface and consumes
system resources. Administrators of server systems should instead login via
SSH or on the text console.</description>
        <Rule id="xccdf_org.ssgproject.content_rule_package_xorg-x11-server-common_removed" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Remove the X Windows Package Group</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">By removing the xorg-x11-server-common package, the system no longer has X Windows
installed. If X Windows is not installed then the system cannot boot into graphical user mode.
This prevents the system from being accidentally or maliciously booted into a <html:code xmlns:html="http://www.w3.org/1999/xhtml">graphical.target</html:code>
mode. To do so, run the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo dnf groupremove "X Window System"</html:pre>
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo dnf remove xorg-x11-server-common</html:pre></description>
          <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="functionality">The installation and use of a Graphical User Interface (GUI) increases your attack vector and decreases your
overall security posture. Removing the package xorg-x11-server-common package will remove the graphical target
which might bring your system to an inconsistent state requiring additional configuration to access the system
again. If a GUI is an operational requirement, a tailored profile that removes this rule should used before
continuing installation.</warning>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS01.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.03</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.11.2.6</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.6.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.6.2.2</reference>
          <reference href="https://www.cisecurity.org/controls/">12</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">8</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Unnecessary service packages must not be installed to decrease the attack surface of the system. X windows has a long history of security
vulnerabilities and should not be installed unless approved and documented.</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_xorg-x11-server-common_removed" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="disable">
# CAUTION: This remediation script will remove xorg-x11-server-common
#	   from the system, and may remove any packages
#	   that depend on xorg-x11-server-common. Execute this
#	   remediation AFTER testing on a non-production
#	   system!

if rpm -q --quiet "xorg-x11-server-common" ; then
    dnf remove -y "xorg-x11-server-common"
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_xorg-x11-server-common_removed" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="disable">- name: Ensure xorg-x11-server-common is removed
  package:
    name: xorg-x11-server-common
    state: absent
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - disable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - package_xorg-x11-server-common_removed
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_xorg-x11-server-common_removed" system="urn:xccdf:fix:script:puppet" complexity="low" disruption="low" strategy="disable">include remove_xorg-x11-server-common

class remove_xorg-x11-server-common {
  package { 'xorg-x11-server-common':
    ensure =&gt; 'purged',
  }
}
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_xorg-x11-server-common_removed" system="urn:redhat:anaconda:pre" complexity="low" disruption="low" strategy="disable">
package --remove=xorg-x11-server-common
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-package_xorg-x11-server-common_removed:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-package_xorg-x11-server-common_removed_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_xwindows_runlevel_target" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable X Windows Startup By Setting Default Target</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Systems that do not require a graphical user interface should only boot by
default into <html:code xmlns:html="http://www.w3.org/1999/xhtml">multi-user.target</html:code> mode. This prevents accidental booting of the system
into a <html:code xmlns:html="http://www.w3.org/1999/xhtml">graphical.target</html:code> mode. Setting the system's default target to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">multi-user.target</html:code> will prevent automatic startup of the X server. To do so, run:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ systemctl set-default multi-user.target</html:pre>
You should see the following output:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">Removed symlink /etc/systemd/system/default.target.
Created symlink from /etc/systemd/system/default.target to /usr/lib/systemd/system/multi-user.target.</html:pre></description>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS01.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.03</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.11.2.6</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.6.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.6.2.2</reference>
          <reference href="https://www.cisecurity.org/controls/">12</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">8</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Services that are not required for system and application processes
must not be active to decrease the attack surface of the system. X windows has a
long history of security vulnerabilities and should not be used unless approved
and documented.</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="xwindows_runlevel_target" system="urn:xccdf:fix:script:sh" reboot="true" complexity="low" disruption="low" strategy="restrict">
systemctl set-default multi-user.target
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="xwindows_runlevel_target" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="low" strategy="restrict">- name: Switch to multi-user runlevel
  file:
    src: /usr/lib/systemd/system/multi-user.target
    dest: /etc/systemd/system/default.target
    state: link
    force: true
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
    - xwindows_runlevel_target
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-xwindows_runlevel_target:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-xwindows_runlevel_target_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
      </Group>
    </Group>
    <Group id="xccdf_org.ssgproject.content_group_kerberos">
      <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Kerberos</title>
      <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The Kerberos protocol is used for authentication across
non-secure network. Authentication can happen between
various types of principals -- users, service, or hosts.
Their identity and encryption keys can be stored in keytab
files.</description>
      <platform idref="cpe:/a:machine"/>
      <Rule id="xccdf_org.ssgproject.content_rule_kerberos_disable_no_keytab" selected="false" role="full" severity="medium">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable Kerberos by removing host keytab</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Kerberos is not an approved key distribution method for
Common Criteria. To prevent using Kerberos by system daemons,
remove the Kerberos keytab files, especially
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/krb5.keytab</html:code>.</description>
        <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FTP_ITC_EXT.1</reference>
        <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000120-GPOS-00061</reference>
        <reference href="">0418</reference>
        <reference href="">1055</reference>
        <reference href="">1402</reference>
        <reference href="https://public.cyber.mil/stigs/cci/">CCI-000803</reference>
        <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The key derivation function (KDF) in Kerberos is not FIPS compatible.</rationale>
        <platform idref="cpe:/a:machine"/>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="kerberos_disable_no_keytab" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

rm -f /etc/*.keytab

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref name="oval:ssg-kerberos_disable_no_keytab:def:1" href="ssg-fedora-oval.xml"/>
        </check>
        <check system="http://scap.nist.gov/schema/ocil/2">
          <check-content-ref name="ocil:ssg-kerberos_disable_no_keytab_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
        </check>
      </Rule>
    </Group>
    <Group id="xccdf_org.ssgproject.content_group_ftp">
      <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">FTP Server</title>
      <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">FTP is a common method for allowing remote access to
files. Like telnet, the FTP protocol is unencrypted, which means
that passwords and other data transmitted during the session can be
captured and that the session is vulnerable to hijacking.
Therefore, running the FTP server software is not recommended.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
However, there are some FTP server configurations which may
be appropriate for some environments, particularly those which
allow only read-only anonymous access as a means of downloading
data available to the public.</description>
      <Group id="xccdf_org.ssgproject.content_group_disabling_vsftpd">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable vsftpd if Possible</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To minimize attack surface, disable vsftpd if at all
possible.</description>
        <Rule id="xccdf_org.ssgproject.content_rule_package_vsftpd_removed" selected="false" role="full" severity="high">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Uninstall vsftpd Package</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">vsftpd</html:code> package can be removed with the following command: <html:pre xmlns:html="http://www.w3.org/1999/xhtml"> $ sudo dnf erase vsftpd</html:pre></description>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-000197</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-000381</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000074-GPOS-00042</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000095-GPOS-00049</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.11</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.12</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.3</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.06</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.5.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.6.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.2.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.2.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
          <reference href="https://www.cisecurity.org/controls/">11</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">9</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Removing the <html:code xmlns:html="http://www.w3.org/1999/xhtml">vsftpd</html:code> package decreases the risk of its
accidental activation.</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_vsftpd_removed" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="disable">
# CAUTION: This remediation script will remove vsftpd
#	   from the system, and may remove any packages
#	   that depend on vsftpd. Execute this
#	   remediation AFTER testing on a non-production
#	   system!

if rpm -q --quiet "vsftpd" ; then
    dnf remove -y "vsftpd"
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_vsftpd_removed" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="disable">- name: Ensure vsftpd is removed
  package:
    name: vsftpd
    state: absent
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - disable_strategy
    - high_severity
    - low_complexity
    - low_disruption
    - no_reboot_needed
    - package_vsftpd_removed
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_vsftpd_removed" system="urn:xccdf:fix:script:puppet" complexity="low" disruption="low" strategy="disable">include remove_vsftpd

class remove_vsftpd {
  package { 'vsftpd':
    ensure =&gt; 'purged',
  }
}
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_vsftpd_removed" system="urn:redhat:anaconda:pre" complexity="low" disruption="low" strategy="disable">
package --remove=vsftpd
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-package_vsftpd_removed:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-package_vsftpd_removed_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
      </Group>
      <Group id="xccdf_org.ssgproject.content_group_ftp_configure_vsftpd">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Configure vsftpd to Provide FTP Service if Necessary</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The primary vsftpd configuration file is
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/vsftpd.conf</html:code>, if that file exists, or
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/vsftpd/vsftpd.conf</html:code> if it does not.</description>
        <Rule id="xccdf_org.ssgproject.content_rule_ftp_present_banner" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Create Warning Banners for All FTP Users</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">
Edit the vsftpd configuration file, which resides at <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/vsftpd/vsftpd.conf</html:code>

by default. Add or correct the following configuration options:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">banner_file=/etc/issue</html:pre></description>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-000048</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">This setting will cause the system greeting banner to be used for FTP connections as well.</rationale>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-ftp_present_banner:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-ftp_present_banner_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_ftp_disable_uploads" selected="false" role="full" severity="unknown">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable FTP Uploads if Possible</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Is there a mission-critical reason for users to upload files via FTP? If not,
edit the vsftpd configuration file to add or correct the following configuration options:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">write_enable=NO</html:pre>
If FTP uploads are necessary, follow the guidance in the remainder of this section to secure these transactions
as much as possible.</description>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Anonymous FTP can be a convenient way to make files available for universal download. However, it is less
common to have a need to allow unauthenticated users to place files on the FTP server. If this must be done, it
is necessary to ensure that files cannot be uploaded and downloaded from the same directory.</rationale>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_ftp_home_partition" selected="false" role="full" severity="unknown">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Place the FTP Home Directory on its Own Partition</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">By default, the anonymous FTP root is the home directory of the FTP user account. The df command can
be used to verify that this directory is on its own partition.</description>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">If there is a mission-critical reason for anonymous users to upload files, precautions must be taken to prevent
these users from filling a disk used by other services.</rationale>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_ftp_log_transactions" selected="false" role="full" severity="unknown">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Enable Logging of All FTP Transactions</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Add or correct the following configuration options within the <html:code xmlns:html="http://www.w3.org/1999/xhtml">vsftpd</html:code>
configuration file, located at <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/vsftpd/vsftpd.conf</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">xferlog_enable=YES
xferlog_std_format=NO
log_ftp_protocol=YES</html:pre></description>
          <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">If verbose logging to <html:code xmlns:html="http://www.w3.org/1999/xhtml">vsftpd.log</html:code> is done, sparse logging of
downloads to <html:code xmlns:html="http://www.w3.org/1999/xhtml">/var/log/xferlog</html:code> will not also occur. However,
the information about what files were downloaded is included in the
information logged to <html:code xmlns:html="http://www.w3.org/1999/xhtml">vsftpd.log</html:code>.</warning>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To trace malicious activity facilitated by the FTP service, it must be configured to ensure that all commands sent to
the FTP server are logged using the verbose vsftpd log
format. The default vsftpd log file is <html:code xmlns:html="http://www.w3.org/1999/xhtml">/var/log/vsftpd.log</html:code>.</rationale>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-ftp_log_transactions:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-ftp_log_transactions_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_ftp_configure_firewall" selected="false" role="full" severity="unknown">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Configure Firewalls to Protect the FTP Server</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">
By default, <html:code xmlns:html="http://www.w3.org/1999/xhtml">iptables</html:code>
blocks access to the ports used by the web server.

To configure <html:code xmlns:html="http://www.w3.org/1999/xhtml">iptables</html:code> to allow port 21 traffic, one must edit
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/sysconfig/iptables</html:code> and
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/sysconfig/ip6tables</html:code> (if IPv6 is in use).
Add the following line, ensuring that it appears before the final LOG and DROP lines for the INPUT chain:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-A INPUT -m state --state NEW -p tcp --dport 21 -j ACCEPT</html:pre>
Edit the file <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/sysconfig/iptables-config</html:code>. Ensure that the space-separated list of modules contains
the FTP connection tracking module:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">IPTABLES_MODULES="ip_conntrack_ftp"</html:pre></description>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">These settings configure the firewall to allow connections to an FTP server.


The first line allows initial connections to the FTP server port.
FTP is an older protocol which is not very compatible with firewalls. During the initial FTP dialogue, the client
and server negotiate an arbitrary port to be used for data transfer. The <html:code xmlns:html="http://www.w3.org/1999/xhtml">ip_conntrack_ftp</html:code>  module is used by
iptables to listen to that dialogue and allow connections to the data ports which FTP negotiates. This allows an
FTP server to operate on a system which is running a firewall.</rationale>
        </Rule>
        <Group id="xccdf_org.ssgproject.content_group_ftp_restrict_users">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Restrict the Set of Users Allowed to Access FTP</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">This section describes how to disable non-anonymous (password-based) FTP logins, or, if it is not possible to
do this entirely due to legacy applications, how to restrict insecure FTP login to only those users who have an
identified need for this access.</description>
          <Rule id="xccdf_org.ssgproject.content_rule_ftp_limit_users" selected="false" role="full" severity="unknown">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Limit Users Allowed FTP Access if Necessary</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">If there is a mission-critical reason for users to access their accounts via the insecure FTP protocol, limit the set of users who are allowed this access. Edit the vsftpd configuration file. Add or correct the following configuration options:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">userlist_enable=YES
userlist_file=/etc/vsftp.ftpusers
userlist_deny=NO</html:pre>
Edit the file <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/vsftp.ftpusers</html:code>. For each user USERNAME who should be allowed to access the system via FTP, add a line containing that user's name:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">USERNAME</html:pre>
If anonymous access is also required, add the anonymous usernames to <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/vsftp.ftpusers</html:code> as well.
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">anonymous
ftp</html:pre></description>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Historically, the file <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/ftpusers</html:code> contained a list of users who were not allowed to access the system via FTP. It was used to prevent system users such as the root user from logging in via the insecure FTP protocol. However, when the configuration option <html:code xmlns:html="http://www.w3.org/1999/xhtml">userlist deny=NO</html:code> is set, vsftpd interprets ftpusers as the set of users who are allowed to login via FTP. Since it should be possible for most users to access their accounts via secure protocols, it is recommended that this setting be used, so that non-anonymous FTP access can be limited to legacy users who have been explicitly identified.</rationale>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_ftp_restrict_to_anon" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Restrict Access to Anonymous Users if Possible</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Is there a mission-critical reason for users to transfer files to/from their own accounts
using FTP, rather than using a secure protocol like SCP/SFTP? If not, edit the vsftpd
configuration file. Add or correct the following configuration option:

<html:pre xmlns:html="http://www.w3.org/1999/xhtml">local_enable=NO</html:pre>

If non-anonymous FTP logins are necessary, follow the guidance in the remainder of
this section to secure these logins as much as possible.</description>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-3</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(a)</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.11</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.12</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.2.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.1</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.2</reference>
            <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.3</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.06</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.5.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.12.6.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.14.2.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.6.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.7.1.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.2.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.2.3</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.1</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.4</reference>
            <reference href="https://www.iso.org/standard/54534.html">A.9.4.5</reference>
            <reference href="https://www.cisecurity.org/controls/">11</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">18</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">5</reference>
            <reference href="https://www.cisecurity.org/controls/">9</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The use of non-anonymous FTP logins is strongly discouraged. Since SSH clients 
and servers are widely available, and since SSH provides support for a transfer
mode which resembles FTP in user interface, there is no good reason to allow
password-based FTP access.'</rationale>
          </Rule>
        </Group>
      </Group>
      <Group id="xccdf_org.ssgproject.content_group_ftp_use_vsftpd">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Use vsftpd to Provide FTP Service if Necessary</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">If your use-case requires FTP service, install and
set-up vsftpd to provide it.</description>
        <Rule id="xccdf_org.ssgproject.content_rule_package_vsftpd_installed" selected="false" role="full" severity="low">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Install vsftpd Package</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">If this system must operate as an FTP server, install the <html:code xmlns:html="http://www.w3.org/1999/xhtml">vsftpd</html:code> package via the standard channels.
The <html:code xmlns:html="http://www.w3.org/1999/xhtml">vsftpd</html:code> package can be installed with the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">
$ sudo dnf install vsftpd</html:pre></description>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.11</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.12</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.3</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.06</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.5.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.6.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.2.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.2.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
          <reference href="https://www.cisecurity.org/controls/">11</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">9</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">After Red Hat Enterprise Linux 2.1, Red Hat switched from distributing <html:code xmlns:html="http://www.w3.org/1999/xhtml">wu-ftpd</html:code> with
Red Hat Enterprise Linux to distributing <html:code xmlns:html="http://www.w3.org/1999/xhtml">vsftpd</html:code>. For security
and for consistency with future Red Hat releases, the use of <html:code xmlns:html="http://www.w3.org/1999/xhtml">vsftpd</html:code> is recommended.</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_vsftpd_installed" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="enable">
if ! rpm -q --quiet "vsftpd" ; then
    dnf install -y "vsftpd"
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_vsftpd_installed" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="enable">- name: Ensure vsftpd is installed
  package:
    name: vsftpd
    state: present
  tags:
    - NIST-800-53-CM-6(a)
    - enable_strategy
    - low_complexity
    - low_disruption
    - low_severity
    - no_reboot_needed
    - package_vsftpd_installed
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_vsftpd_installed" system="urn:xccdf:fix:script:puppet" complexity="low" disruption="low" strategy="enable">include install_vsftpd

class install_vsftpd {
  package { 'vsftpd':
    ensure =&gt; 'installed',
  }
}
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_vsftpd_installed" system="urn:redhat:anaconda:pre" complexity="low" disruption="low" strategy="enable">
package --add=vsftpd
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_vsftpd_installed" system="urn:redhat:osbuild:blueprint">
[[packages]]
name = "vsftpd"
version = "*"
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-package_vsftpd_installed:def:1" href="ssg-fedora-oval.xml"/>
          </check>
        </Rule>
      </Group>
    </Group>
    <Group id="xccdf_org.ssgproject.content_group_imap">
      <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">IMAP and POP3 Server</title>
      <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Dovecot provides IMAP and POP3 services. It is not
installed by default. The project page at 
    <html:a xmlns:html="http://www.w3.org/1999/xhtml" href="http://www.dovecot.org">http://www.dovecot.org</html:a>
contains more detailed information about Dovecot
configuration.</description>
      <Group id="xccdf_org.ssgproject.content_group_configure_dovecot">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Configure Dovecot if Necessary</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">If the system will operate as an IMAP or
POP3 server, the dovecot software should be configured securely by following
the recommendations below.</description>
        <Group id="xccdf_org.ssgproject.content_group_dovecot_support_necessary_protocols">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Support Only the Necessary Protocols</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Dovecot supports the IMAP and POP3 protocols, as well as 
SSL-protected versions of those protocols. Configure the Dovecot server 
to support only the protocols needed by your site. Edit <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/dovecot/dovecot.conf</html:code>. 
Add or correct the following lines, replacing <html:code xmlns:html="http://www.w3.org/1999/xhtml">PROTOCOL</html:code> with 
only the subset of protocols (<html:code xmlns:html="http://www.w3.org/1999/xhtml">imap</html:code>, <html:code xmlns:html="http://www.w3.org/1999/xhtml">imaps</html:code>, 
<html:code xmlns:html="http://www.w3.org/1999/xhtml">pop3</html:code>, <html:code xmlns:html="http://www.w3.org/1999/xhtml">pop3s</html:code>) required:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">protocols = PROTOCOL</html:pre>
If possible, require SSL protection for all transactions. The SSL 
protocol variants listen on alternate ports (995 instead of 110 for 
pop3s, and 993 instead of 143 for imaps), and require SSL-aware clients. 
An alternate approach is to listen on the standard port and require the 
client to use the STARTTLS command before authenticating.</description>
        </Group>
        <Group id="xccdf_org.ssgproject.content_group_dovecot_enabling_ssl">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Enable SSL Support</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">SSL should be used to encrypt network traffic between the 
Dovecot server and its clients. Users must authenticate to the Dovecot 
server in order to read their mail, and passwords should never be 
transmitted in clear text. In addition, protecting mail as it is 
downloaded is a privacy measure, and clients may use SSL certificates 
to authenticate the server, preventing another system from impersonating 
the server.</description>
        </Group>
        <Group id="xccdf_org.ssgproject.content_group_dovecot_allow_imap_access">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Allow IMAP Clients to Access the Server</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">
The default iptables configuration does not allow inbound access to any services.
This modification will allow remote hosts to initiate connections to the IMAP daemon,
while keeping all other ports on the server in their default protected state.
To configure <html:code xmlns:html="http://www.w3.org/1999/xhtml">iptables</html:code> to allow port 143 traffic, one must edit
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/sysconfig/iptables</html:code> and
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/sysconfig/ip6tables</html:code> (if IPv6 is in use).
Add the following line, ensuring that it appears before the final LOG and DROP lines for the INPUT chain:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-A INPUT -m state --state NEW -p tcp --dport 143 -j ACCEPT</html:pre></description>
        </Group>
      </Group>
      <Group id="xccdf_org.ssgproject.content_group_disabling_dovecot">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable Dovecot</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">If the system does not need to operate as an IMAP or
POP3 server, the dovecot software should be disabled and removed.</description>
      </Group>
    </Group>
    <Group id="xccdf_org.ssgproject.content_group_ntp">
      <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Network Time Protocol</title>
      <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The Network Time Protocol is used to manage the system
clock over a network. Computer clocks are not very accurate, so
time will drift unpredictably on unmanaged systems. Central time
protocols can be used both to ensure that time is consistent among
a network of systems, and that their time is consistent with the
outside world.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
If every system on a network reliably reports the same time, then it is much
easier to correlate log messages in case of an attack. In addition, a number of
cryptographic protocols (such as Kerberos) use timestamps to prevent certain
types of attacks. If your network does not have synchronized time, these
protocols may be unreliable or even unusable.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Depending on the specifics of the network, global time accuracy may be just as
important as local synchronization, or not very important at all. If your
network is connected to the Internet, using a public timeserver (or one
provided by your enterprise) provides globally accurate timestamps which may be
essential in investigating or responding to an attack which originated outside
of your network.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
A typical network setup involves a small number of internal systems operating
as NTP servers, and the remainder obtaining time information from those
internal servers.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
There is a choice between the daemons <html:code xmlns:html="http://www.w3.org/1999/xhtml">ntpd</html:code> and <html:code xmlns:html="http://www.w3.org/1999/xhtml">chronyd</html:code>, which
are available from the repositories in the <html:code xmlns:html="http://www.w3.org/1999/xhtml">ntp</html:code> and <html:code xmlns:html="http://www.w3.org/1999/xhtml">chrony</html:code>
packages respectively.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
The default <html:code xmlns:html="http://www.w3.org/1999/xhtml">chronyd</html:code> daemon can work well when external time references
are only intermittently accesible, can perform well even when the network is
congested for longer periods of time, can usually synchronize the clock faster
and with better time accuracy, and quickly adapts to sudden changes in the rate
of the clock, for example, due to changes in the temperature of the crystal
oscillator. <html:code xmlns:html="http://www.w3.org/1999/xhtml">Chronyd</html:code> should be considered for all systems which are
frequently suspended or otherwise intermittently disconnected and reconnected
to a network. Mobile and virtual systems for example.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
The <html:code xmlns:html="http://www.w3.org/1999/xhtml">ntpd</html:code> NTP daemon fully supports NTP protocol version 4 (RFC 5905),
including broadcast, multicast, manycast clients and servers, and the orphan
mode. It also supports extra authentication schemes based on public-key
cryptography (RFC 5906). The NTP daemon (<html:code xmlns:html="http://www.w3.org/1999/xhtml">ntpd</html:code>) should be considered
for systems which are normally kept permanently on. Systems which are required
to use broadcast or multicast IP, or to perform authentication of packets with
the <html:code xmlns:html="http://www.w3.org/1999/xhtml">Autokey</html:code> protocol, should consider using <html:code xmlns:html="http://www.w3.org/1999/xhtml">ntpd</html:code>.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Refer to

    
    <html:a xmlns:html="http://www.w3.org/1999/xhtml" href="https://docs.fedoraproject.org/en-US/fedora/rawhide/system-administrators-guide/servers/Configuring_NTP_Using_the_chrony_Suite/">https://docs.fedoraproject.org/en-US/fedora/rawhide/system-administrators-guide/servers/Configuring_NTP_Using_the_chrony_Suite/</html:a>

for more detailed comparison of features of <html:code xmlns:html="http://www.w3.org/1999/xhtml">chronyd</html:code>
and <html:code xmlns:html="http://www.w3.org/1999/xhtml">ntpd</html:code> daemon features respectively, and for further guidance how to
choose between the two NTP daemons.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
The upstream manual pages at 
    <html:a xmlns:html="http://www.w3.org/1999/xhtml" href="http://chrony.tuxfamily.org/manual.html">http://chrony.tuxfamily.org/manual.html</html:a> for
<html:code xmlns:html="http://www.w3.org/1999/xhtml">chronyd</html:code> and 
    <html:a xmlns:html="http://www.w3.org/1999/xhtml" href="http://www.ntp.org">http://www.ntp.org</html:a> for <html:code xmlns:html="http://www.w3.org/1999/xhtml">ntpd</html:code> provide additional
information on the capabilities and configuration of each of the NTP daemons.</description>
      <platform idref="cpe:/a:machine"/>
      <Value id="xccdf_org.ssgproject.content_value_var_multiple_time_servers" type="string" interactive="true">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Vendor Approved Time Servers</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The list of vendor-approved time servers</description>
        <value>0.pool.ntp.org,1.pool.ntp.org,2.pool.ntp.org,3.pool.ntp.org</value>
        <value selector="fedora">0.fedora.pool.ntp.org,1.fedora.pool.ntp.org,2.fedora.pool.ntp.org,3.fedora.pool.ntp.org</value>
        <value selector="rhel">0.rhel.pool.ntp.org,1.rhel.pool.ntp.org,2.rhel.pool.ntp.org,3.rhel.pool.ntp.org</value>
        <value selector="ol">0.pool.ntp.org,1.pool.ntp.org,2.pool.ntp.org,3.pool.ntp.org</value>
      </Value>
      <Value id="xccdf_org.ssgproject.content_value_var_time_service_set_maxpoll" type="number">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Maximum NTP or Chrony Poll</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The maximum NTP or Chrony poll interval number in seconds specified as a power of two.</description>
        <value selector="36_hours">17</value>
        <value selector="18_hours">16</value>
        <value>10</value>
        <value selector="system_default">10</value>
      </Value>
      <Rule id="xccdf_org.ssgproject.content_rule_package_chrony_installed" selected="false" role="full" severity="medium">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The Chrony package is installed</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">System time should be synchronized between all systems in an environment. This is
typically done by establishing an authoritative time server or set of servers and having all
systems synchronize their clocks to them.
The <html:code xmlns:html="http://www.w3.org/1999/xhtml">chrony</html:code> package can be installed with the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">
$ sudo dnf install chrony</html:pre></description>
        <reference href="">0988</reference>
        <reference href="">1405</reference>
        <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_SMF_EXT.1</reference>
        <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000355-GPOS-00143</reference>
        <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R43)</reference>
        <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Time synchronization is important to support time sensitive security mechanisms like
Kerberos and also ensures log files have consistent time records across the enterprise,
which aids in forensic investigations.</rationale>
        <platform idref="cpe:/a:machine"/>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_chrony_installed" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="enable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

if ! rpm -q --quiet "chrony" ; then
    dnf install -y "chrony"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_chrony_installed" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="enable">- name: Ensure chrony is installed
  package:
    name: chrony
    state: present
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - enable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - package_chrony_installed
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_chrony_installed" system="urn:xccdf:fix:script:puppet" complexity="low" disruption="low" strategy="enable">include install_chrony

class install_chrony {
  package { 'chrony':
    ensure =&gt; 'installed',
  }
}
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_chrony_installed" system="urn:redhat:anaconda:pre" complexity="low" disruption="low" strategy="enable">
package --add=chrony
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_chrony_installed" system="urn:redhat:osbuild:blueprint">
[[packages]]
name = "chrony"
version = "*"
</fix>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref name="oval:ssg-package_chrony_installed:def:1" href="ssg-fedora-oval.xml"/>
        </check>
        <check system="http://scap.nist.gov/schema/ocil/2">
          <check-content-ref name="ocil:ssg-package_chrony_installed_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
        </check>
      </Rule>
      <Rule id="xccdf_org.ssgproject.content_rule_package_ntp_installed" selected="false" role="full" severity="high">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Install the ntp service</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The ntpd service should be installed.</description>
        <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">NT012(R03)</reference>
        <reference href="https://public.cyber.mil/stigs/cci/">CCI-000160</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
        <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.12.4.1</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.12.4.2</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.12.4.3</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.12.4.4</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.12.7.1</reference>
        <reference href="https://www.cisecurity.org/controls/">1</reference>
        <reference href="https://www.cisecurity.org/controls/">14</reference>
        <reference href="https://www.cisecurity.org/controls/">15</reference>
        <reference href="https://www.cisecurity.org/controls/">16</reference>
        <reference href="https://www.cisecurity.org/controls/">3</reference>
        <reference href="https://www.cisecurity.org/controls/">5</reference>
        <reference href="https://www.cisecurity.org/controls/">6</reference>
        <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.4</reference>
        <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Time synchronization (using NTP) is required by almost all network and administrative tasks (syslog, cryptographic based services (authentication, etc.), etc.). Ntpd is regulary maintained and updated, supporting security features such as RFC 5906.</rationale>
        <platform idref="cpe:/a:machine"/>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_ntp_installed" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="enable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

if ! rpm -q --quiet "ntp" ; then
    dnf install -y "ntp"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_ntp_installed" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="enable">- name: Ensure ntp is installed
  package:
    name: ntp
    state: present
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.4
    - enable_strategy
    - high_severity
    - low_complexity
    - low_disruption
    - no_reboot_needed
    - package_ntp_installed
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_ntp_installed" system="urn:xccdf:fix:script:puppet" complexity="low" disruption="low" strategy="enable">include install_ntp

class install_ntp {
  package { 'ntp':
    ensure =&gt; 'installed',
  }
}
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_ntp_installed" system="urn:redhat:anaconda:pre" complexity="low" disruption="low" strategy="enable">
package --add=ntp
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_ntp_installed" system="urn:redhat:osbuild:blueprint">
[[packages]]
name = "ntp"
version = "*"
</fix>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref name="oval:ssg-package_ntp_installed:def:1" href="ssg-fedora-oval.xml"/>
        </check>
      </Rule>
      <Rule id="xccdf_org.ssgproject.content_rule_service_chronyd_enabled" selected="false" role="full" severity="medium">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The Chronyd service is enabled</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">chrony is a daemon which implements the Network Time Protocol (NTP) is designed to
synchronize system clocks across a variety of systems and use a source that is highly
accurate. More information on chrony can be found at

    <html:a xmlns:html="http://www.w3.org/1999/xhtml" href="http://chrony.tuxfamily.org/">http://chrony.tuxfamily.org/</html:a>.
Chrony can be configured to be a client and/or a server.
To enable Chronyd service, you can run:
<html:code xmlns:html="http://www.w3.org/1999/xhtml"># systemctl enable chronyd.service</html:code>
This recommendation only applies if chrony is in use on the system.</description>
        <reference href="">0988</reference>
        <reference href="">1405</reference>
        <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">If chrony is in use on the system proper configuration is vital to ensuring time
synchronization is working properly.</rationale>
        <platform idref="cpe:/a:machine"/>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="service_chronyd_enabled" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="enable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

SYSTEMCTL_EXEC='/usr/bin/systemctl'
"$SYSTEMCTL_EXEC" unmask 'chronyd.service'
"$SYSTEMCTL_EXEC" start 'chronyd.service'
"$SYSTEMCTL_EXEC" enable 'chronyd.service'

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="service_chronyd_enabled" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="enable">- name: Enable service chronyd
  block:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: Enable service chronyd
      service:
        name: chronyd
        enabled: 'yes'
        state: started
        masked: 'no'
      when:
        - '"chrony" in ansible_facts.packages'
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - enable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - service_chronyd_enabled
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="service_chronyd_enabled" system="urn:xccdf:fix:script:puppet" complexity="low" disruption="low" strategy="enable">include enable_chronyd

class enable_chronyd {
  service {'chronyd':
    enable =&gt; true,
    ensure =&gt; 'running',
  }
}
</fix>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref name="oval:ssg-service_chronyd_enabled:def:1" href="ssg-fedora-oval.xml"/>
        </check>
        <check system="http://scap.nist.gov/schema/ocil/2">
          <check-content-ref name="ocil:ssg-service_chronyd_enabled_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
        </check>
      </Rule>
      <Rule id="xccdf_org.ssgproject.content_rule_service_chronyd_or_ntpd_enabled" selected="false" role="full" severity="medium">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Enable the NTP Daemon</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">

Run the following command to determine the current status of the
<html:code xmlns:html="http://www.w3.org/1999/xhtml">chronyd</html:code> service:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ systemctl is-active chronyd</html:pre>
If the service is running, it should return the following: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">active</html:pre>
Note: The <html:code xmlns:html="http://www.w3.org/1999/xhtml">chronyd</html:code> daemon is enabled by default.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>


Run the following command to determine the current status of the
<html:code xmlns:html="http://www.w3.org/1999/xhtml">ntpd</html:code> service:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ systemctl is-active ntpd</html:pre>
If the service is running, it should return the following: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">active</html:pre>
Note: The <html:code xmlns:html="http://www.w3.org/1999/xhtml">ntpd</html:code> daemon is not enabled by default. Though as mentioned
in the previous sections in certain environments the <html:code xmlns:html="http://www.w3.org/1999/xhtml">ntpd</html:code> daemon might
be preferred to be used rather than the <html:code xmlns:html="http://www.w3.org/1999/xhtml">chronyd</html:code> one. Refer to:

    
    <html:a xmlns:html="http://www.w3.org/1999/xhtml" href="https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/System_Administrators_Guide/ch-Configuring_NTP_Using_the_chrony_Suite.html">https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/System_Administrators_Guide/ch-Configuring_NTP_Using_the_chrony_Suite.html</html:a>

for guidance which NTP daemon to choose depending on the environment used.</description>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.3.7</reference>
        <reference href="https://public.cyber.mil/stigs/cci/">CCI-000160</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-8(1)(a)</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
        <reference href="">SRG-OS-000356-VMM-001340</reference>
        <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.4</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
        <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.12.4.1</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.12.4.2</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.12.4.3</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.12.4.4</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.12.7.1</reference>
        <reference href="https://www.cisecurity.org/controls/">1</reference>
        <reference href="https://www.cisecurity.org/controls/">14</reference>
        <reference href="https://www.cisecurity.org/controls/">15</reference>
        <reference href="https://www.cisecurity.org/controls/">16</reference>
        <reference href="https://www.cisecurity.org/controls/">3</reference>
        <reference href="https://www.cisecurity.org/controls/">5</reference>
        <reference href="https://www.cisecurity.org/controls/">6</reference>
        <reference href="">0988</reference>
        <reference href="">1405</reference>
        <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Enabling some of <html:code xmlns:html="http://www.w3.org/1999/xhtml">chronyd</html:code> or <html:code xmlns:html="http://www.w3.org/1999/xhtml">ntpd</html:code> services ensures
that the NTP daemon will be running and that the system will synchronize its
time to any servers specified. This is important whether the system is
configured to be a client (and synchronize only its own clock) or it is also
acting as an NTP server to other systems.  Synchronizing time is essential for
authentication services such as Kerberos, but it is also important for
maintaining accurate logs and auditing possible security breaches.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
The <html:code xmlns:html="http://www.w3.org/1999/xhtml">chronyd</html:code> and <html:code xmlns:html="http://www.w3.org/1999/xhtml">ntpd</html:code> NTP daemons offer all of the
functionality of <html:code xmlns:html="http://www.w3.org/1999/xhtml">ntpdate</html:code>, which is now deprecated. Additional
information on this is available at

    <html:a xmlns:html="http://www.w3.org/1999/xhtml" href="http://support.ntp.org/bin/view/Dev/DeprecatingNtpdate">http://support.ntp.org/bin/view/Dev/DeprecatingNtpdate</html:a></rationale>
        <platform idref="cpe:/a:machine"/>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="service_chronyd_or_ntpd_enabled" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

if rpm -q --quiet chrony ; then
    if ! /usr/sbin/pidof ntpd ; then
        /usr/bin/systemctl enable "chronyd"
        /usr/bin/systemctl start "chronyd"
        # The service may not be running because it has been started and failed,
        # so let's reset the state so OVAL checks pass.
        # Service should be 'inactive', not 'failed' after reboot though.
        /usr/bin/systemctl reset-failed "chronyd"
    fi
elif rpm -q --quiet ntp ; then
    /usr/bin/systemctl enable "ntpd"
    /usr/bin/systemctl start "ntpd"
    # The service may not be running because it has been started and failed,
    # so let's reset the state so OVAL checks pass.
    # Service should be 'inactive', not 'failed' after reboot though.
    /usr/bin/systemctl reset-failed "ntpd"
else
    if ! rpm -q --quiet "chrony" ; then
        dnf install -y "chrony"
    fi
    /usr/bin/systemctl enable "chronyd"
    /usr/bin/systemctl start "chronyd"
    # The service may not be running because it has been started and failed,
    # so let's reset the state so OVAL checks pass.
    # Service should be 'inactive', not 'failed' after reboot though.
    /usr/bin/systemctl reset-failed "chronyd"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref name="oval:ssg-service_chronyd_or_ntpd_enabled:def:1" href="ssg-fedora-oval.xml"/>
        </check>
        <check system="http://scap.nist.gov/schema/ocil/2">
          <check-content-ref name="ocil:ssg-service_chronyd_or_ntpd_enabled_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
        </check>
      </Rule>
      <Rule id="xccdf_org.ssgproject.content_rule_service_ntp_enabled" selected="false" role="full" severity="high">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Enable the NTP Daemon</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">
The <html:code xmlns:html="http://www.w3.org/1999/xhtml">ntpd</html:code> service can be enabled with the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo systemctl enable ntpd.service</html:pre></description>
        <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">NT012(R03)</reference>
        <reference href="https://public.cyber.mil/stigs/cci/">CCI-000160</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-8(1)(a)</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
        <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.4</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
        <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.12.4.1</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.12.4.2</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.12.4.3</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.12.4.4</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.12.7.1</reference>
        <reference href="https://www.cisecurity.org/controls/">1</reference>
        <reference href="https://www.cisecurity.org/controls/">14</reference>
        <reference href="https://www.cisecurity.org/controls/">15</reference>
        <reference href="https://www.cisecurity.org/controls/">16</reference>
        <reference href="https://www.cisecurity.org/controls/">3</reference>
        <reference href="https://www.cisecurity.org/controls/">5</reference>
        <reference href="https://www.cisecurity.org/controls/">6</reference>
        <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Enabling the <html:code xmlns:html="http://www.w3.org/1999/xhtml">ntpd</html:code> service ensures that the <html:code xmlns:html="http://www.w3.org/1999/xhtml">ntpd</html:code>
service will be running and that the system will synchronize its time to
any servers specified. This is important whether the system is configured to be
a client (and synchronize only its own clock) or it is also acting as an NTP
server to other systems.  Synchronizing time is essential for authentication
services such as Kerberos, but it is also important for maintaining accurate
logs and auditing possible security breaches.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
The NTP daemon offers all of the functionality of <html:code xmlns:html="http://www.w3.org/1999/xhtml">ntpdate</html:code>, which is now
deprecated.  Additional information on this is available at

    <html:a xmlns:html="http://www.w3.org/1999/xhtml" href="http://support.ntp.org/bin/view/Dev/DeprecatingNtpdate">http://support.ntp.org/bin/view/Dev/DeprecatingNtpdate</html:a>.</rationale>
        <platform idref="cpe:/a:machine"/>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="service_ntp_enabled" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="enable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

SYSTEMCTL_EXEC='/usr/bin/systemctl'
"$SYSTEMCTL_EXEC" unmask 'ntp.service'
"$SYSTEMCTL_EXEC" start 'ntp.service'
"$SYSTEMCTL_EXEC" enable 'ntp.service'

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="service_ntp_enabled" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="enable">- name: Enable service ntp
  block:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: Enable service ntp
      service:
        name: ntp
        enabled: 'yes'
        state: started
        masked: 'no'
      when:
        - '"ntp" in ansible_facts.packages'
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AU-8(1)(a)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.4
    - enable_strategy
    - high_severity
    - low_complexity
    - low_disruption
    - no_reboot_needed
    - service_ntp_enabled
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="service_ntp_enabled" system="urn:xccdf:fix:script:puppet" complexity="low" disruption="low" strategy="enable">include enable_ntp

class enable_ntp {
  service {'ntp':
    enable =&gt; true,
    ensure =&gt; 'running',
  }
}
</fix>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref name="oval:ssg-service_ntp_enabled:def:1" href="ssg-fedora-oval.xml"/>
        </check>
        <check system="http://scap.nist.gov/schema/ocil/2">
          <check-content-ref name="ocil:ssg-service_ntp_enabled_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
        </check>
      </Rule>
      <Rule id="xccdf_org.ssgproject.content_rule_service_ntpd_enabled" selected="false" role="full" severity="medium">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Enable the NTP Daemon</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">
The <html:code xmlns:html="http://www.w3.org/1999/xhtml">ntpd</html:code> service can be enabled with the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo systemctl enable ntpd.service</html:pre></description>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-8(1)(a)</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
        <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.4</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
        <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.12.4.1</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.12.4.2</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.12.4.3</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.12.4.4</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.12.7.1</reference>
        <reference href="https://www.cisecurity.org/controls/">1</reference>
        <reference href="https://www.cisecurity.org/controls/">14</reference>
        <reference href="https://www.cisecurity.org/controls/">15</reference>
        <reference href="https://www.cisecurity.org/controls/">16</reference>
        <reference href="https://www.cisecurity.org/controls/">3</reference>
        <reference href="https://www.cisecurity.org/controls/">5</reference>
        <reference href="https://www.cisecurity.org/controls/">6</reference>
        <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Enabling the <html:code xmlns:html="http://www.w3.org/1999/xhtml">ntpd</html:code> service ensures that the <html:code xmlns:html="http://www.w3.org/1999/xhtml">ntpd</html:code>
service will be running and that the system will synchronize its time to
any servers specified. This is important whether the system is configured to be
a client (and synchronize only its own clock) or it is also acting as an NTP
server to other systems.  Synchronizing time is essential for authentication
services such as Kerberos, but it is also important for maintaining accurate
logs and auditing possible security breaches.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
The NTP daemon offers all of the functionality of <html:code xmlns:html="http://www.w3.org/1999/xhtml">ntpdate</html:code>, which is now
deprecated.  Additional information on this is available at

    <html:a xmlns:html="http://www.w3.org/1999/xhtml" href="http://support.ntp.org/bin/view/Dev/DeprecatingNtpdate">http://support.ntp.org/bin/view/Dev/DeprecatingNtpdate</html:a>.</rationale>
        <platform idref="cpe:/a:machine"/>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="service_ntpd_enabled" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="enable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

SYSTEMCTL_EXEC='/usr/bin/systemctl'
"$SYSTEMCTL_EXEC" unmask 'ntpd.service'
"$SYSTEMCTL_EXEC" start 'ntpd.service'
"$SYSTEMCTL_EXEC" enable 'ntpd.service'

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="service_ntpd_enabled" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="enable">- name: Enable service ntpd
  block:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: Enable service ntpd
      service:
        name: ntpd
        enabled: 'yes'
        state: started
        masked: 'no'
      when:
        - '"ntp" in ansible_facts.packages'
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AU-8(1)(a)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.4
    - enable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - service_ntpd_enabled
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="service_ntpd_enabled" system="urn:xccdf:fix:script:puppet" complexity="low" disruption="low" strategy="enable">include enable_ntpd

class enable_ntpd {
  service {'ntpd':
    enable =&gt; true,
    ensure =&gt; 'running',
  }
}
</fix>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref name="oval:ssg-service_ntpd_enabled:def:1" href="ssg-fedora-oval.xml"/>
        </check>
        <check system="http://scap.nist.gov/schema/ocil/2">
          <check-content-ref name="ocil:ssg-service_ntpd_enabled_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
        </check>
      </Rule>
      <Rule id="xccdf_org.ssgproject.content_rule_chronyd_or_ntpd_set_maxpoll" selected="false" role="full" severity="medium">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Configure Time Service Maxpoll Interval</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">maxpoll</html:code> should be configured to
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_time_service_set_maxpoll" use="legacy"/> in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/ntp.conf</html:code> or
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/chrony.conf</html:code> to continuously poll time servers. To configure
<html:code xmlns:html="http://www.w3.org/1999/xhtml">maxpoll</html:code> in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/ntp.conf</html:code> or <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/chrony.conf</html:code>
add the following:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml" xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2">maxpoll <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_time_service_set_maxpoll" use="legacy"/></html:pre></description>
        <reference href="https://public.cyber.mil/stigs/cci/">CCI-001891</reference>
        <reference href="https://public.cyber.mil/stigs/cci/">CCI-002046</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-8(1)(b)</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
        <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000355-GPOS-00143</reference>
        <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000356-GPOS-00144</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
        <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.12.4.1</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.12.4.2</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.12.4.3</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.12.4.4</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.12.7.1</reference>
        <reference href="https://www.cisecurity.org/controls/">1</reference>
        <reference href="https://www.cisecurity.org/controls/">14</reference>
        <reference href="https://www.cisecurity.org/controls/">15</reference>
        <reference href="https://www.cisecurity.org/controls/">16</reference>
        <reference href="https://www.cisecurity.org/controls/">3</reference>
        <reference href="https://www.cisecurity.org/controls/">5</reference>
        <reference href="https://www.cisecurity.org/controls/">6</reference>
        <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Inaccurate time stamps make it more difficult to correlate
events and can lead to an inaccurate analysis. Determining the correct
time a particular event occurred on a system is critical when conducting
forensic analysis and investigating system events. Sources outside the
configured acceptable allowance (drift) may be inaccurate.</rationale>
        <platform idref="cpe:/a:chrony"/>
        <platform idref="cpe:/a:ntp"/>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="chronyd_or_ntpd_set_maxpoll" system="urn:xccdf:fix:script:kubernetes" reboot="true" complexity="low" disruption="low" strategy="restrict">apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,%23%20Allow%20for%20extra%20configuration%20files.%20This%20is%20useful%0A%23%20for%20admins%20specifying%20their%20own%20NTP%20servers%0Ainclude%20/etc/chrony.d/%2A.conf%0A%0A%23%20Set%20chronyd%20as%20client-only.%0Aport%200%0A%0A%23%20Disable%20chronyc%20from%20the%20network%0Acmdport%200%0A%0A%23%20Record%20the%20rate%20at%20which%20the%20system%20clock%20gains/losses%20time.%0Adriftfile%20/var/lib/chrony/drift%0A%0A%23%20Allow%20the%20system%20clock%20to%20be%20stepped%20in%20the%20first%20three%20updates%0A%23%20if%20its%20offset%20is%20larger%20than%201%20second.%0Amakestep%201.0%203%0A%0A%23%20Enable%20kernel%20synchronization%20of%20the%20real-time%20clock%20%28RTC%29.%0Artcsync%0A%0A%23%20Enable%20hardware%20timestamping%20on%20all%20interfaces%20that%20support%20it.%0A%23hwtimestamp%20%2A%0A%0A%23%20Increase%20the%20minimum%20number%20of%20selectable%20sources%20required%20to%20adjust%0A%23%20the%20system%20clock.%0A%23minsources%202%0A%0A%23%20Allow%20NTP%20client%20access%20from%20local%20network.%0A%23allow%20192.168.0.0/16%0A%0A%23%20Serve%20time%20even%20if%20not%20synchronized%20to%20a%20time%20source.%0A%23local%20stratum%2010%0A%0A%23%20Require%20authentication%20%28nts%20or%20key%20option%29%20for%20all%20NTP%20sources.%0A%23authselectmode%20require%0A%0A%23%20Specify%20file%20containing%20keys%20for%20NTP%20authentication.%0Akeyfile%20/etc/chrony.keys%0A%0A%23%20Insert/delete%20leap%20seconds%20by%20slewing%20instead%20of%20stepping.%0A%23leapsecmode%20slew%0A%0A%23%20Get%20TAI-UTC%20offset%20and%20leap%20seconds%20from%20the%20system%20tz%20database.%0Aleapsectz%20right/UTC%0A%0A%23%20Specify%20directory%20for%20log%20files.%0Alogdir%20/var/log/chrony%0A%0A%23%20Select%20which%20information%20is%20logged.%0A%23log%20measurements%20statistics%20tracking
        mode: 420
        overwrite: true
        path: /etc/chrony.conf
      - contents:
          source: data:,
        mode: 420
        overwrite: true
        path: /etc/chrony.d/.mco-keep
</fix>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-export export-name="oval:ssg-var_time_service_set_maxpoll:var:1" value-id="xccdf_org.ssgproject.content_value_var_time_service_set_maxpoll"/>
          <check-content-ref name="oval:ssg-chronyd_or_ntpd_set_maxpoll:def:1" href="ssg-fedora-oval.xml"/>
        </check>
        <check system="http://scap.nist.gov/schema/ocil/2">
          <check-content-ref name="ocil:ssg-chronyd_or_ntpd_set_maxpoll_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
        </check>
      </Rule>
      <Rule id="xccdf_org.ssgproject.content_rule_chronyd_run_as_chrony_user" selected="false" role="full" severity="medium">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure that chronyd is running under chrony user account</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">chrony is a daemon which implements the Network Time Protocol (NTP). It is designed to
synchronize system clocks across a variety of systems and use a source that is highly
accurate. More information on chrony can be found at

    <html:a xmlns:html="http://www.w3.org/1999/xhtml" href="http://chrony.tuxfamily.org/">http://chrony.tuxfamily.org/</html:a>.
Chrony can be configured to be a client and/or a server.
To ensure that chronyd is running under chrony user account, Add or edit the
<html:code xmlns:html="http://www.w3.org/1999/xhtml">OPTIONS</html:code> variable in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/sysconfig/chronyd</html:code> to include <html:code xmlns:html="http://www.w3.org/1999/xhtml">-u chrony</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">OPTIONS="-u chrony"</html:pre>
This recommendation only applies if chrony is in use on the system.</description>
        <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">If chrony is in use on the system proper configuration is vital to ensuring time synchronization
is working properly.</rationale>
        <platform idref="cpe:/a:chrony"/>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="chronyd_run_as_chrony_user" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ] &amp;&amp; { rpm --quiet -q chrony; }; then

if grep -q 'OPTIONS=.*' /etc/sysconfig/chronyd; then
	# trying to solve cases where the parameter after OPTIONS
	#may or may not be enclosed in quotes
	sed -i -E -e 's/\s*-u\s+\w+\s*/ /' -e 's/^([\s]*OPTIONS=["]?[^"]*)("?)/\1 -u chrony\2/' /etc/sysconfig/chronyd
else
	echo 'OPTIONS="-u chrony"' &gt;&gt; /etc/sysconfig/chronyd
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="chronyd_run_as_chrony_user" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - chronyd_run_as_chrony_user
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Detect if file /etc/sysconfig/chronyd is not empty or missing
  find:
    path: /etc/sysconfig/
    patterns: chronyd
    contains: ^([\s]*OPTIONS=["]?[^"]*)("?)
  register: chronyd_file
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - '"chrony" in ansible_facts.packages'
  tags:
    - chronyd_run_as_chrony_user
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Remove any previous configuration of user used to run chronyd process
  replace:
    path: /etc/sysconfig/chronyd
    regexp: \s*-u\s+\w+\s*
    replace: ' '
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - '"chrony" in ansible_facts.packages'
    - chronyd_file is defined and chronyd_file.matched &gt; 0
  tags:
    - chronyd_run_as_chrony_user
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Correct existing line in /etc/sysconfig/chronyd to run chronyd as chrony user
  lineinfile:
    path: /etc/sysconfig/chronyd
    regexp: ^([\s]*OPTIONS=["]?[^"]*)("?)
    line: \1 -u chrony\2
    state: present
    backrefs: true
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - '"chrony" in ansible_facts.packages'
    - chronyd_file is defined and chronyd_file.matched &gt; 0
  tags:
    - chronyd_run_as_chrony_user
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Insert correct line into /etc/sysconfig/chronyd ensuring chronyd runs as chrony
    user
  lineinfile:
    path: /etc/sysconfig/chronyd
    line: OPTIONS="-u chrony"
    state: present
    create: true
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - '"chrony" in ansible_facts.packages'
    - chronyd_file is defined and chronyd_file.matched == 0
  tags:
    - chronyd_run_as_chrony_user
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
</fix>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref name="oval:ssg-chronyd_run_as_chrony_user:def:1" href="ssg-fedora-oval.xml"/>
        </check>
        <check system="http://scap.nist.gov/schema/ocil/2">
          <check-content-ref name="ocil:ssg-chronyd_run_as_chrony_user_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
        </check>
      </Rule>
      <Rule id="xccdf_org.ssgproject.content_rule_ntpd_specify_multiple_servers" selected="false" role="full" severity="unknown">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Specify Additional Remote NTP Servers</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Additional NTP servers can be specified for time synchronization
in the file <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/ntp.conf</html:code>.  To do so, add additional lines of the
following form, substituting the IP address or hostname of a remote NTP server for
<html:em xmlns:html="http://www.w3.org/1999/xhtml">ntpserver</html:em>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">server <html:i>ntpserver</html:i></html:pre></description>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-8(1)(a)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-8(2)</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
        <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.12.4.1</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.12.4.2</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.12.4.3</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.12.4.4</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.12.7.1</reference>
        <reference href="https://www.cisecurity.org/controls/">1</reference>
        <reference href="https://www.cisecurity.org/controls/">14</reference>
        <reference href="https://www.cisecurity.org/controls/">15</reference>
        <reference href="https://www.cisecurity.org/controls/">16</reference>
        <reference href="https://www.cisecurity.org/controls/">3</reference>
        <reference href="https://www.cisecurity.org/controls/">5</reference>
        <reference href="https://www.cisecurity.org/controls/">6</reference>
        <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.4.3</reference>
        <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Specifying additional NTP servers increases the availability of
accurate time data, in the event that one of the specified servers becomes
unavailable. This is typical for a system acting as an NTP server for
other systems.</rationale>
        <platform idref="cpe:/a:machine"/>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref name="oval:ssg-ntpd_specify_multiple_servers:def:1" href="ssg-fedora-oval.xml"/>
        </check>
      </Rule>
      <Rule id="xccdf_org.ssgproject.content_rule_chronyd_or_ntpd_specify_remote_server" selected="false" role="full" severity="medium">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Specify a Remote NTP Server</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Depending on specific functional requirements of a concrete
production environment, the Fedora system can be
configured to utilize the services of the <html:code xmlns:html="http://www.w3.org/1999/xhtml">chronyd</html:code> NTP daemon (the
default), or services of the <html:code xmlns:html="http://www.w3.org/1999/xhtml">ntpd</html:code> NTP daemon. Refer to

    
    <html:a xmlns:html="http://www.w3.org/1999/xhtml" href="https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/System_Administrators_Guide/ch-Configuring_NTP_Using_the_chrony_Suite.html">https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/System_Administrators_Guide/ch-Configuring_NTP_Using_the_chrony_Suite.html</html:a>

for more detailed comparison of the features of both of the choices, and for
further guidance how to choose between the two NTP daemons.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
To specify a remote NTP server for time synchronization, perform the following:
<html:ul xmlns:html="http://www.w3.org/1999/xhtml"><html:li> if the system is configured to use the <html:code>chronyd</html:code> as the NTP daemon (the
default), edit the file <html:code>/etc/chrony.conf</html:code> as follows,</html:li><html:li> if the system is configured to use the <html:code>ntpd</html:code> as the NTP daemon,
edit the file <html:code>/etc/ntp.conf</html:code> as documented below.</html:li></html:ul>
Add or correct the following lines, substituting the IP or hostname of a remote
NTP server for <html:em xmlns:html="http://www.w3.org/1999/xhtml">ntpserver</html:em>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">server <html:i>ntpserver</html:i></html:pre>
This instructs the NTP software to contact that remote server to obtain time
data.</description>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.3.7</reference>
        <reference href="https://public.cyber.mil/stigs/cci/">CCI-000160</reference>
        <reference href="https://public.cyber.mil/stigs/cci/">CCI-001891</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-8(1)(a)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-8(2)</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
        <reference href="">SRG-OS-000355-VMM-001330</reference>
        <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.4.1</reference>
        <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.4.3</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
        <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.12.4.1</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.12.4.2</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.12.4.3</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.12.4.4</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.12.7.1</reference>
        <reference href="https://www.cisecurity.org/controls/">1</reference>
        <reference href="https://www.cisecurity.org/controls/">14</reference>
        <reference href="https://www.cisecurity.org/controls/">15</reference>
        <reference href="https://www.cisecurity.org/controls/">16</reference>
        <reference href="https://www.cisecurity.org/controls/">3</reference>
        <reference href="https://www.cisecurity.org/controls/">5</reference>
        <reference href="https://www.cisecurity.org/controls/">6</reference>
        <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Synchronizing with an NTP server makes it possible to collate system
logs from multiple sources or correlate computer events with real time events.</rationale>
        <platform idref="cpe:/a:machine"/>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="chronyd_or_ntpd_specify_remote_server" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then


var_multiple_time_servers="<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_multiple_time_servers" use="legacy"/>"



config_file="/etc/ntp.conf"
/usr/sbin/pidof ntpd || config_file="/etc/chrony.conf"

if ! grep -q ^server "$config_file" ; then
  if ! grep -q '#[[:space:]]*server' "$config_file" ; then
    for server in $(echo "$var_multiple_time_servers" | tr ',' '\n') ; do
      printf '\nserver %s' "$server" &gt;&gt; "$config_file"
    done
  else
    sed -i 's/#[ \t]*server/server/g' "$config_file"
  fi
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="chronyd_or_ntpd_specify_remote_server" system="urn:xccdf:fix:script:kubernetes" reboot="true" complexity="low" disruption="low" strategy="restrict">apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,%23%20Allow%20for%20extra%20configuration%20files.%20This%20is%20useful%0A%23%20for%20admins%20specifying%20their%20own%20NTP%20servers%0Ainclude%20/etc/chrony.d/%2A.conf%0A%0A%23%20Set%20chronyd%20as%20client-only.%0Aport%200%0A%0A%23%20Disable%20chronyc%20from%20the%20network%0Acmdport%200%0A%0A%23%20Record%20the%20rate%20at%20which%20the%20system%20clock%20gains/losses%20time.%0Adriftfile%20/var/lib/chrony/drift%0A%0A%23%20Allow%20the%20system%20clock%20to%20be%20stepped%20in%20the%20first%20three%20updates%0A%23%20if%20its%20offset%20is%20larger%20than%201%20second.%0Amakestep%201.0%203%0A%0A%23%20Enable%20kernel%20synchronization%20of%20the%20real-time%20clock%20%28RTC%29.%0Artcsync%0A%0A%23%20Enable%20hardware%20timestamping%20on%20all%20interfaces%20that%20support%20it.%0A%23hwtimestamp%20%2A%0A%0A%23%20Increase%20the%20minimum%20number%20of%20selectable%20sources%20required%20to%20adjust%0A%23%20the%20system%20clock.%0A%23minsources%202%0A%0A%23%20Allow%20NTP%20client%20access%20from%20local%20network.%0A%23allow%20192.168.0.0/16%0A%0A%23%20Serve%20time%20even%20if%20not%20synchronized%20to%20a%20time%20source.%0A%23local%20stratum%2010%0A%0A%23%20Require%20authentication%20%28nts%20or%20key%20option%29%20for%20all%20NTP%20sources.%0A%23authselectmode%20require%0A%0A%23%20Specify%20file%20containing%20keys%20for%20NTP%20authentication.%0Akeyfile%20/etc/chrony.keys%0A%0A%23%20Insert/delete%20leap%20seconds%20by%20slewing%20instead%20of%20stepping.%0A%23leapsecmode%20slew%0A%0A%23%20Get%20TAI-UTC%20offset%20and%20leap%20seconds%20from%20the%20system%20tz%20database.%0Aleapsectz%20right/UTC%0A%0A%23%20Specify%20directory%20for%20log%20files.%0Alogdir%20/var/log/chrony%0A%0A%23%20Select%20which%20information%20is%20logged.%0A%23log%20measurements%20statistics%20tracking
        mode: 420
        overwrite: true
        path: /etc/chrony.conf
      - contents:
          source: data:,
        mode: 420
        overwrite: true
        path: /etc/chrony.d/.mco-keep
</fix>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref name="oval:ssg-chronyd_or_ntpd_specify_remote_server:def:1" href="ssg-fedora-oval.xml"/>
        </check>
        <check system="http://scap.nist.gov/schema/ocil/2">
          <check-content-ref name="ocil:ssg-chronyd_or_ntpd_specify_remote_server_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
        </check>
      </Rule>
      <Rule id="xccdf_org.ssgproject.content_rule_chronyd_or_ntpd_specify_multiple_servers" selected="false" role="full" severity="medium">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Specify Additional Remote NTP Servers</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Depending on specific functional requirements of a concrete
production environment, the Fedora system can be
configured to utilize the services of the <html:code xmlns:html="http://www.w3.org/1999/xhtml">chronyd</html:code> NTP daemon (the
default), or services of the <html:code xmlns:html="http://www.w3.org/1999/xhtml">ntpd</html:code> NTP daemon. Refer to

    
    <html:a xmlns:html="http://www.w3.org/1999/xhtml" href="https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/System_Administrators_Guide/ch-Configuring_NTP_Using_the_chrony_Suite.html">https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/System_Administrators_Guide/ch-Configuring_NTP_Using_the_chrony_Suite.html</html:a>

for more detailed comparison of the features of both of the choices, and for
further guidance how to choose between the two NTP daemons.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Additional NTP servers can be specified for time synchronization. To do so,
perform the following:
<html:ul xmlns:html="http://www.w3.org/1999/xhtml"><html:li> if the system is configured to use the <html:code>chronyd</html:code> as the NTP daemon
(the default), edit the file <html:code>/etc/chrony.conf</html:code> as follows,</html:li><html:li> if the system is configured to use the <html:code>ntpd</html:code> as the NTP daemon,
edit the file <html:code>/etc/ntp.conf</html:code> as documented below.</html:li></html:ul>
Add additional lines of the following form, substituting the IP address or
hostname of a remote NTP server for <html:em xmlns:html="http://www.w3.org/1999/xhtml">ntpserver</html:em>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">server <html:i>ntpserver</html:i></html:pre></description>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-8(1)(a)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-8(2)</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
        <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.12.4.1</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.12.4.2</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.12.4.3</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.12.4.4</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.12.7.1</reference>
        <reference href="https://www.cisecurity.org/controls/">1</reference>
        <reference href="https://www.cisecurity.org/controls/">14</reference>
        <reference href="https://www.cisecurity.org/controls/">15</reference>
        <reference href="https://www.cisecurity.org/controls/">16</reference>
        <reference href="https://www.cisecurity.org/controls/">3</reference>
        <reference href="https://www.cisecurity.org/controls/">5</reference>
        <reference href="https://www.cisecurity.org/controls/">6</reference>
        <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.4.3</reference>
        <reference href="">0988</reference>
        <reference href="">1405</reference>
        <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Specifying additional NTP servers increases the availability of
accurate time data, in the event that one of the specified servers becomes
unavailable. This is typical for a system acting as an NTP server for
other systems.</rationale>
        <platform idref="cpe:/a:machine"/>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="chronyd_or_ntpd_specify_multiple_servers" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then


var_multiple_time_servers="<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_multiple_time_servers" use="legacy"/>"



config_file="/etc/ntp.conf"
/usr/sbin/pidof ntpd || config_file="/etc/chrony.conf"

if ! [ "$(grep -c '^server' "$config_file")" -gt 1 ] ; then
  if ! grep -q '#[[:space:]]*server' "$config_file" ; then
    for server in $(echo "$var_multiple_time_servers" | tr ',' '\n') ; do
      printf '\nserver %s' "$server" &gt;&gt; "$config_file"
    done
  else
    sed -i 's/#[ \t]*server/server/g' "$config_file"
  fi
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="chronyd_or_ntpd_specify_multiple_servers" system="urn:xccdf:fix:script:kubernetes" reboot="true" complexity="low" disruption="low" strategy="restrict">apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,%23%20Allow%20for%20extra%20configuration%20files.%20This%20is%20useful%0A%23%20for%20admins%20specifying%20their%20own%20NTP%20servers%0Ainclude%20/etc/chrony.d/%2A.conf%0A%0A%23%20Set%20chronyd%20as%20client-only.%0Aport%200%0A%0A%23%20Disable%20chronyc%20from%20the%20network%0Acmdport%200%0A%0A%23%20Record%20the%20rate%20at%20which%20the%20system%20clock%20gains/losses%20time.%0Adriftfile%20/var/lib/chrony/drift%0A%0A%23%20Allow%20the%20system%20clock%20to%20be%20stepped%20in%20the%20first%20three%20updates%0A%23%20if%20its%20offset%20is%20larger%20than%201%20second.%0Amakestep%201.0%203%0A%0A%23%20Enable%20kernel%20synchronization%20of%20the%20real-time%20clock%20%28RTC%29.%0Artcsync%0A%0A%23%20Enable%20hardware%20timestamping%20on%20all%20interfaces%20that%20support%20it.%0A%23hwtimestamp%20%2A%0A%0A%23%20Increase%20the%20minimum%20number%20of%20selectable%20sources%20required%20to%20adjust%0A%23%20the%20system%20clock.%0A%23minsources%202%0A%0A%23%20Allow%20NTP%20client%20access%20from%20local%20network.%0A%23allow%20192.168.0.0/16%0A%0A%23%20Serve%20time%20even%20if%20not%20synchronized%20to%20a%20time%20source.%0A%23local%20stratum%2010%0A%0A%23%20Require%20authentication%20%28nts%20or%20key%20option%29%20for%20all%20NTP%20sources.%0A%23authselectmode%20require%0A%0A%23%20Specify%20file%20containing%20keys%20for%20NTP%20authentication.%0Akeyfile%20/etc/chrony.keys%0A%0A%23%20Insert/delete%20leap%20seconds%20by%20slewing%20instead%20of%20stepping.%0A%23leapsecmode%20slew%0A%0A%23%20Get%20TAI-UTC%20offset%20and%20leap%20seconds%20from%20the%20system%20tz%20database.%0Aleapsectz%20right/UTC%0A%0A%23%20Specify%20directory%20for%20log%20files.%0Alogdir%20/var/log/chrony%0A%0A%23%20Select%20which%20information%20is%20logged.%0A%23log%20measurements%20statistics%20tracking
        mode: 420
        overwrite: true
        path: /etc/chrony.conf
      - contents:
          source: data:,
        mode: 420
        overwrite: true
        path: /etc/chrony.d/.mco-keep
</fix>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref name="oval:ssg-chronyd_or_ntpd_specify_multiple_servers:def:1" href="ssg-fedora-oval.xml"/>
        </check>
      </Rule>
      <Rule id="xccdf_org.ssgproject.content_rule_ntpd_configure_restrictions" selected="false" role="full" severity="medium">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Configure server restrictions for ntpd</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">ntpd is a daemon which implements the Network Time Protocol (NTP). It is designed to
synchronize system clocks across a variety of systems and use a source that is highly
accurate. More information on NTP can be found at

    <html:a xmlns:html="http://www.w3.org/1999/xhtml" href="http://www.ntp.org">http://www.ntp.org</html:a>.
ntp can be configured to be a client and/or a server.
To ensure that ntpd implements correct server restrictions, make sure that the following lines exist in the file <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/ntpd.conf</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">restrict -4 default kod nomodify notrap nopeer noquery</html:pre>
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">restrict -6 default kod nomodify notrap nopeer noquery</html:pre>
This recommendation only applies if ntp is in use on the system.</description>
        <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">If ntp is in use on the system proper configuration is vital to ensuring time synchronization
is working properly.</rationale>
        <platform idref="cpe:/a:ntp"/>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="ntpd_configure_restrictions" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ] &amp;&amp; { rpm --quiet -q ntp; }; then

#!/bin/bash

if [ -e "/etc/ntp.conf" ] ; then
    LC_ALL=C sed -i "/^\s*restrict -4\s\+/Id" "/etc/ntp.conf"
else
    touch "/etc/ntp.conf"
fi
cp "/etc/ntp.conf" "/etc/ntp.conf.bak"
# Insert at the end of the file
printf '%s\n' "restrict -4 default kod nomodify notrap nopeer noquery" &gt;&gt; "/etc/ntp.conf"
# Clean up after ourselves.
rm "/etc/ntp.conf.bak"
if [ -e "/etc/ntp.conf" ] ; then
    LC_ALL=C sed -i "/^\s*restrict -6\s\+/Id" "/etc/ntp.conf"
else
    touch "/etc/ntp.conf"
fi
cp "/etc/ntp.conf" "/etc/ntp.conf.bak"
# Insert at the end of the file
printf '%s\n' "restrict -6 default kod nomodify notrap nopeer noquery" &gt;&gt; "/etc/ntp.conf"
# Clean up after ourselves.
rm "/etc/ntp.conf.bak"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="ntpd_configure_restrictions" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - ntpd_configure_restrictions

- name: configure ipv4 restrictions for ntpd
  lineinfile:
    path: /etc/ntp.conf
    create: true
    line: restrict -4 default kod nomodify notrap nopeer noquery
    state: present
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - '"ntp" in ansible_facts.packages'
  tags:
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - ntpd_configure_restrictions

- name: configure ipv6 restrictions for ntpd
  lineinfile:
    path: /etc/ntp.conf
    create: true
    line: restrict -6 default kod nomodify notrap nopeer noquery
    state: present
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - '"ntp" in ansible_facts.packages'
  tags:
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - ntpd_configure_restrictions
</fix>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref name="oval:ssg-ntpd_configure_restrictions:def:1" href="ssg-fedora-oval.xml"/>
        </check>
        <check system="http://scap.nist.gov/schema/ocil/2">
          <check-content-ref name="ocil:ssg-ntpd_configure_restrictions_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
        </check>
      </Rule>
      <Rule id="xccdf_org.ssgproject.content_rule_ntpd_run_as_ntp_user" selected="false" role="full" severity="medium">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Configure ntpd To Run As ntp User</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">ntp is a daemon which implements the Network Time Protocol (NTP). It is designed to
synchronize system clocks across a variety of systems and use a source that is highly
accurate. More information on NTP can be found at

    <html:a xmlns:html="http://www.w3.org/1999/xhtml" href="http://www.ntp.org">http://www.ntp.org</html:a>.
ntp can be configured to be a client and/or a server.
To ensure that ntpd is running as ntp user, Add or edit the
<html:code xmlns:html="http://www.w3.org/1999/xhtml">OPTIONS</html:code> variable in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/sysconfig/ntpd</html:code> to include ' -u ntp:ntp ':
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">OPTIONS="-u ntp:ntp"</html:pre>
This recommendation only applies if ntp is in use on the system.</description>
        <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">If ntp is in use on the system proper configuration is vital to ensuring time synchronization
is working properly. Running ntpd under dedicated user accounts limits the attack surface for
potential attacker exploiting security flaws in the daemon or the protocol.</rationale>
        <platform idref="cpe:/a:ntp"/>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="ntpd_run_as_ntp_user" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ] &amp;&amp; { rpm --quiet -q ntp; }; then

if grep -q 'OPTIONS=.*' /etc/sysconfig/ntpd; then
	# trying to solve cases where the parameter after OPTIONS
	#may or may not be enclosed in quotes
	sed -i -E 's/^([\s]*OPTIONS=["]?[^"]*)("?)/\1 -u ntp:ntp\2/' /etc/sysconfig/ntpd
else
	echo 'OPTIONS="-u ntp:ntp"' &gt;&gt; /etc/sysconfig/ntpd
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="ntpd_run_as_ntp_user" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - ntpd_run_as_ntp_user

- name: detect if file is not empty or missing
  find:
    path: /etc/sysconfig/
    patterns: ntpd
    contains: ^([\s]*OPTIONS=["]?[^"]*)("?)
  register: ntpd_file
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - '"ntp" in ansible_facts.packages'
  tags:
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - ntpd_run_as_ntp_user

- name: replace existing setting or create a new file, rest is handled by different
    task
  lineinfile:
    path: /etc/sysconfig/ntpd
    regexp: ^([\s]*OPTIONS=["]?[^"]*)("?)
    line: \1 -u ntp:ntp\2
    state: present
    create: true
    backrefs: true
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - '"ntp" in ansible_facts.packages'
    - ntpd_file.matched &gt; 0
  tags:
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - ntpd_run_as_ntp_user

- name: put line into file, assume file was empty
  lineinfile:
    path: /etc/sysconfig/ntpd
    line: OPTIONS="-u ntp:ntp"
    state: present
    create: true
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - '"ntp" in ansible_facts.packages'
    - ntpd_file.matched == 0
  tags:
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - ntpd_run_as_ntp_user
</fix>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref name="oval:ssg-ntpd_run_as_ntp_user:def:1" href="ssg-fedora-oval.xml"/>
        </check>
        <check system="http://scap.nist.gov/schema/ocil/2">
          <check-content-ref name="ocil:ssg-ntpd_run_as_ntp_user_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
        </check>
      </Rule>
      <Rule id="xccdf_org.ssgproject.content_rule_chronyd_no_chronyc_network" selected="false" role="full" severity="low">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable network management of chrony daemon</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">cmdport</html:code> option in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/chrony.conf</html:code> can be set to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">0</html:code> to stop chrony daemon from listening on the UDP port 323
for management connections made by chronyc.</description>
        <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_SMF_EXT.1</reference>
        <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000096-GPOS-00050</reference>
        <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000095-GPOS-00049</reference>
        <reference href="https://public.cyber.mil/stigs/cci/">CCI-000381</reference>
        <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Not exposing the management interface of the chrony daemon on
the network diminishes the attack space.</rationale>
        <platform idref="cpe:/a:machine"/>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="chronyd_no_chronyc_network" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

# Include source function library
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_replace_or_append" use="legacy"/>
replace_or_append /etc/chrony.conf '^cmdport' 0 '' '%s %s'

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="chronyd_no_chronyc_network" system="urn:xccdf:fix:script:kubernetes" reboot="true" complexity="low" disruption="low" strategy="restrict">apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,%23%20Allow%20for%20extra%20configuration%20files.%20This%20is%20useful%0A%23%20for%20admins%20specifying%20their%20own%20NTP%20servers%0Ainclude%20/etc/chrony.d/%2A.conf%0A%0A%23%20Set%20chronyd%20as%20client-only.%0Aport%200%0A%0A%23%20Disable%20chronyc%20from%20the%20network%0Acmdport%200%0A%0A%23%20Record%20the%20rate%20at%20which%20the%20system%20clock%20gains/losses%20time.%0Adriftfile%20/var/lib/chrony/drift%0A%0A%23%20Allow%20the%20system%20clock%20to%20be%20stepped%20in%20the%20first%20three%20updates%0A%23%20if%20its%20offset%20is%20larger%20than%201%20second.%0Amakestep%201.0%203%0A%0A%23%20Enable%20kernel%20synchronization%20of%20the%20real-time%20clock%20%28RTC%29.%0Artcsync%0A%0A%23%20Enable%20hardware%20timestamping%20on%20all%20interfaces%20that%20support%20it.%0A%23hwtimestamp%20%2A%0A%0A%23%20Increase%20the%20minimum%20number%20of%20selectable%20sources%20required%20to%20adjust%0A%23%20the%20system%20clock.%0A%23minsources%202%0A%0A%23%20Allow%20NTP%20client%20access%20from%20local%20network.%0A%23allow%20192.168.0.0/16%0A%0A%23%20Serve%20time%20even%20if%20not%20synchronized%20to%20a%20time%20source.%0A%23local%20stratum%2010%0A%0A%23%20Require%20authentication%20%28nts%20or%20key%20option%29%20for%20all%20NTP%20sources.%0A%23authselectmode%20require%0A%0A%23%20Specify%20file%20containing%20keys%20for%20NTP%20authentication.%0Akeyfile%20/etc/chrony.keys%0A%0A%23%20Insert/delete%20leap%20seconds%20by%20slewing%20instead%20of%20stepping.%0A%23leapsecmode%20slew%0A%0A%23%20Get%20TAI-UTC%20offset%20and%20leap%20seconds%20from%20the%20system%20tz%20database.%0Aleapsectz%20right/UTC%0A%0A%23%20Specify%20directory%20for%20log%20files.%0Alogdir%20/var/log/chrony%0A%0A%23%20Select%20which%20information%20is%20logged.%0A%23log%20measurements%20statistics%20tracking
        mode: 420
        overwrite: true
        path: /etc/chrony.conf
      - contents:
          source: data:,
        mode: 420
        overwrite: true
        path: /etc/chrony.d/.mco-keep
</fix>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref name="oval:ssg-chronyd_no_chronyc_network:def:1" href="ssg-fedora-oval.xml"/>
        </check>
        <check system="http://scap.nist.gov/schema/ocil/2">
          <check-content-ref name="ocil:ssg-chronyd_no_chronyc_network_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
        </check>
      </Rule>
      <Rule id="xccdf_org.ssgproject.content_rule_ntpd_specify_remote_server" selected="false" role="full" severity="medium">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Specify a Remote NTP Server</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To specify a remote NTP server for time synchronization, edit
the file <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/ntp.conf</html:code>. Add or correct the following lines,
substituting the IP or hostname of a remote NTP server for <html:em xmlns:html="http://www.w3.org/1999/xhtml">ntpserver</html:em>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">server <html:i>ntpserver</html:i></html:pre>
This instructs the NTP software to contact that remote server to obtain time
data.</description>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-8(1)(a)</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
        <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.4.1</reference>
        <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.4.3</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
        <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.12.4.1</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.12.4.2</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.12.4.3</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.12.4.4</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.12.7.1</reference>
        <reference href="https://www.cisecurity.org/controls/">1</reference>
        <reference href="https://www.cisecurity.org/controls/">14</reference>
        <reference href="https://www.cisecurity.org/controls/">15</reference>
        <reference href="https://www.cisecurity.org/controls/">16</reference>
        <reference href="https://www.cisecurity.org/controls/">3</reference>
        <reference href="https://www.cisecurity.org/controls/">5</reference>
        <reference href="https://www.cisecurity.org/controls/">6</reference>
        <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Synchronizing with an NTP server makes it possible
to collate system logs from multiple sources or correlate computer events with
real time events.</rationale>
        <platform idref="cpe:/a:machine"/>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref name="oval:ssg-ntpd_specify_remote_server:def:1" href="ssg-fedora-oval.xml"/>
        </check>
        <check system="http://scap.nist.gov/schema/ocil/2">
          <check-content-ref name="ocil:ssg-ntpd_specify_remote_server_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
        </check>
      </Rule>
      <Rule id="xccdf_org.ssgproject.content_rule_chronyd_client_only" selected="false" role="full" severity="low">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable chrony daemon from acting as server</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">port</html:code> option in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/chrony.conf</html:code> can be set to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">0</html:code> to make chrony daemon to never open any listening port
for server operation and to operate strictly in a client-only mode.</description>
        <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_SMF_EXT.1</reference>
        <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000096-GPOS-00050</reference>
        <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000095-GPOS-00049</reference>
        <reference href="https://public.cyber.mil/stigs/cci/">CCI-000381</reference>
        <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Minimizing the exposure of the server functionality of the chrony
daemon diminishes the attack surface.</rationale>
        <platform idref="cpe:/a:machine"/>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="chronyd_client_only" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

# Include source function library
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_replace_or_append" use="legacy"/>
replace_or_append /etc/chrony.conf '^port' 0 '' '%s %s'

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="chronyd_client_only" system="urn:xccdf:fix:script:kubernetes" reboot="true" complexity="low" disruption="low" strategy="restrict">apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,%23%20Allow%20for%20extra%20configuration%20files.%20This%20is%20useful%0A%23%20for%20admins%20specifying%20their%20own%20NTP%20servers%0Ainclude%20/etc/chrony.d/%2A.conf%0A%0A%23%20Set%20chronyd%20as%20client-only.%0Aport%200%0A%0A%23%20Disable%20chronyc%20from%20the%20network%0Acmdport%200%0A%0A%23%20Record%20the%20rate%20at%20which%20the%20system%20clock%20gains/losses%20time.%0Adriftfile%20/var/lib/chrony/drift%0A%0A%23%20Allow%20the%20system%20clock%20to%20be%20stepped%20in%20the%20first%20three%20updates%0A%23%20if%20its%20offset%20is%20larger%20than%201%20second.%0Amakestep%201.0%203%0A%0A%23%20Enable%20kernel%20synchronization%20of%20the%20real-time%20clock%20%28RTC%29.%0Artcsync%0A%0A%23%20Enable%20hardware%20timestamping%20on%20all%20interfaces%20that%20support%20it.%0A%23hwtimestamp%20%2A%0A%0A%23%20Increase%20the%20minimum%20number%20of%20selectable%20sources%20required%20to%20adjust%0A%23%20the%20system%20clock.%0A%23minsources%202%0A%0A%23%20Allow%20NTP%20client%20access%20from%20local%20network.%0A%23allow%20192.168.0.0/16%0A%0A%23%20Serve%20time%20even%20if%20not%20synchronized%20to%20a%20time%20source.%0A%23local%20stratum%2010%0A%0A%23%20Require%20authentication%20%28nts%20or%20key%20option%29%20for%20all%20NTP%20sources.%0A%23authselectmode%20require%0A%0A%23%20Specify%20file%20containing%20keys%20for%20NTP%20authentication.%0Akeyfile%20/etc/chrony.keys%0A%0A%23%20Insert/delete%20leap%20seconds%20by%20slewing%20instead%20of%20stepping.%0A%23leapsecmode%20slew%0A%0A%23%20Get%20TAI-UTC%20offset%20and%20leap%20seconds%20from%20the%20system%20tz%20database.%0Aleapsectz%20right/UTC%0A%0A%23%20Specify%20directory%20for%20log%20files.%0Alogdir%20/var/log/chrony%0A%0A%23%20Select%20which%20information%20is%20logged.%0A%23log%20measurements%20statistics%20tracking
        mode: 420
        overwrite: true
        path: /etc/chrony.conf
      - contents:
          source: data:,
        mode: 420
        overwrite: true
        path: /etc/chrony.d/.mco-keep
</fix>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref name="oval:ssg-chronyd_client_only:def:1" href="ssg-fedora-oval.xml"/>
        </check>
        <check system="http://scap.nist.gov/schema/ocil/2">
          <check-content-ref name="ocil:ssg-chronyd_client_only_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
        </check>
      </Rule>
      <Rule id="xccdf_org.ssgproject.content_rule_chronyd_specify_remote_server" selected="false" role="full" severity="medium">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">A remote time server for Chrony is configured</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US"><html:code xmlns:html="http://www.w3.org/1999/xhtml">Chrony</html:code> is a daemon which implements the Network Time Protocol (NTP). It is designed to
synchronize system clocks across a variety of systems and use a source that is highly
accurate. More information on <html:code xmlns:html="http://www.w3.org/1999/xhtml">chrony</html:code> can be found at

    <html:a xmlns:html="http://www.w3.org/1999/xhtml" href="http://chrony.tuxfamily.org/">http://chrony.tuxfamily.org/</html:a>.
<html:code xmlns:html="http://www.w3.org/1999/xhtml">Chrony</html:code> can be configured to be a client and/or a server.
Add or edit server or pool lines to <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/chrony.conf</html:code> as appropriate:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">server &lt;remote-server&gt;</html:pre>
Multiple servers may be configured.</description>
        <reference href="">0988</reference>
        <reference href="">1405</reference>
        <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R43)</reference>
        <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">If <html:code xmlns:html="http://www.w3.org/1999/xhtml">chrony</html:code> is in use on the system proper configuration is vital to ensuring time
synchronization is working properly.</rationale>
        <platform idref="cpe:/a:chrony"/>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="chronyd_specify_remote_server" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ] &amp;&amp; { rpm --quiet -q chrony; }; then


var_multiple_time_servers="<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_multiple_time_servers" use="legacy"/>"



config_file="/etc/chrony.conf"

if ! grep -q '^[\s]*(?:server|pool)[\s]+[\w]+' "$config_file" ; then
  if ! grep -q '#[[:space:]]*server' "$config_file" ; then
    for server in $(echo "$var_multiple_time_servers" | tr ',' '\n') ; do
      printf '\nserver %s' "$server" &gt;&gt; "$config_file"
    done
  else
    sed -i 's/#[ \t]*server/server/g' "$config_file"
  fi
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="chronyd_specify_remote_server" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - chronyd_specify_remote_server
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
- name: XCCDF Value var_multiple_time_servers # promote to variable
  set_fact:
    var_multiple_time_servers: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_multiple_time_servers" use="legacy"/>
  tags:
    - always

- name: Detect if chrony is already configured with pools or servers
  find:
    path: /etc
    patterns: chrony.conf
    contains: ^[\s]*(?:server|pool)[\s]+[\w]+
  register: chrony_servers
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - '"chrony" in ansible_facts.packages'
  tags:
    - chronyd_specify_remote_server
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Configure remote time servers
  lineinfile:
    path: /etc/chrony.conf
    line: server {{ item }}
    state: present
    create: true
  loop: '{{ var_multiple_time_servers.split(",") }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - '"chrony" in ansible_facts.packages'
    - chrony_servers.matched == 0
  tags:
    - chronyd_specify_remote_server
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
</fix>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref name="oval:ssg-chronyd_specify_remote_server:def:1" href="ssg-fedora-oval.xml"/>
        </check>
        <check system="http://scap.nist.gov/schema/ocil/2">
          <check-content-ref name="ocil:ssg-chronyd_specify_remote_server_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
        </check>
      </Rule>
    </Group>
    <Group id="xccdf_org.ssgproject.content_group_avahi">
      <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Avahi Server</title>
      <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The Avahi daemon implements the DNS Service Discovery
and Multicast DNS protocols, which provide service and host
discovery on a network. It allows a system to automatically
identify resources on the network, such as printers or web servers.
This capability is also known as mDNSresponder and is a major part
of Zeroconf networking.</description>
      <Group id="xccdf_org.ssgproject.content_group_avahi_configuration">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Configure Avahi if Necessary</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">If your system requires the Avahi daemon, its configuration can be restricted
to improve security. The Avahi daemon configuration file is
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/avahi/avahi-daemon.conf</html:code>. The following security recommendations
should be applied to this file:
See the <html:code xmlns:html="http://www.w3.org/1999/xhtml">avahi-daemon.conf(5)</html:code> man page, or documentation at

    <html:a xmlns:html="http://www.w3.org/1999/xhtml" href="http://www.avahi.org">http://www.avahi.org</html:a>, for more detailed information
about the configuration options.</description>
        <Rule id="xccdf_org.ssgproject.content_rule_avahi_disable_publishing" selected="false" role="full" severity="low">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable Avahi Publishing</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To prevent Avahi from publishing its records, edit <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/avahi/avahi-daemon.conf</html:code>
and ensure the following line appears in the <html:code xmlns:html="http://www.w3.org/1999/xhtml">[publish]</html:code> section:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">disable-publishing=yes</html:pre></description>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.11</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.12</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.3</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.06</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.5.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.6.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.2.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.2.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
          <reference href="https://www.cisecurity.org/controls/">11</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">9</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">This helps ensure that no record will be published by Avahi.</rationale>
        </Rule>
      </Group>
      <Group id="xccdf_org.ssgproject.content_group_disable_avahi_group">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable Avahi Server if Possible</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Because the Avahi daemon service keeps an open network
port, it is subject to network attacks.
Disabling it can reduce the system's vulnerability to such attacks.</description>
      </Group>
    </Group>
    <Group id="xccdf_org.ssgproject.content_group_ldap">
      <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">LDAP</title>
      <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">LDAP is a popular directory service, that is, a
standardized way of looking up information from a central database.
Fedora includes software that enables a system to act as both
an LDAP client and server.</description>
      <Group id="xccdf_org.ssgproject.content_group_openldap_server">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Configure OpenLDAP Server</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">This section details some security-relevant settings
for an OpenLDAP server.</description>
        <Group id="xccdf_org.ssgproject.content_group_ldap_server_config_certificate_files">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Install and Protect LDAP Certificate Files</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Create the PKI directory for LDAP certificates if it does not already exist:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo mkdir /etc/pki/tls/ldap
$ sudo chown root:root /etc/pki/tls/ldap
$ sudo chmod 755 /etc/pki/tls/ldap</html:pre>
Using removable media or some other secure transmission format, install the certificate files
onto the LDAP server:
<html:ul xmlns:html="http://www.w3.org/1999/xhtml"><html:li><html:code>/etc/pki/tls/ldap/serverkey.pem</html:code>: the private key <html:code>ldapserverkey.pem</html:code></html:li><html:li><html:code>/etc/pki/tls/ldap/servercert.pem</html:code>: the certificate file <html:code>ldapservercert.pem</html:code></html:li></html:ul>
Verify the ownership and permissions of these files:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo chown root:ldap /etc/pki/tls/ldap/serverkey.pem
$ sudo chown root:ldap /etc/pki/tls/ldap/servercert.pem
$ sudo chmod 640 /etc/pki/tls/ldap/serverkey.pem
$ sudo chmod 640 /etc/pki/tls/ldap/servercert.pem</html:pre>
Verify that the CA's public certificate file has been installed as
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/pki/tls/CA/cacert.pem</html:code>, and has the correct permissions:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo mkdir /etc/pki/tls/CA
$ sudo chown root:root /etc/pki/tls/CA/cacert.pem
$ sudo chmod 644 /etc/pki/tls/CA/cacert.pem</html:pre>

As a result of these steps, the LDAP server will have access to its own private
certificate and the key with which that certificate is encrypted, and to the
public certificate file belonging to the CA. Note that it would be possible for
the key to be protected further, so that processes running as ldap could not
read it. If this were done, the LDAP server process would need to be restarted
manually whenever the server rebooted.</description>
        </Group>
      </Group>
      <Group id="xccdf_org.ssgproject.content_group_openldap_client">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Configure OpenLDAP Clients</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">This section provides information on which security settings are
important to configure in OpenLDAP clients by manually editing the appropriate
configuration files.  Fedora provides an automated configuration tool called
authconfig and a graphical wrapper for authconfig called
<html:code xmlns:html="http://www.w3.org/1999/xhtml">system-config-authentication</html:code>. However, these tools do not provide as
much control over configuration as manual editing of configuration files. The
authconfig tools do not allow you to specify locations of SSL certificate
files, which is useful when trying to use SSL cleanly across several protocols.
Installation and configuration of OpenLDAP on Fedora is available at</description>
        <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">Before configuring any system to be an
LDAP client, ensure that a working LDAP server is present on the
network.</warning>
        <Rule id="xccdf_org.ssgproject.content_rule_package_openldap-clients_removed" selected="false" role="full" severity="low">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure LDAP client is not installed</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The Lightweight Directory Access Protocol (LDAP) is a service that provides
a method for looking up information from a central database.
The <html:code xmlns:html="http://www.w3.org/1999/xhtml">openldap-clients</html:code> package can be removed with the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">
$ sudo dnf erase openldap-clients</html:pre></description>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">If the system does not need to act as an LDAP client, it is recommended that the software is removed to reduce the potential attack surface.</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_openldap-clients_removed" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="disable">
# CAUTION: This remediation script will remove openldap-clients
#	   from the system, and may remove any packages
#	   that depend on openldap-clients. Execute this
#	   remediation AFTER testing on a non-production
#	   system!

if rpm -q --quiet "openldap-clients" ; then
    dnf remove -y "openldap-clients"
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_openldap-clients_removed" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="disable">- name: Ensure openldap-clients is removed
  package:
    name: openldap-clients
    state: absent
  tags:
    - disable_strategy
    - low_complexity
    - low_disruption
    - low_severity
    - no_reboot_needed
    - package_openldap-clients_removed
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_openldap-clients_removed" system="urn:xccdf:fix:script:puppet" complexity="low" disruption="low" strategy="disable">include remove_openldap-clients

class remove_openldap-clients {
  package { 'openldap-clients':
    ensure =&gt; 'purged',
  }
}
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_openldap-clients_removed" system="urn:redhat:anaconda:pre" complexity="low" disruption="low" strategy="disable">
package --remove=openldap-clients
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-package_openldap-clients_removed:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-package_openldap-clients_removed_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
      </Group>
    </Group>
    <Group id="xccdf_org.ssgproject.content_group_printing">
      <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Print Support</title>
      <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The Common Unix Printing System (CUPS) service provides both local
and network printing support. A system running the CUPS service can accept
print jobs from other systems, process them, and send them to the appropriate
printer. It also provides an interface for remote administration through a web
browser. The CUPS service is installed and activated by default. The project
homepage and more detailed documentation are available at

    <html:a xmlns:html="http://www.w3.org/1999/xhtml" href="http://www.cups.org">http://www.cups.org</html:a>.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/></description>
      <Group id="xccdf_org.ssgproject.content_group_configure_printing">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Configure the CUPS Service if Necessary</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">CUPS provides the ability to easily share local printers with
other systems over the network. It does this by allowing systems to share
lists of available printers. Additionally, each system that runs the CUPS
service can potentially act as a print server. Whenever possible, the printer
sharing and print server capabilities of CUPS should be limited or disabled.
The following recommendations should demonstrate how to do just that.</description>
      </Group>
    </Group>
    <Group id="xccdf_org.ssgproject.content_group_dhcp">
      <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">DHCP</title>
      <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The Dynamic Host Configuration Protocol (DHCP) allows
systems to request and obtain an IP address and other configuration
parameters from a server.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
This guide recommends configuring networking on clients by manually editing
the appropriate files under <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/sysconfig</html:code>.  Use of DHCP can make client 
systems vulnerable to compromise by rogue DHCP servers, and should be avoided 
unless necessary.  If using DHCP is necessary, however, there are best practices 
that should be followed to minimize security risk.</description>
      <Group id="xccdf_org.ssgproject.content_group_disabling_dhcp_server">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable DHCP Server</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The DHCP server <html:code xmlns:html="http://www.w3.org/1999/xhtml">dhcpd</html:code> is not installed or activated by
default. If the software was installed and activated, but the
system does not need to act as a DHCP server, it should be disabled
and removed.</description>
      </Group>
      <Group id="xccdf_org.ssgproject.content_group_disabling_dhcp_client">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable DHCP Client</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">DHCP is the default network configuration method provided by the system
installer, and common on many networks. Nevertheless, manual management
of IP addresses for systems implies a greater degree of management and
accountability for network activity.</description>
      </Group>
      <Group id="xccdf_org.ssgproject.content_group_dhcp_client_configuration">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Configure DHCP Client if Necessary</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">If DHCP must be used, then certain configuration changes can
minimize the amount of information it receives and applies from the network,
and thus the amount of incorrect information a rogue DHCP server could
successfully distribute.  For more information on configuring dhclient, see the
<html:code xmlns:html="http://www.w3.org/1999/xhtml">dhclient(8)</html:code> and <html:code xmlns:html="http://www.w3.org/1999/xhtml">dhclient.conf(5)</html:code> man pages.</description>
        <Rule id="xccdf_org.ssgproject.content_rule_dhcp_client_restrict_options" selected="false" role="full" severity="unknown">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Minimize the DHCP-Configured Options</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Create the file <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/dhcp/dhclient.conf</html:code>, and add an
appropriate setting for each of the ten configuration settings which can be
obtained via DHCP. For each setting, do one of the following:
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
If the setting should <html:i xmlns:html="http://www.w3.org/1999/xhtml">not</html:i> be configured remotely by the DHCP server,
select an appropriate static value, and add the line:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">supersede <html:code>setting value</html:code>;</html:pre>
If the setting should be configured remotely by the DHCP server, add the lines:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">request <html:code>setting</html:code>;
require <html:code>setting</html:code>;</html:pre>
For example, suppose the DHCP server should provide only the IP address itself
and the subnet mask. Then the entire file should look like:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">supersede domain-name "example.com";
supersede domain-name-servers 192.168.1.2;
supersede nis-domain "";
supersede nis-servers "";
supersede ntp-servers "ntp.example.com ";
supersede routers 192.168.1.1;
supersede time-offset -18000;
request subnet-mask;
require subnet-mask;</html:pre></description>
          <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">In this example, the options nis-servers and
nis-domain are set to empty strings, on the assumption that the deprecated NIS
protocol is not in use. It is necessary to supersede settings for unused
services so that they cannot be set by a hostile DHCP server. If an option is
set to an empty string, dhclient will typically not attempt to configure the
service.</warning>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">By default, the DHCP client program, dhclient, requests and applies
ten configuration options (in addition to the IP address) from the DHCP server.
subnet-mask, broadcast-address, time-offset, routers, domain-name,
domain-name-servers, host-name, nis-domain, nis-servers, and ntp-servers.  Many
of the options requested and applied by dhclient may be the same for every
system on a network. It is recommended that almost all configuration options be
assigned statically, and only options which must vary on a host-by-host basis
be assigned via DHCP. This limits the damage which can be done by a rogue DHCP
server.  If appropriate for your site, it is also possible to supersede the
host-name directive in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/dhcp/dhclient.conf</html:code>, establishing a static
hostname for the system. However, dhclient does not use the host name option
provided by the DHCP server (instead using the value provided by a reverse DNS
lookup).</rationale>
        </Rule>
      </Group>
      <Group id="xccdf_org.ssgproject.content_group_dhcp_server_configuration">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Configure DHCP Server</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">If the system must act as a DHCP server, the configuration
information it serves should be minimized. Also, support for other protocols
and DNS-updating schemes should be explicitly disabled unless needed. The
configuration file for dhcpd is called <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/dhcp/dhcpd.conf</html:code>. The file
begins with a number of global configuration options. The remainder of the file
is divided into sections, one for each block of addresses offered by dhcpd,
each of which contains configuration options specific to that address
block.</description>
        <Rule id="xccdf_org.ssgproject.content_rule_dhcp_server_minimize_served_info" selected="false" role="full" severity="unknown">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Minimize Served Information</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Edit /etc/dhcp/dhcpd.conf. Examine each address range section within
the file, and ensure that the following options are not defined unless there is
an operational need to provide this information via DHCP:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">option domain-name
option domain-name-servers
option nis-domain
option nis-servers
option ntp-servers
option routers
option time-offset</html:pre></description>
          <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">By default, the Red Hat Enterprise Linux client installation uses DHCP
to request much of the above information from the DHCP server. In particular,
domain-name, domain-name-servers, and routers are configured via DHCP.  These
settings are typically necessary for proper network functionality, but are also
usually static across systems at a given site.</warning>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.11</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.12</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.3</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.06</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.5.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.6.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.2.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.2.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
          <reference href="https://www.cisecurity.org/controls/">11</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">9</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Because the configuration information provided by the DHCP server
could be maliciously provided to clients by a rogue DHCP server, the amount of
information provided via DHCP should be minimized. Remove these definitions
from the DHCP server configuration to ensure that legitimate clients do not
unnecessarily rely on DHCP for this information.</rationale>
        </Rule>
      </Group>
    </Group>
    <Group id="xccdf_org.ssgproject.content_group_obsolete">
      <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Obsolete Services</title>
      <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">This section discusses a number of network-visible
services which have historically caused problems for system
security, and for which disabling or severely limiting the service
has been the best available guidance for some time. As a result of
this, many of these services are not installed as part of Fedora
by default.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Organizations which are running these services should
switch to more secure equivalents as soon as possible.
If it remains absolutely necessary to run one of
these services for legacy reasons, care should be taken to restrict
the service as much as possible, for instance by configuring host

firewall software such as <html:code xmlns:html="http://www.w3.org/1999/xhtml">iptables</html:code> to restrict access to the

vulnerable service to only those remote hosts which have a known
need to use it.</description>
      <Rule id="xccdf_org.ssgproject.content_rule_service_rsyncd_disabled" selected="false" role="full" severity="medium">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure rsyncd service is diabled</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">
The <html:code xmlns:html="http://www.w3.org/1999/xhtml">rsyncd</html:code> service can be disabled with the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo systemctl mask --now rsyncd.service</html:pre></description>
        <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The rsyncd service presents a security risk as it uses unencrypted protocols for
communication.</rationale>
        <platform idref="cpe:/a:machine"/>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="service_rsyncd_disabled" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

SYSTEMCTL_EXEC='/usr/bin/systemctl'
"$SYSTEMCTL_EXEC" stop 'rsyncd.service'
"$SYSTEMCTL_EXEC" disable 'rsyncd.service'
"$SYSTEMCTL_EXEC" mask 'rsyncd.service'
# Disable socket activation if we have a unit file for it
if "$SYSTEMCTL_EXEC" list-unit-files | grep -q '^rsyncd.socket'; then
    "$SYSTEMCTL_EXEC" stop 'rsyncd.socket'
    "$SYSTEMCTL_EXEC" mask 'rsyncd.socket'
fi
# The service may not be running because it has been started and failed,
# so let's reset the state so OVAL checks pass.
# Service should be 'inactive', not 'failed' after reboot though.
"$SYSTEMCTL_EXEC" reset-failed 'rsyncd.service' || true

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="service_rsyncd_disabled" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="disable">- name: Disable service rsyncd
  block:

    - name: Gather the service facts
      service_facts: null

    - name: Disable service rsyncd
      systemd:
        name: rsyncd.service
        enabled: 'no'
        state: stopped
        masked: 'yes'
      when: '"rsyncd.service" in ansible_facts.services'
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - disable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - service_rsyncd_disabled

- name: Unit Socket Exists - rsyncd.socket
  command: systemctl list-unit-files rsyncd.socket
  args:
    warn: false
  register: socket_file_exists
  changed_when: false
  ignore_errors: true
  check_mode: false
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - disable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - service_rsyncd_disabled

- name: Disable socket rsyncd
  systemd:
    name: rsyncd.socket
    enabled: 'no'
    state: stopped
    masked: 'yes'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - '"rsyncd.socket" in socket_file_exists.stdout_lines[1]'
  tags:
    - disable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - service_rsyncd_disabled
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="service_rsyncd_disabled" system="urn:xccdf:fix:script:puppet" complexity="low" disruption="low" strategy="enable">include disable_rsyncd

class disable_rsyncd {
  service {'rsyncd':
    enable =&gt; false,
    ensure =&gt; 'stopped',
  }
}
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="service_rsyncd_disabled" system="urn:xccdf:fix:script:kubernetes" reboot="true" complexity="low" disruption="medium" strategy="disable">apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    systemd:
      units:
      - name: rsyncd.service
        enabled: false
        mask: true
      - name: rsyncd.socket
        enabled: false
        mask: true
</fix>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref name="oval:ssg-service_rsyncd_disabled:def:1" href="ssg-fedora-oval.xml"/>
        </check>
        <check system="http://scap.nist.gov/schema/ocil/2">
          <check-content-ref name="ocil:ssg-service_rsyncd_disabled_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
        </check>
      </Rule>
      <Group id="xccdf_org.ssgproject.content_group_telnet">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Telnet</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The telnet protocol does not provide confidentiality or integrity
for information transmitted on the network. This includes authentication
information such as passwords. Organizations which use telnet should be
actively working to migrate to a more secure protocol.</description>
      </Group>
      <Group id="xccdf_org.ssgproject.content_group_tftp">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">TFTP Server</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">TFTP is a lightweight version of the FTP protocol which has
traditionally been used to configure networking equipment. However,
TFTP provides little security, and modern versions of networking
operating systems frequently support configuration via SSH or other
more secure protocols. A TFTP server should be run only if no more
secure method of supporting existing equipment can be
found.</description>
        <Value id="xccdf_org.ssgproject.content_value_var_tftpd_secure_directory" type="string" interactive="true">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">TFTP server secure directory</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Specify the directory which is used by TFTP server as a root directory when running in secure mode.</description>
          <value>/var/lib/tftpboot</value>
        </Value>
      </Group>
      <Group id="xccdf_org.ssgproject.content_group_r_services">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Rlogin, Rsh, and Rexec</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The Berkeley r-commands are legacy services which
allow cleartext remote access and have an insecure trust
model.</description>
        <Rule id="xccdf_org.ssgproject.content_rule_no_rsh_trust_files" selected="false" role="full" severity="high">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Remove Rsh Trust Files</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The files <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/hosts.equiv</html:code> and <html:code xmlns:html="http://www.w3.org/1999/xhtml">~/.rhosts</html:code> (in
each user's home directory) list remote hosts and users that are trusted by the
local system when using the rshd daemon.
To remove these files, run the following command to delete them from any
location:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo rm /etc/hosts.equiv</html:pre>
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ rm ~/.rhosts</html:pre></description>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-001436</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(4)(i)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(1)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(3)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(1)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(2)(ii)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.11</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.12</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.3</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS01.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.06</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.11.2.6</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.5.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.6.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.2.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.2.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.6.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.6.2.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
          <reference href="https://www.cisecurity.org/controls/">11</reference>
          <reference href="https://www.cisecurity.org/controls/">12</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">8</reference>
          <reference href="https://www.cisecurity.org/controls/">9</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">This action is only meaningful if <html:code xmlns:html="http://www.w3.org/1999/xhtml">.rhosts</html:code> support is permitted
through PAM. Trust files are convenient, but when used in conjunction with
the R-services, they can allow unauthenticated access to a system.</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="no_rsh_trust_files" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- block:

    - name: Detect shosts.equiv Files on the System
      find:
        paths: /
        recurse: true
        patterns: shosts.equiv
      check_mode: false
      register: shosts_equiv_locations

    - name: Remove Rsh Trust Files
      file:
        path: '{{ item.path }}'
        state: absent
      with_items: '{{ shosts_equiv_locations.files }}'
      when: shosts_equiv_locations
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - high_severity
    - low_complexity
    - low_disruption
    - no_reboot_needed
    - no_rsh_trust_files
    - restrict_strategy
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-no_rsh_trust_files:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-no_rsh_trust_files_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
      </Group>
      <Group id="xccdf_org.ssgproject.content_group_inetd_and_xinetd">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Xinetd</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">xinetd</html:code> service acts as a dedicated listener for some
network services (mostly, obsolete ones) and can be used to provide access
controls and perform some logging. It has been largely obsoleted by other
features, and it is not installed by default. The older Inetd service
is not even available as part of Fedora.</description>
        <platform idref="cpe:/a:machine"/>
      </Group>
      <Group id="xccdf_org.ssgproject.content_group_talk">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Chat/Messaging Services</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The talk software makes it possible for users to send and receive messages
across systems through a terminal session.</description>
      </Group>
      <Group id="xccdf_org.ssgproject.content_group_nis">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">NIS</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The Network Information Service (NIS), also known as 'Yellow
Pages' (YP), and its successor NIS+ have been made obsolete by
Kerberos, LDAP, and other modern centralized authentication
services. NIS should not be used because it suffers from security
problems inherent in its design, such as inadequate protection of
important authentication information.</description>
      </Group>
    </Group>
    <Group id="xccdf_org.ssgproject.content_group_dns">
      <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">DNS Server</title>
      <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Most organizations have an operational need to run at
least one nameserver. However, there are many common attacks
involving DNS server software, and this server software should
be disabled on any system
on which it is not needed.</description>
      <Group id="xccdf_org.ssgproject.content_group_dns_server_protection">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Protect DNS Data from Tampering or Attack</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">This section discusses DNS configuration options which make it
more difficult for attackers to gain access to private DNS data or to modify
DNS data.</description>
        <Group id="xccdf_org.ssgproject.content_group_dns_server_separate_internal_external">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Run Separate DNS Servers for External and Internal Queries</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Is it possible to run external and internal nameservers on
separate systems? If so, follow the configuration guidance in this section. On
the external nameserver, edit <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/named.conf</html:code> to add or correct the
following directives:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">options {
  allow-query { any; };
  recursion no;
  ...
};
zone "example.com " IN {
  ...
};</html:pre>
On the internal nameserver, edit <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/named.conf</html:code>. Add or correct the
following directives, where SUBNET is the numerical IP representation of your
organization in the form xxx.xxx.xxx.xxx/xx:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">acl internal {
  SUBNET ;
  localhost;
};
options {
  allow-query { internal; };
  ...
};
zone "internal.example.com " IN {
  ...
};</html:pre></description>
        </Group>
        <Group id="xccdf_org.ssgproject.content_group_dns_server_partition_with_views">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Use Views to Partition External and Internal Information</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">If it is not possible to run external and internal nameservers on
separate physical systems, run BIND9 and simulate this feature using views.
Edit <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/named.conf</html:code>. Add or correct the following directives (where
SUBNET is the numerical IP representation of your organization in the form
xxx.xxx.xxx.xxx/xx):
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">acl internal {
  SUBNET ;
  localhost;
};
view "internal-view" {
  match-clients { internal; };
  zone "." IN {
    type hint;
    file "db.cache";
  };
  zone "internal.example.com " IN {
    ...
  };
};

view "external-view" {
  match-clients { any; };
  recursion no;
  zone "example.com " IN {
    ...
  };
};</html:pre></description>
          <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">As shown in the example, database files which are
required for recursion, such as the root hints file, must be available to any
clients which are allowed to make recursive queries. Under typical
circumstances, this includes only the internal clients which are allowed to use
this server as a general-purpose nameserver.</warning>
        </Group>
      </Group>
      <Group id="xccdf_org.ssgproject.content_group_disabling_dns_server">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable DNS Server</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">DNS software should be disabled on any systems which does not
need to be a nameserver. Note that the BIND DNS server software is
not installed on Fedora by default. The remainder of this section
discusses secure configuration of systems which must be
nameservers.</description>
        <Rule id="xccdf_org.ssgproject.content_rule_package_bind_removed" selected="false" role="full" severity="low">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Uninstall bind Package</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">named</html:code> service is provided by the <html:code xmlns:html="http://www.w3.org/1999/xhtml">bind</html:code> package.
The <html:code xmlns:html="http://www.w3.org/1999/xhtml">bind</html:code> package can be removed with the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">
$ sudo dnf erase bind</html:pre></description>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.11</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.12</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.3</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.06</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.5.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.6.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.2.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.2.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
          <reference href="https://www.cisecurity.org/controls/">11</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">9</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">If there is no need to make DNS server software available,
removing it provides a safeguard against its activation.</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_bind_removed" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="disable">
# CAUTION: This remediation script will remove bind
#	   from the system, and may remove any packages
#	   that depend on bind. Execute this
#	   remediation AFTER testing on a non-production
#	   system!

if rpm -q --quiet "bind" ; then
    dnf remove -y "bind"
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_bind_removed" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="disable">- name: Ensure bind is removed
  package:
    name: bind
    state: absent
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - disable_strategy
    - low_complexity
    - low_disruption
    - low_severity
    - no_reboot_needed
    - package_bind_removed
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_bind_removed" system="urn:xccdf:fix:script:puppet" complexity="low" disruption="low" strategy="disable">include remove_bind

class remove_bind {
  package { 'bind':
    ensure =&gt; 'purged',
  }
}
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_bind_removed" system="urn:redhat:anaconda:pre" complexity="low" disruption="low" strategy="disable">
package --remove=bind
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-package_bind_removed:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-package_bind_removed_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
      </Group>
      <Group id="xccdf_org.ssgproject.content_group_dns_server_isolation">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Isolate DNS from Other Services</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">This section discusses mechanisms for preventing the DNS server
from interfering with other services. This is done both to protect the
remainder of the network should a nameserver be compromised, and to make direct
attacks on nameservers more difficult.</description>
        <Group id="xccdf_org.ssgproject.content_group_dns_server_dedicated">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Run DNS Software on Dedicated Servers</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Since DNS is
a high-risk service which must frequently be made available to the entire
Internet, it is strongly recommended that no other services be offered by
systems which act as organizational DNS servers.</description>
        </Group>
        <Group id="xccdf_org.ssgproject.content_group_dns_server_chroot">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Run DNS Software in a chroot Jail</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Install the <html:code xmlns:html="http://www.w3.org/1999/xhtml">bind-chroot</html:code> package:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo yum install bind-chroot</html:pre>
Place a valid named.conf file inside the chroot jail:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo cp /etc/named.conf /var/named/chroot/etc/named.conf
$ sudo chown root:root /var/named/chroot/etc/named.conf
$ sudo chmod 644 /var/named/chroot/etc/named.conf</html:pre>
Create and populate an appropriate zone directory within the jail, based on the
options directive. If your <html:code xmlns:html="http://www.w3.org/1999/xhtml">named.conf</html:code> includes:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">options {
directory "/path/to/DIRNAME ";
...
}</html:pre>
then copy that directory and its contents from the original zone directory:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo cp -r /path/to/DIRNAME /var/named/chroot/DIRNAME</html:pre>
Add or correct the following line within <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/sysconfig/named</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">ROOTDIR=/var/named/chroot</html:pre></description>
          <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">If you are running BIND in a chroot jail, then you
should use the jailed <html:code xmlns:html="http://www.w3.org/1999/xhtml">named.conf</html:code> as the primary nameserver
configuration file. That is, when this guide recommends editing
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/named.conf</html:code>, you should instead edit
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/var/named/chroot/etc/named.conf</html:code>.</warning>
        </Group>
      </Group>
    </Group>
    <Group id="xccdf_org.ssgproject.content_group_rng">
      <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Hardware RNG Entropy Gatherer Daemon</title>
      <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The rngd feeds random data from hardware device to kernel random device.</description>
      <platform idref="cpe:/a:machine"/>
      <Rule id="xccdf_org.ssgproject.content_rule_service_rngd_enabled" selected="false" role="full" severity="medium">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Enable the Hardware RNG Entropy Gatherer Service</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The Hardware RNG Entropy Gatherer service should be enabled.

The <html:code xmlns:html="http://www.w3.org/1999/xhtml">rngd</html:code> service can be enabled with the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo systemctl enable rngd.service</html:pre></description>
        <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FCS_RBG_EXT.1</reference>
        <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
        <reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</reference>
        <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">rngd</html:code> service
feeds random data from hardware device to kernel random device.</rationale>
        <platform idref="cpe:/a:machine"/>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="service_rngd_enabled" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="enable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

SYSTEMCTL_EXEC='/usr/bin/systemctl'
"$SYSTEMCTL_EXEC" unmask 'rngd.service'
"$SYSTEMCTL_EXEC" start 'rngd.service'
"$SYSTEMCTL_EXEC" enable 'rngd.service'

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="service_rngd_enabled" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="enable">- name: Enable service rngd
  block:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: Enable service rngd
      service:
        name: rngd
        enabled: 'yes'
        state: started
        masked: 'no'
      when:
        - '"rng-tools" in ansible_facts.packages'
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - enable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - service_rngd_enabled
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="service_rngd_enabled" system="urn:xccdf:fix:script:puppet" complexity="low" disruption="low" strategy="enable">include enable_rngd

class enable_rngd {
  service {'rngd':
    enable =&gt; true,
    ensure =&gt; 'running',
  }
}
</fix>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref name="oval:ssg-service_rngd_enabled:def:1" href="ssg-fedora-oval.xml"/>
        </check>
        <check system="http://scap.nist.gov/schema/ocil/2">
          <check-content-ref name="ocil:ssg-service_rngd_enabled_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
        </check>
      </Rule>
    </Group>
    <Group id="xccdf_org.ssgproject.content_group_sssd">
      <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">System Security Services Daemon</title>
      <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The System Security Services Daemon (SSSD) is a system daemon that provides access
to different identity and authentication providers such as Red Hat's IdM, Microsoft's AD,
openLDAP, MIT Kerberos, etc. It uses a common framework that can provide caching and offline
support to systems utilizing SSSD. SSSD using caching to reduce load on authentication
servers permit offline authentication as well as store extended user data.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
For more information, see</description>
      <platform idref="cpe:/a:sssd"/>
      <Value id="xccdf_org.ssgproject.content_value_var_sssd_memcache_timeout" type="number">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">SSSD memcache_timeout option</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Value of the memcache_timeout option in the [nss] section
of SSSD config /etc/sssd/sssd.conf.</description>
        <value selector="3_minutes">180</value>
        <value selector="5_minutes">300</value>
        <value selector="10_minutes">600</value>
        <value selector="15_minutes">900</value>
        <value selector="30_minutes">1800</value>
        <value selector="1_day">86400</value>
        <value>300</value>
      </Value>
      <Value id="xccdf_org.ssgproject.content_value_var_sssd_ssh_known_hosts_timeout" type="number">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">SSSD ssh_known_hosts_timeout option</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Value of the ssh_known_hosts_timeout option in the [ssh] section
of SSSD configuration file /etc/sssd/sssd.conf.</description>
        <value selector="3_minutes">180</value>
        <value selector="5_minutes">300</value>
        <value selector="10_minutes">600</value>
        <value selector="15_minutes">900</value>
        <value selector="30_minutes">1800</value>
        <value selector="1_day">86400</value>
        <value>180</value>
      </Value>
      <Rule id="xccdf_org.ssgproject.content_rule_package_sssd-ipa_installed" selected="false" role="full" severity="medium">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Install sssd-ipa Package</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">sssd-ipa</html:code> package can be installed with the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">
$ sudo dnf install sssd-ipa</html:pre></description>
        <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
        <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US"><html:code xmlns:html="http://www.w3.org/1999/xhtml">sssd-ipa</html:code> provides the IPA back end that the SSSD can utilize to
fetch identity data from and authenticate against an IPA server.</rationale>
        <platform idref="cpe:/a:sssd"/>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_sssd-ipa_installed" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="enable"># Remediation is applicable only in certain platforms
if rpm --quiet -q sssd-common; then

if ! rpm -q --quiet "sssd-ipa" ; then
    dnf install -y "sssd-ipa"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_sssd-ipa_installed" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="enable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - enable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - package_sssd-ipa_installed

- name: Ensure sssd-ipa is installed
  package:
    name: sssd-ipa
    state: present
  when: '"sssd-common" in ansible_facts.packages'
  tags:
    - enable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - package_sssd-ipa_installed
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_sssd-ipa_installed" system="urn:xccdf:fix:script:puppet" complexity="low" disruption="low" strategy="enable">include install_sssd-ipa

class install_sssd-ipa {
  package { 'sssd-ipa':
    ensure =&gt; 'installed',
  }
}
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_sssd-ipa_installed" system="urn:redhat:anaconda:pre" complexity="low" disruption="low" strategy="enable">
package --add=sssd-ipa
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_sssd-ipa_installed" system="urn:redhat:osbuild:blueprint">
[[packages]]
name = "sssd-ipa"
version = "*"
</fix>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref name="oval:ssg-package_sssd-ipa_installed:def:1" href="ssg-fedora-oval.xml"/>
        </check>
        <check system="http://scap.nist.gov/schema/ocil/2">
          <check-content-ref name="ocil:ssg-package_sssd-ipa_installed_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
        </check>
      </Rule>
      <Rule id="xccdf_org.ssgproject.content_rule_sssd_memcache_timeout" selected="false" role="full" severity="medium">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Configure SSSD's Memory Cache to Expire</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">SSSD's memory cache should be configured to set to expire records after
<html:code xmlns:html="http://www.w3.org/1999/xhtml" xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2"><xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_sssd_memcache_timeout" use="legacy"/></html:code> seconds.
To configure SSSD to expire memory cache, set <html:code xmlns:html="http://www.w3.org/1999/xhtml">memcache_timeout</html:code> to
<html:code xmlns:html="http://www.w3.org/1999/xhtml" xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2"><xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_sssd_memcache_timeout" use="legacy"/></html:code> under the
<html:code xmlns:html="http://www.w3.org/1999/xhtml">[nss]</html:code> section in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/sssd/sssd.conf</html:code>.

For example:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml" xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2">[nss]
memcache_timeout = <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_sssd_memcache_timeout" use="legacy"/>
</html:pre></description>
        <reference href="https://public.cyber.mil/stigs/cci/">CCI-002007</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(13)</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</reference>
        <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000383-GPOS-00166</reference>
        <reference href="">SRG-OS-000383-VMM-001570</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.2.2</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.10</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS06.03</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS06.10</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.18.1.4</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.7.1.1</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.9.2.1</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.9.2.2</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.9.2.3</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.9.2.4</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.9.2.6</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.9.3.1</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.9.4.2</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.9.4.3</reference>
        <reference href="https://www.cisecurity.org/controls/">1</reference>
        <reference href="https://www.cisecurity.org/controls/">12</reference>
        <reference href="https://www.cisecurity.org/controls/">15</reference>
        <reference href="https://www.cisecurity.org/controls/">16</reference>
        <reference href="https://www.cisecurity.org/controls/">5</reference>
        <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">If cached authentication information is out-of-date, the validity of the
authentication information may be questionable.</rationale>
        <platform idref="cpe:/a:machine"/>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sssd_memcache_timeout" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q sssd-common &amp;&amp; { [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; }; then


var_sssd_memcache_timeout="<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_sssd_memcache_timeout" use="legacy"/>"



SSSD_CONF="/etc/sssd/sssd.conf"
MEMCACHE_TIMEOUT_REGEX="[[:space:]]*\[nss]([^\n\[]*\n+)+?[[:space:]]*memcache_timeout"
NSS_REGEX="[[:space:]]*\[nss]"

# Try find [nss] and memcache_timeout in sssd.conf, if it exists, set to
# var_sssd_memcache_timeout, if it isn't here, add it, if [nss] doesn't
# exist, add it there
if grep -qzosP $MEMCACHE_TIMEOUT_REGEX $SSSD_CONF; then
        sed -i "s/memcache_timeout[^(\n)]*/memcache_timeout = $var_sssd_memcache_timeout/" $SSSD_CONF
elif grep -qs $NSS_REGEX $SSSD_CONF; then
        sed -i "/$NSS_REGEX/a memcache_timeout = $var_sssd_memcache_timeout" $SSSD_CONF
else
        mkdir -p /etc/sssd
        touch $SSSD_CONF
        echo -e "[nss]\nmemcache_timeout = $var_sssd_memcache_timeout" &gt;&gt; $SSSD_CONF
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sssd_memcache_timeout" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="medium">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(13)
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - sssd_memcache_timeout
    - unknown_strategy
- name: XCCDF Value var_sssd_memcache_timeout # promote to variable
  set_fact:
    var_sssd_memcache_timeout: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_sssd_memcache_timeout" use="legacy"/>
  tags:
    - always

- name: Test for domain group
  command: grep '\s*\[domain\/[^]]*]' /etc/sssd/sssd.conf
  register: test_grep_domain
  ignore_errors: true
  changed_when: false
  check_mode: false
  when:
    - '"sssd-common" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(13)
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - sssd_memcache_timeout
    - unknown_strategy

- name: Add default domain group (if no domain there)
  ini_file:
    path: /etc/sssd/sssd.conf
    section: '{{ item.section }}'
    option: '{{ item.option }}'
    value: '{{ item.value }}'
    create: true
    mode: 384
  with_items:
    - section: sssd
      option: domains
      value: default
    - section: domain/default
      option: id_provider
      value: files
  when:
    - '"sssd-common" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - test_grep_domain.stdout is defined
    - test_grep_domain.stdout | length &lt; 1
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(13)
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - sssd_memcache_timeout
    - unknown_strategy

- name: Configure SSSD's Memory Cache to Expire
  ini_file:
    dest: /etc/sssd/sssd.conf
    section: nss
    option: memcache_timeout
    value: '{{ var_sssd_memcache_timeout }}'
    create: true
    mode: 384
  when:
    - '"sssd-common" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(13)
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - sssd_memcache_timeout
    - unknown_strategy
</fix>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-export export-name="oval:ssg-var_sssd_memcache_timeout:var:1" value-id="xccdf_org.ssgproject.content_value_var_sssd_memcache_timeout"/>
          <check-content-ref name="oval:ssg-sssd_memcache_timeout:def:1" href="ssg-fedora-oval.xml"/>
        </check>
        <check system="http://scap.nist.gov/schema/ocil/2">
          <check-content-ref name="ocil:ssg-sssd_memcache_timeout_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
        </check>
      </Rule>
      <Rule id="xccdf_org.ssgproject.content_rule_sssd_ssh_known_hosts_timeout" selected="false" role="full" severity="medium">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Configure SSSD to Expire SSH Known Hosts</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">SSSD should be configured to expire keys from known SSH hosts after
<html:code xmlns:html="http://www.w3.org/1999/xhtml" xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2"><xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_sssd_ssh_known_hosts_timeout" use="legacy"/></html:code> seconds.
To configure SSSD to known SSH hosts, set <html:code xmlns:html="http://www.w3.org/1999/xhtml">ssh_known_hosts_timeout</html:code>
to <html:code xmlns:html="http://www.w3.org/1999/xhtml" xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2"><xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_sssd_ssh_known_hosts_timeout" use="legacy"/></html:code> under the
<html:code xmlns:html="http://www.w3.org/1999/xhtml">[ssh]</html:code> section in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/sssd/sssd.conf</html:code>. For example:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml" xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2">[ssh]
ssh_known_hosts_timeout = <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_sssd_ssh_known_hosts_timeout" use="legacy"/>
</html:pre></description>
        <reference href="https://public.cyber.mil/stigs/cci/">CCI-002007</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(13)</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</reference>
        <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000383-GPOS-00166</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.2.2</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.10</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS06.03</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS06.10</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.18.1.4</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.7.1.1</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.9.2.1</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.9.2.2</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.9.2.3</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.9.2.4</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.9.2.6</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.9.3.1</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.9.4.2</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.9.4.3</reference>
        <reference href="https://www.cisecurity.org/controls/">1</reference>
        <reference href="https://www.cisecurity.org/controls/">12</reference>
        <reference href="https://www.cisecurity.org/controls/">15</reference>
        <reference href="https://www.cisecurity.org/controls/">16</reference>
        <reference href="https://www.cisecurity.org/controls/">5</reference>
        <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">If cached authentication information is out-of-date, the validity of the
authentication information may be questionable.</rationale>
        <platform idref="cpe:/a:machine"/>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sssd_ssh_known_hosts_timeout" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q sssd-common &amp;&amp; { [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; }; then


var_sssd_ssh_known_hosts_timeout="<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_sssd_ssh_known_hosts_timeout" use="legacy"/>"



SSSD_CONF="/etc/sssd/sssd.conf"
SSH_KNOWN_HOSTS_TIMEOUT_REGEX="[[:space:]]*\[ssh]([^\n\[]*\n+)+?[[:space:]]*ssh_known_hosts_timeout"
SSH_REGEX="[[:space:]]*\[ssh]"

# Try find [ssh] and ssh_known_hosts_timeout in sssd.conf, if it exists, set to
# var_sssd_ssh_known_hosts_timeout, if it isn't here, add it, if [ssh] doesn't
# exist, add it there
if grep -qzosP $SSH_KNOWN_HOSTS_TIMEOUT_REGEX $SSSD_CONF; then
        sed -i "s/ssh_known_hosts_timeout[^(\n)]*/ssh_known_hosts_timeout = $var_sssd_ssh_known_hosts_timeout/" $SSSD_CONF
elif grep -qs $SSH_REGEX $SSSD_CONF; then
        sed -i "/$SSH_REGEX/a ssh_known_hosts_timeout = $var_sssd_ssh_known_hosts_timeout" $SSSD_CONF
else
        mkdir -p /etc/sssd
        touch $SSSD_CONF
        echo -e "[ssh]\nssh_known_hosts_timeout = $var_sssd_ssh_known_hosts_timeout" &gt;&gt; $SSSD_CONF
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sssd_ssh_known_hosts_timeout" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="medium">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(13)
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - sssd_ssh_known_hosts_timeout
    - unknown_strategy
- name: XCCDF Value var_sssd_ssh_known_hosts_timeout # promote to variable
  set_fact:
    var_sssd_ssh_known_hosts_timeout: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_sssd_ssh_known_hosts_timeout" use="legacy"/>
  tags:
    - always

- name: Test for domain group
  command: grep '\s*\[domain\/[^]]*]' /etc/sssd/sssd.conf
  register: test_grep_domain
  ignore_errors: true
  changed_when: false
  check_mode: false
  when:
    - '"sssd-common" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(13)
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - sssd_ssh_known_hosts_timeout
    - unknown_strategy

- name: Add default domain group (if no domain there)
  ini_file:
    path: /etc/sssd/sssd.conf
    section: '{{ item.section }}'
    option: '{{ item.option }}'
    value: '{{ item.value }}'
    create: true
    mode: 384
  with_items:
    - section: sssd
      option: domains
      value: default
    - section: domain/default
      option: id_provider
      value: files
  when:
    - '"sssd-common" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - test_grep_domain.stdout is defined
    - test_grep_domain.stdout | length &lt; 1
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(13)
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - sssd_ssh_known_hosts_timeout
    - unknown_strategy

- name: Configure SSSD to Expire SSH Known Hosts
  ini_file:
    dest: /etc/sssd/sssd.conf
    section: ssh
    option: ssh_known_hosts_timeout
    value: '{{ var_sssd_ssh_known_hosts_timeout }}'
    create: true
    mode: 384
  when:
    - '"sssd-common" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(13)
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - sssd_ssh_known_hosts_timeout
    - unknown_strategy
</fix>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-export export-name="oval:ssg-var_sssd_ssh_known_hosts_timeout:var:1" value-id="xccdf_org.ssgproject.content_value_var_sssd_ssh_known_hosts_timeout"/>
          <check-content-ref name="oval:ssg-sssd_ssh_known_hosts_timeout:def:1" href="ssg-fedora-oval.xml"/>
        </check>
        <check system="http://scap.nist.gov/schema/ocil/2">
          <check-content-ref name="ocil:ssg-sssd_ssh_known_hosts_timeout_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
        </check>
      </Rule>
      <Rule id="xccdf_org.ssgproject.content_rule_sssd_run_as_sssd_user" selected="false" role="full" severity="medium">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Configure SSSD to run as user sssd</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">SSSD processes should be configured to run as user sssd, not root.</description>
        <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_SMF_EXT.1</reference>
        <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
        <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To minimize privileges of SSSD processes, they are configured to
run as non-root user.</rationale>
        <platform idref="cpe:/a:sssd"/>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sssd_run_as_sssd_user" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q sssd-common; then

found=false
for f in $( ls /etc/sssd/sssd.conf /etc/sssd/conf.d/*.conf 2&gt; /dev/null ) ; do
	user=$( awk '/^\s*\[/{f=0} /^\s*\[sssd\]/{f=1} f{nu=gensub("^\\s*user\\s*=\\s*(\\S+).*","\\1",1); if($0!=nu){user=nu}} END{print user}' $f )
	if [ -n "$user" ] ; then
		if [ "$user" != sssd ] ; then
			sed -i 's/^\s*user\s*=.*/user = sssd/' $f
		fi
		found=true
	fi
done

if ! $found ; then
	SSSD_CONF="/etc/sssd/conf.d/ospp.conf"
	mkdir -p $( dirname $SSSD_CONF )
	touch $SSSD_CONF
	chown root:root $SSSD_CONF
	chmod 600 $SSSD_CONF
	echo -e "[sssd]\nuser = sssd" &gt;&gt; $SSSD_CONF
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref name="oval:ssg-sssd_run_as_sssd_user:def:1" href="ssg-fedora-oval.xml"/>
        </check>
        <check system="http://scap.nist.gov/schema/ocil/2">
          <check-content-ref name="ocil:ssg-sssd_run_as_sssd_user_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
        </check>
      </Rule>
      <Rule id="xccdf_org.ssgproject.content_rule_sssd_enable_smartcards" selected="false" role="full" severity="medium">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Enable Smartcards in SSSD</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">SSSD should be configured to authenticate access to the system
using smart cards. To enable smart cards in SSSD, set <html:code xmlns:html="http://www.w3.org/1999/xhtml">pam_cert_auth</html:code>
to <html:code xmlns:html="http://www.w3.org/1999/xhtml">true</html:code> under the <html:code xmlns:html="http://www.w3.org/1999/xhtml">[pam]</html:code>
section in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/sssd/sssd.conf</html:code>. For example:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">[pam]
pam_cert_auth = true
</html:pre></description>
        <reference href="https://public.cyber.mil/stigs/cci/">CCI-001954</reference>
        <reference href="https://public.cyber.mil/stigs/cci/">CCI-000765</reference>
        <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000375-GPOS-00160</reference>
        <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000105-GPOS-00052</reference>
        <reference href="">SRG-OS-000107-VMM-000530</reference>
        <reference href="">0421</reference>
        <reference href="">0422</reference>
        <reference href="">0431</reference>
        <reference href="">0974</reference>
        <reference href="">1173</reference>
        <reference href="">1401</reference>
        <reference href="">1504</reference>
        <reference href="">1505</reference>
        <reference href="">1546</reference>
        <reference href="">1557</reference>
        <reference href="">1558</reference>
        <reference href="">1559</reference>
        <reference href="">1560</reference>
        <reference href="">1561</reference>
        <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Using an authentication device, such as a CAC or token that is separate from
the information system, ensures that even if the information system is
compromised, that compromise will not affect credentials stored on the
authentication device.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Multifactor solutions that require devices separate from
information systems gaining access include, for example, hardware tokens
providing time-based or challenge-response authenticators and smart cards such
as the U.S. Government Personal Identity Verification card and the DoD Common
Access Card.</rationale>
        <platform idref="cpe:/a:machine"/>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sssd_enable_smartcards" system="urn:xccdf:fix:script:sh" complexity="low" disruption="medium" strategy="configure"># Remediation is applicable only in certain platforms
if rpm --quiet -q sssd-common &amp;&amp; { [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; }; then

SSSD_CONF="/etc/sssd/sssd.conf"
SSSD_OPT="pam_cert_auth"
SSSD_OPT_VAL=true
PAM_REGEX="[[:space:]]*\[pam]"
PAM_OPT_REGEX="${PAM_REGEX}([^\n\[]*\n+)+?[[:space:]]*${SSSD_OPT}"

if grep -qzosP $PAM_OPT_REGEX $SSSD_CONF; then
	sed -i "s/${SSSD_OPT}[^(\n)]*/${SSSD_OPT} = ${SSSD_OPT_VAL}/" $SSSD_CONF
elif grep -qs $PAM_REGEX $SSSD_CONF; then
	sed -i "/$PAM_REGEX/a ${SSSD_OPT} = ${SSSD_OPT_VAL}" $SSSD_CONF
else
	mkdir -p /etc/sssd
	touch $SSSD_CONF
	echo -e "[pam]\n${SSSD_OPT} = ${SSSD_OPT_VAL}" &gt;&gt; $SSSD_CONF
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sssd_enable_smartcards" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="medium" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - configure_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - sssd_enable_smartcards

- name: Test for domain group
  command: grep '\s*\[domain\/[^]]*]' /etc/sssd/sssd.conf
  register: test_grep_domain
  ignore_errors: true
  changed_when: false
  check_mode: false
  when:
    - '"sssd-common" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - configure_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - sssd_enable_smartcards

- name: Add default domain group (if no domain there)
  ini_file:
    path: /etc/sssd/sssd.conf
    section: '{{ item.section }}'
    option: '{{ item.option }}'
    value: '{{ item.value }}'
    create: true
    mode: 384
  with_items:
    - section: sssd
      option: domains
      value: default
    - section: domain/default
      option: id_provider
      value: files
  when:
    - '"sssd-common" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - test_grep_domain.stdout is defined
    - test_grep_domain.stdout | length &lt; 1
  tags:
    - configure_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - sssd_enable_smartcards

- name: Enable Smartcards in SSSD
  ini_file:
    dest: /etc/sssd/sssd.conf
    section: pam
    option: pam_cert_auth
    value: 'true'
    create: true
    mode: 384
  when:
    - '"sssd-common" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - configure_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - sssd_enable_smartcards
</fix>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref name="oval:ssg-sssd_enable_smartcards:def:1" href="ssg-fedora-oval.xml"/>
        </check>
        <check system="http://scap.nist.gov/schema/ocil/2">
          <check-content-ref name="ocil:ssg-sssd_enable_smartcards_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
        </check>
      </Rule>
      <Rule id="xccdf_org.ssgproject.content_rule_sssd_offline_cred_expiration" selected="false" role="full" severity="medium">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Configure SSSD to Expire Offline Credentials</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">SSSD should be configured to expire offline credentials after 1 day.
To configure SSSD to expire offline credentials, set
<html:code xmlns:html="http://www.w3.org/1999/xhtml">offline_credentials_expiration</html:code> to <html:code xmlns:html="http://www.w3.org/1999/xhtml">1</html:code> under the <html:code xmlns:html="http://www.w3.org/1999/xhtml">[pam]</html:code>
section in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/sssd/sssd.conf</html:code>. For example:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">[pam]
offline_credentials_expiration = 1
</html:pre></description>
        <reference href="https://public.cyber.mil/stigs/cci/">CCI-002007</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(13)</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</reference>
        <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000383-GPOS-00166</reference>
        <reference href="">SRG-OS-000383-VMM-001570</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.2.2</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.10</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS06.03</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS06.10</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.18.1.4</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.7.1.1</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.9.2.1</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.9.2.2</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.9.2.3</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.9.2.4</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.9.2.6</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.9.3.1</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.9.4.2</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.9.4.3</reference>
        <reference href="https://www.cisecurity.org/controls/">1</reference>
        <reference href="https://www.cisecurity.org/controls/">12</reference>
        <reference href="https://www.cisecurity.org/controls/">15</reference>
        <reference href="https://www.cisecurity.org/controls/">16</reference>
        <reference href="https://www.cisecurity.org/controls/">5</reference>
        <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">If cached authentication information is out-of-date, the validity of the
authentication information may be questionable.</rationale>
        <platform idref="cpe:/a:machine"/>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sssd_offline_cred_expiration" system="urn:xccdf:fix:script:sh" complexity="low" disruption="medium" strategy="configure"># Remediation is applicable only in certain platforms
if rpm --quiet -q sssd-common &amp;&amp; { [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; }; then

SSSD_CONF="/etc/sssd/sssd.conf"
SSSD_OPT="offline_credentials_expiration"
SSSD_OPT_VAL=1
PAM_REGEX="[[:space:]]*\[pam]"
PAM_OPT_REGEX="${PAM_REGEX}([^\n\[]*\n+)+?[[:space:]]*${SSSD_OPT}"

# Try find [pam] and offline_credentials_expiration in sssd.conf, if it exists
# set it to 1, if it doesn't exist add it, if [pam] section doesn't exist add
# the section and the configuration option.
if grep -qzosP $PAM_OPT_REGEX $SSSD_CONF; then
	sed -i "s/${SSSD_OPT}[^(\n)]*/${SSSD_OPT} = ${SSSD_OPT_VAL}/" $SSSD_CONF
elif grep -qs $PAM_REGEX $SSSD_CONF; then
	sed -i "/$PAM_REGEX/a ${SSSD_OPT} = ${SSSD_OPT_VAL}" $SSSD_CONF
else
	mkdir -p /etc/sssd
	touch $SSSD_CONF
	echo -e "[pam]\n${SSSD_OPT} = ${SSSD_OPT_VAL}" &gt;&gt; $SSSD_CONF
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sssd_offline_cred_expiration" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="medium" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(13)
    - configure_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - sssd_offline_cred_expiration

- name: Test for domain group
  command: grep '\s*\[domain\/[^]]*]' /etc/sssd/sssd.conf
  register: test_grep_domain
  ignore_errors: true
  changed_when: false
  check_mode: false
  when:
    - '"sssd-common" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(13)
    - configure_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - sssd_offline_cred_expiration

- name: Add default domain group (if no domain there)
  ini_file:
    path: /etc/sssd/sssd.conf
    section: '{{ item.section }}'
    option: '{{ item.option }}'
    value: '{{ item.value }}'
    create: true
    mode: 384
  with_items:
    - section: sssd
      option: domains
      value: default
    - section: domain/default
      option: id_provider
      value: files
  when:
    - '"sssd-common" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - test_grep_domain.stdout is defined
    - test_grep_domain.stdout | length &lt; 1
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(13)
    - configure_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - sssd_offline_cred_expiration

- name: Configure SSD to Expire Offline Credentials
  ini_file:
    dest: /etc/sssd/sssd.conf
    section: pam
    option: offline_credentials_expiration
    value: 1
    create: true
    mode: 384
  when:
    - '"sssd-common" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(13)
    - configure_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - sssd_offline_cred_expiration
</fix>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref name="oval:ssg-sssd_offline_cred_expiration:def:1" href="ssg-fedora-oval.xml"/>
        </check>
        <check system="http://scap.nist.gov/schema/ocil/2">
          <check-content-ref name="ocil:ssg-sssd_offline_cred_expiration_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
        </check>
      </Rule>
      <Group id="xccdf_org.ssgproject.content_group_sssd-ldap">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">System Security Services Daemon (SSSD) - LDAP</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The System Security Services Daemon (SSSD) is a system daemon that provides access
to different identity and authentication providers such as Red Hat's IdM, Microsoft's AD,
openLDAP, MIT Kerberos, etc. It uses a common framework that can provide caching and offline
support to systems utilizing SSSD. SSSD using caching to reduce load on authentication
servers permit offline authentication as well as store extended user data.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
SSSD can support many backends including LDAP. The <html:code xmlns:html="http://www.w3.org/1999/xhtml">sssd-ldap</html:code> backend
allows SSSD to fetch identity information from an LDAP server.</description>
        <platform idref="cpe:/a:machine"/>
        <Value id="xccdf_org.ssgproject.content_value_var_sssd_ldap_tls_ca_dir" type="string">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">SSSD LDAP Backend Client CA Certificate Location</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Path of a directory that contains Certificate Authority certificates.</description>
          <value>/etc/openldap/cacerts</value>
        </Value>
      </Group>
    </Group>
    <Group id="xccdf_org.ssgproject.content_group_usbguard">
      <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">USBGuard daemon</title>
      <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The USBGuard daemon enforces the USB device authorization policy for all USB devices.</description>
      <platform idref="cpe:/a:not_s390x_arch"/>
      <Rule id="xccdf_org.ssgproject.content_rule_package_usbguard_installed" selected="false" role="full" severity="medium">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Install usbguard Package</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">
The <html:code xmlns:html="http://www.w3.org/1999/xhtml">usbguard</html:code> package can be installed with the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">
$ sudo dnf install usbguard</html:pre></description>
        <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000378-GPOS-00163</reference>
        <reference href="">1418</reference>
        <reference href="https://public.cyber.mil/stigs/cci/">CCI-001958</reference>
        <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US"><html:code xmlns:html="http://www.w3.org/1999/xhtml">usbguard</html:code> is a software framework that helps to protect
against rogue USB devices by implementing basic whitelisting/blacklisting
capabilities based on USB device attributes.</rationale>
        <platform idref="cpe:/a:not_s390x_arch"/>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_usbguard_installed" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="enable">
if ! rpm -q --quiet "usbguard" ; then
    dnf install -y "usbguard"
fi
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_usbguard_installed" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="enable">- name: Ensure usbguard is installed
  package:
    name: usbguard
    state: present
  tags:
    - enable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - package_usbguard_installed
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_usbguard_installed" system="urn:xccdf:fix:script:puppet" complexity="low" disruption="low" strategy="enable">include install_usbguard

class install_usbguard {
  package { 'usbguard':
    ensure =&gt; 'installed',
  }
}
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_usbguard_installed" system="urn:redhat:anaconda:pre" complexity="low" disruption="low" strategy="enable">
package --add=usbguard
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_usbguard_installed" system="urn:xccdf:fix:script:kubernetes">---
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
  extensions:
    - usbguard
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_usbguard_installed" system="urn:redhat:osbuild:blueprint">
[[packages]]
name = "usbguard"
version = "*"
</fix>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref name="oval:ssg-package_usbguard_installed:def:1" href="ssg-fedora-oval.xml"/>
        </check>
        <check system="http://scap.nist.gov/schema/ocil/2">
          <check-content-ref name="ocil:ssg-package_usbguard_installed_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
        </check>
      </Rule>
      <Rule id="xccdf_org.ssgproject.content_rule_service_usbguard_enabled" selected="false" role="full" severity="medium">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Enable the USBGuard Service</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The USBGuard service should be enabled.

The <html:code xmlns:html="http://www.w3.org/1999/xhtml">usbguard</html:code> service can be enabled with the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo systemctl enable usbguard.service</html:pre></description>
        <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_SMF_EXT.1</reference>
        <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000378-GPOS-00163</reference>
        <reference href="">1418</reference>
        <reference href="https://public.cyber.mil/stigs/cci/">CCI-000416</reference>
        <reference href="https://public.cyber.mil/stigs/cci/">CCI-001958</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-8(3)(a)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-3</reference>
        <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">usbguard</html:code> service must be running in order to
enforce the USB device authorization policy for all USB devices.</rationale>
        <platform idref="cpe:/a:machine"/>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="service_usbguard_enabled" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="enable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

SYSTEMCTL_EXEC='/usr/bin/systemctl'
"$SYSTEMCTL_EXEC" unmask 'usbguard.service'
"$SYSTEMCTL_EXEC" start 'usbguard.service'
"$SYSTEMCTL_EXEC" enable 'usbguard.service'

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="service_usbguard_enabled" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="enable">- name: Enable service usbguard
  block:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: Enable service usbguard
      service:
        name: usbguard
        enabled: 'yes'
        state: started
        masked: 'no'
      when:
        - '"usbguard" in ansible_facts.packages'
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-CM-8(3)(a)
    - NIST-800-53-IA-3
    - enable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - service_usbguard_enabled
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="service_usbguard_enabled" system="urn:xccdf:fix:script:puppet" complexity="low" disruption="low" strategy="enable">include enable_usbguard

class enable_usbguard {
  service {'usbguard':
    enable =&gt; true,
    ensure =&gt; 'running',
  }
}
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="service_usbguard_enabled" system="urn:xccdf:fix:script:kubernetes">---
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
metadata:
  annotations:
    complianceascode.io/depends-on: xccdf_org.ssgproject.content_rule_package_usbguard_installed
spec:
  config:
    ignition:
      version: 3.1.0
    systemd:
      units:
      - name: usbguard.service
        enabled: true
</fix>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref name="oval:ssg-service_usbguard_enabled:def:1" href="ssg-fedora-oval.xml"/>
        </check>
        <check system="http://scap.nist.gov/schema/ocil/2">
          <check-content-ref name="ocil:ssg-service_usbguard_enabled_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
        </check>
      </Rule>
      <Rule id="xccdf_org.ssgproject.content_rule_configure_usbguard_auditbackend" selected="false" role="full" severity="medium">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Log USBGuard daemon audit events using Linux Audit</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To configure USBGuard daemon to log via Linux Audit
(as opposed directly to a file),
<html:code xmlns:html="http://www.w3.org/1999/xhtml">AuditBackend</html:code> option in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/usbguard/usbguard-daemon.conf</html:code>
needs to be set to <html:code xmlns:html="http://www.w3.org/1999/xhtml">LinuxAudit</html:code>.</description>
        <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_SMF_EXT.1</reference>
        <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</reference>
        <reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</reference>
        <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Using the Linux Audit logging allows for centralized trace
of events.</rationale>
        <platform idref="cpe:/a:not_s390x_arch"/>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="configure_usbguard_auditbackend" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="restrict">if [ -e "/etc/usbguard/usbguard-daemon.conf" ] ; then
    LC_ALL=C sed -i "/^\s*AuditBackend=/d" "/etc/usbguard/usbguard-daemon.conf"
else
    touch "/etc/usbguard/usbguard-daemon.conf"
fi
cp "/etc/usbguard/usbguard-daemon.conf" "/etc/usbguard/usbguard-daemon.conf.bak"
# Insert at the end of the file
printf '%s\n' "AuditBackend=LinuxAudit" &gt;&gt; "/etc/usbguard/usbguard-daemon.conf"
# Clean up after ourselves.
rm "/etc/usbguard/usbguard-daemon.conf.bak"
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="configure_usbguard_auditbackend" system="urn:xccdf:fix:script:kubernetes">apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
metadata:
  annotations:
    complianceascode.io/depends-on: xccdf_org.ssgproject.content_rule_package_usbguard_installed
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,%0A%23%0A%23%20Rule%20set%20file%20path.%0A%23%0A%23%20The%20USBGuard%20daemon%20will%20use%20this%20file%20to%20load%20the%20policy%0A%23%20rule%20set%20from%20it%20and%20to%20write%20new%20rules%20received%20via%20the%0A%23%20IPC%20interface.%0A%23%0A%23%20RuleFile%3D/path/to/rules.conf%0A%23%0ARuleFile%3D/etc/usbguard/rules.conf%0A%0A%23%0A%23%20Rule%20set%20folder%20path.%0A%23%0A%23%20The%20USBGuard%20daemon%20will%20use%20this%20folder%20to%20load%20the%20policy%0A%23%20rule%20set%20from%20it%20and%20to%20write%20new%20rules%20received%20via%20the%0A%23%20IPC%20interface.%20Usually%2C%20we%20set%20the%20option%20to%0A%23%20/etc/usbguard/rules.d/.%20The%20USBGuard%20daemon%20is%20supposed%20to%0A%23%20behave%20like%20any%20other%20standard%20Linux%20daemon%20therefore%20it%0A%23%20loads%20rule%20files%20in%20alpha-numeric%20order.%20File%20names%20inside%0A%23%20RuleFolder%20directory%20should%20start%20with%20a%20two-digit%20number%0A%23%20prefix%20indicating%20the%20position%2C%20in%20which%20the%20rules%20are%0A%23%20scanned%20by%20the%20daemon.%0A%23%0A%23%20RuleFolder%3D/path/to/rulesfolder/%0A%23%0ARuleFolder%3D/etc/usbguard/rules.d/%0A%0A%23%0A%23%20Implicit%20policy%20target.%0A%23%0A%23%20How%20to%20treat%20devices%20that%20don%27t%20match%20any%20rule%20in%20the%0A%23%20policy.%20One%20of%3A%0A%23%0A%23%20%2A%20allow%20%20-%20authorize%20the%20device%0A%23%20%2A%20block%20%20-%20block%20the%20device%0A%23%20%2A%20reject%20-%20remove%20the%20device%0A%23%0AImplicitPolicyTarget%3Dblock%0A%0A%23%0A%23%20Present%20device%20policy.%0A%23%0A%23%20How%20to%20treat%20devices%20that%20are%20already%20connected%20when%20the%0A%23%20daemon%20starts.%20One%20of%3A%0A%23%0A%23%20%2A%20allow%20%20%20%20%20%20%20%20-%20authorize%20every%20present%20device%0A%23%20%2A%20block%20%20%20%20%20%20%20%20-%20deauthorize%20every%20present%20device%0A%23%20%2A%20reject%20%20%20%20%20%20%20-%20remove%20every%20present%20device%0A%23%20%2A%20keep%20%20%20%20%20%20%20%20%20-%20just%20sync%20the%20internal%20state%20and%20leave%20it%0A%23%20%2A%20apply-policy%20-%20evaluate%20the%20ruleset%20for%20every%20present%0A%23%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20device%0A%23%0APresentDevicePolicy%3Dapply-policy%0A%0A%23%0A%23%20Present%20controller%20policy.%0A%23%0A%23%20How%20to%20treat%20USB%20controllers%20that%20are%20already%20connected%0A%23%20when%20the%20daemon%20starts.%20One%20of%3A%0A%23%0A%23%20%2A%20allow%20%20%20%20%20%20%20%20-%20authorize%20every%20present%20device%0A%23%20%2A%20block%20%20%20%20%20%20%20%20-%20deauthorize%20every%20present%20device%0A%23%20%2A%20reject%20%20%20%20%20%20%20-%20remove%20every%20present%20device%0A%23%20%2A%20keep%20%20%20%20%20%20%20%20%20-%20just%20sync%20the%20internal%20state%20and%20leave%20it%0A%23%20%2A%20apply-policy%20-%20evaluate%20the%20ruleset%20for%20every%20present%0A%23%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20device%0A%23%0APresentControllerPolicy%3Dkeep%0A%0A%23%0A%23%20Inserted%20device%20policy.%0A%23%0A%23%20How%20to%20treat%20USB%20devices%20that%20are%20already%20connected%0A%23%20%2Aafter%2A%20the%20daemon%20starts.%20One%20of%3A%0A%23%0A%23%20%2A%20block%20%20%20%20%20%20%20%20-%20deauthorize%20every%20present%20device%0A%23%20%2A%20reject%20%20%20%20%20%20%20-%20remove%20every%20present%20device%0A%23%20%2A%20apply-policy%20-%20evaluate%20the%20ruleset%20for%20every%20present%0A%23%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20device%0A%23%0AInsertedDevicePolicy%3Dapply-policy%0A%0A%23%0A%23%20Control%20which%20devices%20are%20authorized%20by%20default.%0A%23%0A%23%20The%20USBGuard%20daemon%20modifies%20some%20the%20default%20authorization%20state%20attributes%0A%23%20of%20controller%20devices.%20This%20setting%2C%20enables%20you%20to%20define%20what%20value%20the%0A%23%20default%20authorization%20is%20set%20to.%0A%23%0A%23%20%2A%20keep%20%20%20%20%20%20%20%20%20-%20do%20not%20change%20the%20authorization%20state%0A%23%20%2A%20none%20%20%20%20%20%20%20%20%20-%20every%20new%20device%20starts%20out%20deauthorized%0A%23%20%2A%20all%20%20%20%20%20%20%20%20%20%20-%20every%20new%20device%20starts%20out%20authorized%0A%23%20%2A%20internal%20%20%20%20%20-%20internal%20devices%20start%20out%20authorized%2C%20external%20devices%20start%0A%23%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20out%20deauthorized%20%28this%20requires%20the%20ACPI%20tables%20to%20properly%0A%23%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20label%20internal%20devices%2C%20and%20kernel%20support%29%0A%23%0A%23AuthorizedDefault%3Dnone%0A%0A%23%0A%23%20Restore%20controller%20device%20state.%0A%23%0A%23%20The%20USBGuard%20daemon%20modifies%20some%20attributes%20of%20controller%0A%23%20devices%20like%20the%20default%20authorization%20state%20of%20new%20child%20device%0A%23%20instances.%20Using%20this%20setting%2C%20you%20can%20control%20whether%20the%0A%23%20daemon%20will%20try%20to%20restore%20the%20attribute%20values%20to%20the%20state%0A%23%20before%20modification%20on%20shutdown.%0A%23%0A%23%20SECURITY%20CONSIDERATIONS%3A%20If%20set%20to%20true%2C%20the%20USB%20authorization%0A%23%20policy%20could%20be%20bypassed%20by%20performing%20some%20sort%20of%20attack%20on%20the%0A%23%20daemon%20%28via%20a%20local%20exploit%20or%20via%20a%20USB%20device%29%20to%20make%20it%20shutdown%0A%23%20and%20restore%20to%20the%20operating-system%20default%20state%20%28known%20to%20be%20permissive%29.%0A%23%0ARestoreControllerDeviceState%3Dfalse%0A%0A%23%0A%23%20Device%20manager%20backend%0A%23%0A%23%20Which%20device%20manager%20backend%20implementation%20to%20use.%20One%20of%3A%0A%23%0A%23%20%2A%20uevent%20%20%20-%20Netlink%20based%20implementation%20which%20uses%20sysfs%20to%20scan%20for%20present%0A%23%20%20%20%20%20%20%20%20%20%20%20%20%20%20devices%20and%20an%20uevent%20netlink%20socket%20for%20receiving%20USB%20device%0A%23%20%20%20%20%20%20%20%20%20%20%20%20%20%20related%20events.%0A%23%20%2A%20umockdev%20-%20umockdev%20based%20device%20manager%20capable%20of%20simulating%20devices%20based%0A%23%20%20%20%20%20%20%20%20%20%20%20%20%20%20on%20umockdev-record%20files.%20Useful%20for%20testing.%0A%23%0ADeviceManagerBackend%3Duevent%0A%0A%23%21%21%21%20WARNING%3A%20It%27s%20good%20practice%20to%20set%20at%20least%20one%20of%20the%20%21%21%21%0A%23%21%21%21%20%20%20%20%20%20%20%20%20%20two%20options%20bellow.%20If%20none%20of%20them%20are%20set%2C%20%20%21%21%21%0A%23%21%21%21%20%20%20%20%20%20%20%20%20%20the%20daemon%20will%20accept%20IPC%20connections%20from%20%20%20%21%21%21%0A%23%21%21%21%20%20%20%20%20%20%20%20%20%20anyone%2C%20thus%20allowing%20anyone%20to%20modify%20the%20%20%20%20%21%21%21%0A%23%21%21%21%20%20%20%20%20%20%20%20%20%20rule%20set%20and%20%28de%29authorize%20USB%20devices.%20%20%20%20%20%20%20%21%21%21%0A%0A%23%0A%23%20Users%20allowed%20to%20use%20the%20IPC%20interface.%0A%23%0A%23%20A%20space%20delimited%20list%20of%20usernames%20that%20the%20daemon%20will%0A%23%20accept%20IPC%20connections%20from.%0A%23%0A%23%20IPCAllowedUsers%3Dusername1%20username2%20...%0A%23%0AIPCAllowedUsers%3Droot%0A%0A%23%0A%23%20Groups%20allowed%20to%20use%20the%20IPC%20interface.%0A%23%0A%23%20A%20space%20delimited%20list%20of%20groupnames%20that%20the%20daemon%20will%0A%23%20accept%20IPC%20connections%20from.%0A%23%0A%23%20IPCAllowedGroups%3Dgroupname1%20groupname2%20...%0A%23%0AIPCAllowedGroups%3Dwheel%0A%0A%23%0A%23%20IPC%20access%20control%20definition%20files%20path.%0A%23%0A%23%20The%20files%20at%20this%20location%20will%20be%20interpreted%20by%20the%20daemon%0A%23%20as%20access%20control%20definition%20files.%20The%20%28base%29name%20of%20a%20file%0A%23%20should%20be%20in%20the%20form%3A%0A%23%0A%23%20%20%20%5Buser%5D%5B%3A%3Cgroup%3E%5D%0A%23%0A%23%20and%20should%20contain%20lines%20in%20the%20form%3A%0A%23%0A%23%20%20%20%3Csection%3E%3D%5Bprivilege%5D%20...%0A%23%0A%23%20This%20way%20each%20file%20defines%20who%20is%20able%20to%20connect%20to%20the%20IPC%0A%23%20bus%20and%20what%20privileges%20he%20has.%0A%23%0AIPCAccessControlFiles%3D/etc/usbguard/IPCAccessControl.d/%0A%0A%23%0A%23%20Generate%20device%20specific%20rules%20including%20the%20%22via-port%22%0A%23%20attribute.%0A%23%0A%23%20This%20option%20modifies%20the%20behavior%20of%20the%20allowDevice%0A%23%20action.%20When%20instructed%20to%20generate%20a%20permanent%20rule%2C%0A%23%20the%20action%20can%20generate%20a%20port%20specific%20rule.%20Because%0A%23%20some%20systems%20have%20unstable%20port%20numbering%2C%20the%20generated%0A%23%20rule%20might%20not%20match%20the%20device%20after%20rebooting%20the%20system.%0A%23%0A%23%20If%20set%20to%20false%2C%20the%20generated%20rule%20will%20still%20contain%0A%23%20the%20%22parent-hash%22%20attribute%20which%20also%20defines%20an%20association%0A%23%20to%20the%20parent%20device.%20See%20usbguard-rules.conf%285%29%20for%20more%0A%23%20details.%0A%23%0ADeviceRulesWithPort%3Dfalse%0A%0A%23%0A%23%20USBGuard%20Audit%20events%20log%20backend%0A%23%0A%23%20One%20of%3A%0A%23%0A%23%20%2A%20FileAudit%20-%20Log%20audit%20events%20into%20a%20file%20specified%20by%0A%23%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20AuditFilePath%20setting%20%28see%20below%29%0A%23%20%2A%20LinuxAudit%20-%20Log%20audit%20events%20using%20the%20Linux%20Audit%0A%23%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20subsystem%20%28using%20audit_log_user_message%29%0A%23%0AAuditBackend%3DLinuxAudit%0A%0A%23%0A%23%20USBGuard%20audit%20events%20log%20file%20path.%0A%23%0A%23AuditFilePath%3D/var/log/usbguard/usbguard-audit.log%0A%0A%23%0A%23%20Hides%20personally%20identifiable%20information%20such%20as%20device%20serial%20numbers%20and%0A%23%20hashes%20of%20descriptors%20%28which%20include%20the%20serial%20number%29%20from%20audit%20entries.%0A%23%0A%23HidePII%3Dfalse
        mode: 0600
        path: /etc/usbguard/usbguard-daemon.conf
        overwrite: true
</fix>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref name="oval:ssg-configure_usbguard_auditbackend:def:1" href="ssg-fedora-oval.xml"/>
        </check>
        <check system="http://scap.nist.gov/schema/ocil/2">
          <check-content-ref name="ocil:ssg-configure_usbguard_auditbackend_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
        </check>
      </Rule>
      <Rule id="xccdf_org.ssgproject.content_rule_usbguard_allow_hid_and_hub" selected="false" role="full" severity="medium">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Authorize Human Interface Devices and USB hubs in USBGuard daemon</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To allow authorization of USB devices combining human interface device and hub capabilities
by USBGuard daemon,
add the line
<html:code xmlns:html="http://www.w3.org/1999/xhtml">allow with-interface match-all { 03:*:* 09:00:* }</html:code>
to <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/usbguard/rules.conf</html:code>.</description>
        <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">This rule should be understood primarily as a convenience administration feature. This rule ensures that if the USBGuard default rules.conf file is present, it will alter it so that USB human interface devices and hubs are allowed. However, if the rules.conf file is altered by system administrator, the rule does not check if USB human interface devices and hubs are allowed. This assumes that an administrator modified the file with some purpose in mind.</warning>
        <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_SMF_EXT.1</reference>
        <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000114-GPOS-00059</reference>
        <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Without allowing Human Interface Devices, it might not be possible
to interact with the system. Without allowing hubs, it might not be possible to use any
USB devices on the system.</rationale>
        <platform idref="cpe:/a:not_s390x_arch"/>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="usbguard_allow_hid_and_hub" system="urn:xccdf:fix:script:sh">#!/bin/bash


echo "allow with-interface match-all { 03:*:* 09:00:* }" &gt;&gt; /etc/usbguard/rules.conf
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="usbguard_allow_hid_and_hub" system="urn:xccdf:fix:script:kubernetes">apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
metadata:
  annotations:
    complianceascode.io/depends-on: xccdf_org.ssgproject.content_rule_package_usbguard_installed
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,%0Aallow%20with-interface%20match-all%20%7B%2003%3A%2A%3A%2A%2009%3A00%3A%2A%20%7D
        mode: 0600
        path: /etc/usbguard/rules.d/75-hid-and-hub.conf
        overwrite: true
</fix>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref name="oval:ssg-usbguard_allow_hid_and_hub:def:1" href="ssg-fedora-oval.xml"/>
        </check>
        <check system="http://scap.nist.gov/schema/ocil/2">
          <check-content-ref name="ocil:ssg-usbguard_allow_hid_and_hub_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
        </check>
      </Rule>
      <Rule id="xccdf_org.ssgproject.content_rule_usbguard_allow_hid" selected="false" role="full" severity="medium">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Authorize Human Interface Devices in USBGuard daemon</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To allow authorization of Human Interface Devices (keyboard, mouse)
by USBGuard daemon,
add the line
<html:code xmlns:html="http://www.w3.org/1999/xhtml">allow with-interface match-all { 03:*:* }</html:code>
to <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/usbguard/rules.conf</html:code>.</description>
        <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">This rule should be understood primarily as a convenience administration feature. This rule ensures that if the USBGuard default rules.conf file is present, it will alter it so that USB human interface devices are allowed. However, if the rules.conf file is altered by system administrator, the rule does not check if USB human interface devices are allowed. This assumes that an administrator modified the file with some purpose in mind.</warning>
        <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_SMF_EXT.1</reference>
        <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000114-GPOS-00059</reference>
        <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Without allowing Human Interface Devices, it might not be possible
to interact with the system.</rationale>
        <platform idref="cpe:/a:not_s390x_arch"/>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="usbguard_allow_hid" system="urn:xccdf:fix:script:sh">
# path of file with Usbguard rules
rulesfile="/etc/usbguard/rules.conf"

echo "allow with-interface match-all { 03:*:* }" &gt;&gt; $rulesfile
</fix>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref name="oval:ssg-usbguard_allow_hid:def:1" href="ssg-fedora-oval.xml"/>
        </check>
        <check system="http://scap.nist.gov/schema/ocil/2">
          <check-content-ref name="ocil:ssg-usbguard_allow_hid_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
        </check>
      </Rule>
      <Rule id="xccdf_org.ssgproject.content_rule_usbguard_allow_hub" selected="false" role="full" severity="medium">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Authorize USB hubs in USBGuard daemon</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To allow authorization of USB hub devices by USBGuard daemon,
add line
<html:code xmlns:html="http://www.w3.org/1999/xhtml">allow with-interface match-all { 09:00:* }</html:code>
to <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/usbguard/rules.conf</html:code>.</description>
        <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">This rule should be understood primarily as a convenience administration feature. This rule ensures that if the USBGuard default rules.conf file is present, it will alter it so that USB hub devices are allowed. However, if the rules.conf file is altered by system administrator, the rule does not check if USB hub devices are allowed. This assumes that an administrator modified the file with some purpose in mind.</warning>
        <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_SMF_EXT.1</reference>
        <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000114-GPOS-00059</reference>
        <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Without allowing hubs, it might not be possible to use any
USB devices on the system.</rationale>
        <platform idref="cpe:/a:not_s390x_arch"/>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="usbguard_allow_hub" system="urn:xccdf:fix:script:sh">

echo "allow with-interface match-all { 09:00:* }" &gt;&gt; /etc/usbguard/rules.conf
</fix>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref name="oval:ssg-usbguard_allow_hub:def:1" href="ssg-fedora-oval.xml"/>
        </check>
        <check system="http://scap.nist.gov/schema/ocil/2">
          <check-content-ref name="ocil:ssg-usbguard_allow_hub_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
        </check>
      </Rule>
    </Group>
    <Group id="xccdf_org.ssgproject.content_group_ssh">
      <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">SSH Server</title>
      <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The SSH protocol is recommended for remote login and
remote file transfer. SSH provides confidentiality and integrity
for data exchanged between two systems, as well as server
authentication, through the use of public key cryptography. The
implementation included with the system is called OpenSSH, and more
detailed documentation is available from its website,

    <html:a xmlns:html="http://www.w3.org/1999/xhtml" href="https://www.openssh.com">https://www.openssh.com</html:a>.
Its server program is called <html:code xmlns:html="http://www.w3.org/1999/xhtml">sshd</html:code> and provided by the RPM package
<html:code xmlns:html="http://www.w3.org/1999/xhtml">openssh-server</html:code>.</description>
      <platform idref="cpe:/a:machine"/>
      <Value id="xccdf_org.ssgproject.content_value_firewalld_sshd_zone" type="string">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">SSH enabled firewalld zone</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Specify firewalld zone to enable SSH service. This value is used only for remediation purposes.</description>
        <value selector="block">block</value>
        <value>public</value>
        <value selector="dmz">dmz</value>
        <value selector="drop">drop</value>
        <value selector="external">external</value>
        <value selector="home">home</value>
        <value selector="internal">internal</value>
        <value selector="public">public</value>
        <value selector="trusted">trusted</value>
        <value selector="work">work</value>
      </Value>
      <Value id="xccdf_org.ssgproject.content_value_sshd_approved_ciphers" type="string">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">SSH Approved ciphers by FIPS</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Specify the FIPS approved ciphers that are used for data integrity protection by the SSH server.</description>
        <value selector="stig">aes128-ctr,aes192-ctr,aes256-ctr</value>
        <value>aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,aes192-cbc,aes256-cbc,rijndael-cbc@lysator.liu.se</value>
      </Value>
      <Value id="xccdf_org.ssgproject.content_value_sshd_approved_macs" type="string">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">SSH Approved MACs by FIPS</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Specify the FIPS approved MACs (message authentication code) algorithms
	that are used for data integrity protection by the SSH server.</description>
        <value selector="stig">hmac-sha2-512,hmac-sha2-256</value>
        <value>hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com</value>
      </Value>
      <Value id="xccdf_org.ssgproject.content_value_sshd_idle_timeout_value" type="number">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">SSH session Idle time</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Specify duration of allowed idle time.</description>
        <value selector="10_minutes">600</value>
        <value selector="120_minutes">7200</value>
        <value selector="14_minutes">840</value>
        <value selector="15_minutes">900</value>
        <value selector="30_minutes">1800</value>
        <value selector="5_minutes">300</value>
        <value selector="60_minutes">3600</value>
        <value>300</value>
      </Value>
      <Value id="xccdf_org.ssgproject.content_value_sshd_listening_port" type="number">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">SSH Server Listening Port</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Specify port the SSH server is listening.</description>
        <value>22</value>
      </Value>
      <Value id="xccdf_org.ssgproject.content_value_sshd_max_auth_tries_value" type="number">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">SSH Max authentication attempts</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Specify the maximum number of authentication attempts per connection.</description>
        <value selector="10">10</value>
        <value selector="3">3</value>
        <value selector="4">4</value>
        <value selector="5">5</value>
        <value>4</value>
      </Value>
      <Value id="xccdf_org.ssgproject.content_value_sshd_required" type="number">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">SSH is required to be installed</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Specify if the Policy requires SSH to be installed. Used by SSH Rules
to determine if SSH should be uninstalled or configured.<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
A value of 0 means that the policy doesn't care if OpenSSH server is installed or not. If it is installed, scanner will check for it's configuration, if it's not installed, the check will pass.<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
A value of 1 indicates that OpenSSH server package is not required by the policy;<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
A value of 2 indicates that OpenSSH server package is required by the policy.<html:br xmlns:html="http://www.w3.org/1999/xhtml"/></description>
        <value>0</value>
        <value selector="no">1</value>
        <value selector="yes">2</value>
      </Value>
      <Value id="xccdf_org.ssgproject.content_value_var_sshd_max_sessions" type="number">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">SSH Max Sessions Count</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Specify the maximum number of open sessions permitted.</description>
        <value selector="10">10</value>
        <value selector="4">4</value>
        <value selector="3">3</value>
        <value selector="2">2</value>
        <value selector="1">1</value>
        <value selector="0">0</value>
        <value>10</value>
      </Value>
      <Value id="xccdf_org.ssgproject.content_value_var_sshd_set_keepalive" type="number">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">SSH Max Keep Alive Count</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Specify the maximum number of idle message counts before session is terminated.</description>
        <value selector="10">10</value>
        <value selector="3">3</value>
        <value selector="5">5</value>
        <value selector="0">0</value>
        <value selector="1">1</value>
        <value>0</value>
      </Value>
      <Rule id="xccdf_org.ssgproject.content_rule_package_openssh-server_installed" selected="false" role="full" severity="medium">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Install the OpenSSH Server Package</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">openssh-server</html:code> package should be installed.
The <html:code xmlns:html="http://www.w3.org/1999/xhtml">openssh-server</html:code> package can be installed with the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">
$ sudo dnf install openssh-server</html:pre></description>
        <reference href="https://public.cyber.mil/stigs/cci/">CCI-002418</reference>
        <reference href="https://public.cyber.mil/stigs/cci/">CCI-002420</reference>
        <reference href="https://public.cyber.mil/stigs/cci/">CCI-002421</reference>
        <reference href="https://public.cyber.mil/stigs/cci/">CCI-002422</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-2</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</reference>
        <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000423-GPOS-00187</reference>
        <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000424-GPOS-00188</reference>
        <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000425-GPOS-00189</reference>
        <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000426-GPOS-00190</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.2</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS06.06</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.10.1.1</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.11.1.4</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.11.1.5</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.11.2.1</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.13.1.3</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.13.2.3</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.13.2.4</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.14.1.2</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.6.1.2</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.7.1.1</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.7.1.2</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.7.3.1</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.8.2.2</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.8.2.3</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.9.1.1</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.9.2.3</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.9.4.1</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.9.4.4</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.9.4.5</reference>
        <reference href="https://www.cisecurity.org/controls/">13</reference>
        <reference href="https://www.cisecurity.org/controls/">14</reference>
        <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FIA_UAU.5</reference>
        <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FTP_ITC_EXT.1</reference>
        <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Without protection of the transmitted information, confidentiality, and
integrity may be compromised because unprotected communications can be
intercepted and either read or altered.</rationale>
        <platform idref="cpe:/a:machine"/>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_openssh-server_installed" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="enable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

if ! rpm -q --quiet "openssh-server" ; then
    dnf install -y "openssh-server"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_openssh-server_installed" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="enable">- name: Ensure openssh-server is installed
  package:
    name: openssh-server
    state: present
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-CM-6(a)
    - enable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - package_openssh-server_installed
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_openssh-server_installed" system="urn:xccdf:fix:script:puppet" complexity="low" disruption="low" strategy="enable">include install_openssh-server

class install_openssh-server {
  package { 'openssh-server':
    ensure =&gt; 'installed',
  }
}
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_openssh-server_installed" system="urn:redhat:anaconda:pre" complexity="low" disruption="low" strategy="enable">
package --add=openssh-server
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_openssh-server_installed" system="urn:redhat:osbuild:blueprint">
[[packages]]
name = "openssh-server"
version = "*"
</fix>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref name="oval:ssg-package_openssh-server_installed:def:1" href="ssg-fedora-oval.xml"/>
        </check>
        <check system="http://scap.nist.gov/schema/ocil/2">
          <check-content-ref name="ocil:ssg-package_openssh-server_installed_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
        </check>
      </Rule>
      <Rule id="xccdf_org.ssgproject.content_rule_package_openssh-server_removed" selected="false" role="full" severity="medium">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Remove the OpenSSH Server Package</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">openssh-server</html:code> package should be removed.
The <html:code xmlns:html="http://www.w3.org/1999/xhtml">openssh-server</html:code> package can be removed with the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">
$ sudo dnf erase openssh-server</html:pre></description>
        <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Without protection of the transmitted information, confidentiality, and
integrity may be compromised because unprotected communications can be
intercepted and either read or altered.</rationale>
        <platform idref="cpe:/a:machine"/>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_openssh-server_removed" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

# CAUTION: This remediation script will remove openssh-server
#	   from the system, and may remove any packages
#	   that depend on openssh-server. Execute this
#	   remediation AFTER testing on a non-production
#	   system!

if rpm -q --quiet "openssh-server" ; then
    dnf remove -y "openssh-server"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_openssh-server_removed" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="disable">- name: Ensure openssh-server is removed
  package:
    name: openssh-server
    state: absent
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - disable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - package_openssh-server_removed
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_openssh-server_removed" system="urn:xccdf:fix:script:puppet" complexity="low" disruption="low" strategy="disable">include remove_openssh-server

class remove_openssh-server {
  package { 'openssh-server':
    ensure =&gt; 'purged',
  }
}
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_openssh-server_removed" system="urn:redhat:anaconda:pre" complexity="low" disruption="low" strategy="disable">
package --remove=openssh-server
</fix>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref name="oval:ssg-package_openssh-server_removed:def:1" href="ssg-fedora-oval.xml"/>
        </check>
        <check system="http://scap.nist.gov/schema/ocil/2">
          <check-content-ref name="ocil:ssg-package_openssh-server_removed_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
        </check>
      </Rule>
      <Rule id="xccdf_org.ssgproject.content_rule_service_sshd_disabled" selected="false" role="full" severity="unknown">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable SSH Server If Possible (Unusual)</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The SSH server service, sshd, is commonly needed.
However, if it can be disabled, do so.


The <html:code xmlns:html="http://www.w3.org/1999/xhtml">sshd</html:code> service can be disabled with the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo systemctl mask --now sshd.service</html:pre>

This is unusual, as SSH is a common method for encrypted and authenticated
remote access.</description>
        <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US"/>
        <platform idref="cpe:/a:machine"/>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="service_sshd_disabled" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

SYSTEMCTL_EXEC='/usr/bin/systemctl'
"$SYSTEMCTL_EXEC" stop 'sshd.service'
"$SYSTEMCTL_EXEC" disable 'sshd.service'
"$SYSTEMCTL_EXEC" mask 'sshd.service'
# Disable socket activation if we have a unit file for it
if "$SYSTEMCTL_EXEC" list-unit-files | grep -q '^sshd.socket'; then
    "$SYSTEMCTL_EXEC" stop 'sshd.socket'
    "$SYSTEMCTL_EXEC" mask 'sshd.socket'
fi
# The service may not be running because it has been started and failed,
# so let's reset the state so OVAL checks pass.
# Service should be 'inactive', not 'failed' after reboot though.
"$SYSTEMCTL_EXEC" reset-failed 'sshd.service' || true

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="service_sshd_disabled" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="disable">- name: Disable service sshd
  block:

    - name: Gather the service facts
      service_facts: null

    - name: Disable service sshd
      systemd:
        name: sshd.service
        enabled: 'no'
        state: stopped
        masked: 'yes'
      when: '"sshd.service" in ansible_facts.services'
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - disable_strategy
    - low_complexity
    - low_disruption
    - no_reboot_needed
    - service_sshd_disabled
    - unknown_severity

- name: Unit Socket Exists - sshd.socket
  command: systemctl list-unit-files sshd.socket
  args:
    warn: false
  register: socket_file_exists
  changed_when: false
  ignore_errors: true
  check_mode: false
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - disable_strategy
    - low_complexity
    - low_disruption
    - no_reboot_needed
    - service_sshd_disabled
    - unknown_severity

- name: Disable socket sshd
  systemd:
    name: sshd.socket
    enabled: 'no'
    state: stopped
    masked: 'yes'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - '"sshd.socket" in socket_file_exists.stdout_lines[1]'
  tags:
    - disable_strategy
    - low_complexity
    - low_disruption
    - no_reboot_needed
    - service_sshd_disabled
    - unknown_severity
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="service_sshd_disabled" system="urn:xccdf:fix:script:puppet" complexity="low" disruption="low" strategy="enable">include disable_sshd

class disable_sshd {
  service {'sshd':
    enable =&gt; false,
    ensure =&gt; 'stopped',
  }
}
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="service_sshd_disabled" system="urn:xccdf:fix:script:kubernetes" reboot="true" complexity="low" disruption="medium" strategy="disable">apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    systemd:
      units:
      - name: sshd.service
        enabled: false
        mask: true
      - name: sshd.socket
        enabled: false
        mask: true
</fix>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref name="oval:ssg-service_sshd_disabled:def:1" href="ssg-fedora-oval.xml"/>
        </check>
      </Rule>
      <Rule id="xccdf_org.ssgproject.content_rule_file_permissions_sshd_pub_key" selected="false" role="full" severity="medium">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Verify Permissions on SSH Server Public *.pub Key Files</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US"> To properly set the permissions of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/ssh/*.pub</html:code>, run the command: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo chmod 0644 /etc/ssh/*.pub</html:pre></description>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.13</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.13.10</reference>
        <reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(a)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</reference>
        <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.10.1.1</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.11.1.4</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.11.1.5</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.11.2.1</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.13.1.3</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.13.2.3</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.13.2.4</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.14.1.2</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.6.1.2</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.7.1.1</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.7.1.2</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.7.3.1</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.8.2.2</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.8.2.3</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.9.1.1</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.9.2.3</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.9.4.1</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.9.4.4</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.9.4.5</reference>
        <reference href="https://www.cisecurity.org/controls/">12</reference>
        <reference href="https://www.cisecurity.org/controls/">13</reference>
        <reference href="https://www.cisecurity.org/controls/">14</reference>
        <reference href="https://www.cisecurity.org/controls/">15</reference>
        <reference href="https://www.cisecurity.org/controls/">16</reference>
        <reference href="https://www.cisecurity.org/controls/">18</reference>
        <reference href="https://www.cisecurity.org/controls/">3</reference>
        <reference href="https://www.cisecurity.org/controls/">5</reference>
        <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">If a public host key file is modified by an unauthorized user, the SSH service
may be compromised.</rationale>
        <platform idref="cpe:/a:machine"/>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_permissions_sshd_pub_key" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="configure"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

readarray -t files &lt; &lt;(find /etc/ssh/)
for file in "${files[@]}"; do
    if basename $file | grep -q '^.*.pub$'; then
        chmod 0644 $file
    fi    
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_permissions_sshd_pub_key" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: Find /etc/ssh/ file(s)
  find:
    paths: /etc/ssh/
    patterns: ^.*.pub$
    use_regex: true
  register: files_found
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.13
    - NIST-800-171-3.13.10
    - NIST-800-53-AC-17(a)
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - configure_strategy
    - file_permissions_sshd_pub_key
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Set permissions for /etc/ssh/ file(s)
  file:
    path: '{{ item.path }}'
    mode: '0644'
  with_items:
    - '{{ files_found.files }}'
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.13
    - NIST-800-171-3.13.10
    - NIST-800-53-AC-17(a)
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - configure_strategy
    - file_permissions_sshd_pub_key
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_permissions_sshd_pub_key" system="urn:xccdf:fix:script:puppet">include ssh_public_key_perms

class ssh_public_key_perms {
  exec { 'sshd_pub_key':
    command =&gt; "chmod 0644 /etc/ssh/*.pub",
    path    =&gt; '/bin:/usr/bin'
  }
}
</fix>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref name="oval:ssg-file_permissions_sshd_pub_key:def:1" href="ssg-fedora-oval.xml"/>
        </check>
        <check system="http://scap.nist.gov/schema/ocil/2">
          <check-content-ref name="ocil:ssg-file_permissions_sshd_pub_key_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
        </check>
      </Rule>
      <Rule id="xccdf_org.ssgproject.content_rule_iptables_sshd_disabled" selected="false" role="full" severity="unknown">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Remove SSH Server iptables Firewall exception (Unusual)</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">By default, inbound connections to SSH's port are allowed. If the SSH
server is not being used, this exception should be removed from the
firewall configuration.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Edit the files <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/sysconfig/iptables</html:code> and
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/sysconfig/ip6tables</html:code> (if IPv6 is in use). In each file, locate
and delete the line:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT</html:pre>
This is unusual, as SSH is a common method for encrypted and authenticated
remote access.</description>
        <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">If inbound SSH connections are not expected, disallowing access to the SSH
port will avoid possible exploitation of the port by an attacker.</rationale>
        <platform idref="cpe:/a:machine"/>
      </Rule>
      <Rule id="xccdf_org.ssgproject.content_rule_file_permissions_sshd_private_key" selected="false" role="full" severity="medium">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Verify Permissions on SSH Server Private *_key Key Files</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">

To properly set the permissions of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/ssh/*_key</html:code>, run the command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo chmod 0640 /etc/ssh/*_key</html:pre></description>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.13</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.13.10</reference>
        <reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(a)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</reference>
        <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
        <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.10.1.1</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.11.1.4</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.11.1.5</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.11.2.1</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.13.1.3</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.13.2.3</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.13.2.4</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.14.1.2</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.6.1.2</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.7.1.1</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.7.1.2</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.7.3.1</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.8.2.2</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.8.2.3</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.9.1.1</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.9.2.3</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.9.4.1</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.9.4.4</reference>
        <reference href="https://www.iso.org/standard/54534.html">A.9.4.5</reference>
        <reference href="https://www.cisecurity.org/controls/">12</reference>
        <reference href="https://www.cisecurity.org/controls/">13</reference>
        <reference href="https://www.cisecurity.org/controls/">14</reference>
        <reference href="https://www.cisecurity.org/controls/">15</reference>
        <reference href="https://www.cisecurity.org/controls/">16</reference>
        <reference href="https://www.cisecurity.org/controls/">18</reference>
        <reference href="https://www.cisecurity.org/controls/">3</reference>
        <reference href="https://www.cisecurity.org/controls/">5</reference>
        <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R36)</reference>
        <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">If an unauthorized user obtains the private SSH host key file, the host could be
impersonated.</rationale>
        <platform idref="cpe:/a:machine"/>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_permissions_sshd_private_key" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="configure"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

readarray -t files &lt; &lt;(find /etc/ssh/)
for file in "${files[@]}"; do
    if basename $file | grep -q '^.*_key$'; then
        chmod 0640 $file
    fi    
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_permissions_sshd_private_key" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: Find /etc/ssh/ file(s)
  find:
    paths: /etc/ssh/
    patterns: ^.*_key$
    use_regex: true
  register: files_found
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.13
    - NIST-800-171-3.13.10
    - NIST-800-53-AC-17(a)
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - configure_strategy
    - file_permissions_sshd_private_key
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Set permissions for /etc/ssh/ file(s)
  file:
    path: '{{ item.path }}'
    mode: '0640'
  with_items:
    - '{{ files_found.files }}'
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.13
    - NIST-800-171-3.13.10
    - NIST-800-53-AC-17(a)
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - configure_strategy
    - file_permissions_sshd_private_key
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_permissions_sshd_private_key" system="urn:xccdf:fix:script:puppet">include ssh_private_key_perms

class ssh_private_key_perms {
  exec { 'sshd_priv_key':
    command =&gt; "chmod 0640 /etc/ssh/*_key",
    path    =&gt; '/bin:/usr/bin'
  }
}
</fix>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref name="oval:ssg-file_permissions_sshd_private_key:def:1" href="ssg-fedora-oval.xml"/>
        </check>
        <check system="http://scap.nist.gov/schema/ocil/2">
          <check-content-ref name="ocil:ssg-file_permissions_sshd_private_key_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
        </check>
      </Rule>
      <Group id="xccdf_org.ssgproject.content_group_ssh_client">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Configure OpenSSH Client if Necessary</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The following configuration changes apply to the SSH client. They can
improve security parameters relwevant to the client user, e.g. increasing
entropy while generating initialization vectors. Note that these changes
influence only the default SSH client configuration. Changes in this group
can be overridden by the client user by modifying files within the
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">~/.ssh</html:pre> directory or by supplying parameters on the command line.</description>
        <platform idref="cpe:/a:machine"/>
      </Group>
      <Group id="xccdf_org.ssgproject.content_group_ssh_server">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Configure OpenSSH Server if Necessary</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">If the system needs to act as an SSH server, then
certain changes should be made to the OpenSSH daemon configuration
file <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/ssh/sshd_config</html:code>. The following recommendations can be
applied to this file. See the <html:code xmlns:html="http://www.w3.org/1999/xhtml">sshd_config(5)</html:code> man page for more
detailed information.</description>
        <platform idref="cpe:/a:machine"/>
        <Value id="xccdf_org.ssgproject.content_value_var_rekey_limit_size" type="string">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">SSH RekeyLimit - size</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Specify the size component of the rekey limit.</description>
          <value selector="sshd_default">default</value>
          <value>512M</value>
          <value selector="512M">512M</value>
          <value selector="1G">1G</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_rekey_limit_time" type="string">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">SSH RekeyLimit - size</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Specify the size component of the rekey limit.</description>
          <value selector="sshd_default">none</value>
          <value>1h</value>
          <value selector="1hour">1h</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_sshd_disable_compression" type="string">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">SSH Compression Setting</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Specify the compression setting for SSH connections.</description>
          <value selector="no">no</value>
          <value selector="delayed">delayed</value>
          <value>no</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_sshd_priv_separation" type="string">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">SSH Privilege Separation Setting</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Specify whether and how sshd separates privileges when handling incoming network connections.</description>
          <value selector="no">no</value>
          <value selector="yes">yes</value>
          <value selector="sandbox">sandbox</value>
          <value>sandbox</value>
        </Value>
        <Rule id="xccdf_org.ssgproject.content_rule_sshd_rekey_limit" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Force frequent session key renegotiation</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">RekeyLimit</html:code> parameter specifies how often
the session key of the is renegotiated, both in terms of
amount of data that may be transmitted and the time
elapsed. To decrease the default limits, put line
<html:code xmlns:html="http://www.w3.org/1999/xhtml" xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2">RekeyLimit <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_rekey_limit_size" use="legacy"/> <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_rekey_limit_time" use="legacy"/></html:code> to file <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/ssh/sshd_config</html:code>.</description>
          <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FCS_SSHS_EXT.1</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000033-GPOS-00014</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-000068</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">By decreasing the limit based on the amount of data and enabling
time-based limit, effects of potential attacks against
encryption keys are limited.</rationale>
          <platform idref="cpe:/a:machine"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sshd_rekey_limit" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then


var_rekey_limit_size="<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_rekey_limit_size" use="legacy"/>"

var_rekey_limit_time="<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_rekey_limit_time" use="legacy"/>"



if [ -e "/etc/ssh/sshd_config" ] ; then
    LC_ALL=C sed -i "/^\s*RekeyLimit\s\+/Id" "/etc/ssh/sshd_config"
else
    touch "/etc/ssh/sshd_config"
fi
cp "/etc/ssh/sshd_config" "/etc/ssh/sshd_config.bak"
# Insert before the line matching the regex '^Match'.
line_number="$(LC_ALL=C grep -n "^Match" "/etc/ssh/sshd_config.bak" | LC_ALL=C sed 's/:.*//g')"
if [ -z "$line_number" ]; then
    # There was no match of '^Match', insert at
    # the end of the file.
    printf '%s\n' "RekeyLimit $var_rekey_limit_size $var_rekey_limit_time" &gt;&gt; "/etc/ssh/sshd_config"
else
    head -n "$(( line_number - 1 ))" "/etc/ssh/sshd_config.bak" &gt; "/etc/ssh/sshd_config"
    printf '%s\n' "RekeyLimit $var_rekey_limit_size $var_rekey_limit_time" &gt;&gt; "/etc/ssh/sshd_config"
    tail -n "+$(( line_number ))" "/etc/ssh/sshd_config.bak" &gt;&gt; "/etc/ssh/sshd_config"
fi
# Clean up after ourselves.
rm "/etc/ssh/sshd_config.bak"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sshd_rekey_limit" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: XCCDF Value var_rekey_limit_size # promote to variable
  set_fact:
    var_rekey_limit_size: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_rekey_limit_size" use="legacy"/>
  tags:
    - always
- name: XCCDF Value var_rekey_limit_time # promote to variable
  set_fact:
    var_rekey_limit_time: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_rekey_limit_time" use="legacy"/>
  tags:
    - always

- name: Force frequent session key renegotiation
  block:

    - name: Check for duplicate values
      lineinfile:
        path: /etc/ssh/sshd_config
        create: false
        regexp: (?i)^\s*RekeyLimit\s+
        state: absent
      check_mode: true
      changed_when: false
      register: dupes

    - name: Deduplicate values from /etc/ssh/sshd_config
      lineinfile:
        path: /etc/ssh/sshd_config
        create: false
        regexp: (?i)^\s*RekeyLimit\s+
        state: absent
      when: dupes.found is defined and dupes.found &gt; 1

    - name: Insert correct line to /etc/ssh/sshd_config
      lineinfile:
        path: /etc/ssh/sshd_config
        create: true
        regexp: (?i)^\s*RekeyLimit\s+
        line: RekeyLimit {{ var_rekey_limit_size }} {{ var_rekey_limit_time }}
        state: present
        insertbefore: ^[#\s]*Match
        validate: /usr/sbin/sshd -t -f %s
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - sshd_rekey_limit
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export export-name="oval:ssg-sshd_required:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_required"/>
            <check-export export-name="oval:ssg-var_rekey_limit_time:var:1" value-id="xccdf_org.ssgproject.content_value_var_rekey_limit_time"/>
            <check-export export-name="oval:ssg-var_rekey_limit_size:var:1" value-id="xccdf_org.ssgproject.content_value_var_rekey_limit_size"/>
            <check-content-ref name="oval:ssg-sshd_rekey_limit:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-sshd_rekey_limit_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_sshd_disable_gssapi_auth" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable GSSAPI Authentication</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Unless needed, SSH should not permit extraneous or unnecessary
authentication mechanisms like GSSAPI. To disable GSSAPI authentication, add or
correct the following line in the <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/ssh/sshd_config</html:code> file:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">GSSAPIAuthentication no</html:pre></description>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.12</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-000318</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-000368</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-001812</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-001813</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-001814</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(4)(i)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(1)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(3)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(1)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(2)(ii)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(a)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
          <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FTP_ITC_EXT.1</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000364-GPOS-00151</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
          <reference href="">SRG-OS-000480-VMM-002000</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.3</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.5.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.6.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.2.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.2.4</reference>
          <reference href="https://www.cisecurity.org/controls/">11</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">9</reference>
          <reference href="">0418</reference>
          <reference href="">1055</reference>
          <reference href="">1402</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">GSSAPI authentication is used to provide additional authentication mechanisms to
applications. Allowing GSSAPI authentication through SSH exposes the system's
GSSAPI to remote hosts, increasing the attack surface of the system.</rationale>
          <platform idref="cpe:/a:machine"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sshd_disable_gssapi_auth" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="restrict"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

if [ -e "/etc/ssh/sshd_config" ] ; then
    LC_ALL=C sed -i "/^\s*GSSAPIAuthentication\s\+/Id" "/etc/ssh/sshd_config"
else
    touch "/etc/ssh/sshd_config"
fi
cp "/etc/ssh/sshd_config" "/etc/ssh/sshd_config.bak"
# Insert before the line matching the regex '^Match'.
line_number="$(LC_ALL=C grep -n "^Match" "/etc/ssh/sshd_config.bak" | LC_ALL=C sed 's/:.*//g')"
if [ -z "$line_number" ]; then
    # There was no match of '^Match', insert at
    # the end of the file.
    printf '%s\n' "GSSAPIAuthentication no" &gt;&gt; "/etc/ssh/sshd_config"
else
    head -n "$(( line_number - 1 ))" "/etc/ssh/sshd_config.bak" &gt; "/etc/ssh/sshd_config"
    printf '%s\n' "GSSAPIAuthentication no" &gt;&gt; "/etc/ssh/sshd_config"
    tail -n "+$(( line_number ))" "/etc/ssh/sshd_config.bak" &gt;&gt; "/etc/ssh/sshd_config"
fi
# Clean up after ourselves.
rm "/etc/ssh/sshd_config.bak"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sshd_disable_gssapi_auth" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Disable GSSAPI Authentication
  block:

    - name: Check for duplicate values
      lineinfile:
        path: /etc/ssh/sshd_config
        create: false
        regexp: (?i)^\s*GSSAPIAuthentication\s+
        state: absent
      check_mode: true
      changed_when: false
      register: dupes

    - name: Deduplicate values from /etc/ssh/sshd_config
      lineinfile:
        path: /etc/ssh/sshd_config
        create: false
        regexp: (?i)^\s*GSSAPIAuthentication\s+
        state: absent
      when: dupes.found is defined and dupes.found &gt; 1

    - name: Insert correct line to /etc/ssh/sshd_config
      lineinfile:
        path: /etc/ssh/sshd_config
        create: true
        regexp: (?i)^\s*GSSAPIAuthentication\s+
        line: GSSAPIAuthentication no
        state: present
        insertbefore: ^[#\s]*Match
        validate: /usr/sbin/sshd -t -f %s
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.12
    - NIST-800-53-AC-17(a)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sshd_disable_gssapi_auth
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export export-name="oval:ssg-sshd_required:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_required"/>
            <check-content-ref name="oval:ssg-sshd_disable_gssapi_auth:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-sshd_disable_gssapi_auth_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_sshd_print_last_log" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Enable SSH Print Last Log</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">When enabled, SSH will display the date and time of the last
successful account logon. To enable LastLog in
SSH, add or correct the following line in the <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/ssh/sshd_config</html:code> file:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">PrintLastLog yes</html:pre></description>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-9</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.10</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.10</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.18.1.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.3.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.3</reference>
          <reference href="https://www.cisecurity.org/controls/">1</reference>
          <reference href="https://www.cisecurity.org/controls/">12</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">16</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Providing users feedback on when account accesses last occurred facilitates user
recognition and reporting of unauthorized account use.</rationale>
          <platform idref="cpe:/a:machine"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sshd_print_last_log" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="restrict"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

if [ -e "/etc/ssh/sshd_config" ] ; then
    LC_ALL=C sed -i "/^\s*PrintLastLog\s\+/Id" "/etc/ssh/sshd_config"
else
    touch "/etc/ssh/sshd_config"
fi
cp "/etc/ssh/sshd_config" "/etc/ssh/sshd_config.bak"
# Insert before the line matching the regex '^Match'.
line_number="$(LC_ALL=C grep -n "^Match" "/etc/ssh/sshd_config.bak" | LC_ALL=C sed 's/:.*//g')"
if [ -z "$line_number" ]; then
    # There was no match of '^Match', insert at
    # the end of the file.
    printf '%s\n' "PrintLastLog yes" &gt;&gt; "/etc/ssh/sshd_config"
else
    head -n "$(( line_number - 1 ))" "/etc/ssh/sshd_config.bak" &gt; "/etc/ssh/sshd_config"
    printf '%s\n' "PrintLastLog yes" &gt;&gt; "/etc/ssh/sshd_config"
    tail -n "+$(( line_number ))" "/etc/ssh/sshd_config.bak" &gt;&gt; "/etc/ssh/sshd_config"
fi
# Clean up after ourselves.
rm "/etc/ssh/sshd_config.bak"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sshd_print_last_log" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Enable SSH Print Last Log
  block:

    - name: Check for duplicate values
      lineinfile:
        path: /etc/ssh/sshd_config
        create: false
        regexp: (?i)^\s*PrintLastLog\s+
        state: absent
      check_mode: true
      changed_when: false
      register: dupes

    - name: Deduplicate values from /etc/ssh/sshd_config
      lineinfile:
        path: /etc/ssh/sshd_config
        create: false
        regexp: (?i)^\s*PrintLastLog\s+
        state: absent
      when: dupes.found is defined and dupes.found &gt; 1

    - name: Insert correct line to /etc/ssh/sshd_config
      lineinfile:
        path: /etc/ssh/sshd_config
        create: true
        regexp: (?i)^\s*PrintLastLog\s+
        line: PrintLastLog yes
        state: present
        insertbefore: ^[#\s]*Match
        validate: /usr/sbin/sshd -t -f %s
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-17(a)
    - NIST-800-53-AC-9
    - NIST-800-53-CM-6(a)
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sshd_print_last_log
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export export-name="oval:ssg-sshd_required:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_required"/>
            <check-content-ref name="oval:ssg-sshd_print_last_log:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-sshd_print_last_log_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_sshd_set_idle_timeout" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Set SSH Idle Timeout Interval</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">SSH allows administrators to set an idle timeout interval. After this interval
has passed, the idle user will be automatically logged out.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
To set an idle timeout interval, edit the following line in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/ssh/sshd_config</html:code> as
follows:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml" xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2">ClientAliveInterval <html:b><xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sshd_idle_timeout_value" use="legacy"/></html:b></html:pre>
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
The timeout <html:b xmlns:html="http://www.w3.org/1999/xhtml">interval</html:b> is given in seconds. For example, have a timeout
of 10 minutes, set <html:b xmlns:html="http://www.w3.org/1999/xhtml">interval</html:b> to 600.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
If a shorter timeout has already been set for the login shell, that value will
preempt any SSH setting made in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/ssh/sshd_config</html:code>. Keep in mind that
some processes may stop SSH  from correctly detecting that the user is idle.</description>
          <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="dependency">SSH disconnecting idle clients will not have desired effect without also
configuring ClientAliveCountMax in the SSH service configuration.</warning>
          <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">Following conditions may prevent the SSH session to time out:
<html:ul xmlns:html="http://www.w3.org/1999/xhtml"><html:li>Remote processes on the remote machine generates output. As the output has to be transferred over the network to the client, the timeout is reset every time such transfer happens.</html:li><html:li>Any <html:code>scp</html:code> or <html:code>sftp</html:code> activity by the same user to the host resets the timeout.</html:li></html:ul></warning>
          <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.6</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.11</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-000879</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-001133</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-002361</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-2(5)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-12</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-10</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-2</reference>
          <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-8.1.8</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000126-GPOS-00066</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000163-GPOS-00072</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000279-GPOS-00109</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000395-GPOS-00175</reference>
          <reference href="">SRG-OS-000480-VMM-002000</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.2.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.3</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI03.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI03.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI03.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.10</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.10</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.4.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.4.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.2.5</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.18.1.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.6.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.6.1.5</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.7.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.6</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.3.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.5</reference>
          <reference href="https://www.cisecurity.org/controls/">1</reference>
          <reference href="https://www.cisecurity.org/controls/">12</reference>
          <reference href="https://www.cisecurity.org/controls/">13</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">16</reference>
          <reference href="https://www.cisecurity.org/controls/">18</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">5</reference>
          <reference href="https://www.cisecurity.org/controls/">7</reference>
          <reference href="https://www.cisecurity.org/controls/">8</reference>
          <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R29)</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Terminating an idle ssh session within a short time period reduces the window of
opportunity for unauthorized personnel to take control of a management session
enabled on the console or console port that has been let unattended.</rationale>
          <platform idref="cpe:/a:machine"/>
          <requires idref="xccdf_org.ssgproject.content_rule_sshd_set_keepalive"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sshd_set_idle_timeout" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then


sshd_idle_timeout_value="<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_sshd_idle_timeout_value" use="legacy"/>"



if [ -e "/etc/ssh/sshd_config" ] ; then
    LC_ALL=C sed -i "/^\s*ClientAliveInterval\s\+/Id" "/etc/ssh/sshd_config"
else
    touch "/etc/ssh/sshd_config"
fi
cp "/etc/ssh/sshd_config" "/etc/ssh/sshd_config.bak"
# Insert before the line matching the regex '^Match'.
line_number="$(LC_ALL=C grep -n "^Match" "/etc/ssh/sshd_config.bak" | LC_ALL=C sed 's/:.*//g')"
if [ -z "$line_number" ]; then
    # There was no match of '^Match', insert at
    # the end of the file.
    printf '%s\n' "ClientAliveInterval $sshd_idle_timeout_value" &gt;&gt; "/etc/ssh/sshd_config"
else
    head -n "$(( line_number - 1 ))" "/etc/ssh/sshd_config.bak" &gt; "/etc/ssh/sshd_config"
    printf '%s\n' "ClientAliveInterval $sshd_idle_timeout_value" &gt;&gt; "/etc/ssh/sshd_config"
    tail -n "+$(( line_number ))" "/etc/ssh/sshd_config.bak" &gt;&gt; "/etc/ssh/sshd_config"
fi
# Clean up after ourselves.
rm "/etc/ssh/sshd_config.bak"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sshd_set_idle_timeout" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: XCCDF Value sshd_idle_timeout_value # promote to variable
  set_fact:
    sshd_idle_timeout_value: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_sshd_idle_timeout_value" use="legacy"/>
  tags:
    - always

- name: Set SSH Idle Timeout Interval
  block:

    - name: Check for duplicate values
      lineinfile:
        path: /etc/ssh/sshd_config
        create: false
        regexp: (?i)^\s*ClientAliveInterval\s+
        state: absent
      check_mode: true
      changed_when: false
      register: dupes

    - name: Deduplicate values from /etc/ssh/sshd_config
      lineinfile:
        path: /etc/ssh/sshd_config
        create: false
        regexp: (?i)^\s*ClientAliveInterval\s+
        state: absent
      when: dupes.found is defined and dupes.found &gt; 1

    - name: Insert correct line to /etc/ssh/sshd_config
      lineinfile:
        path: /etc/ssh/sshd_config
        create: true
        regexp: (?i)^\s*ClientAliveInterval\s+
        line: ClientAliveInterval {{ sshd_idle_timeout_value }}
        state: present
        insertbefore: ^[#\s]*Match
        validate: /usr/sbin/sshd -t -f %s
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.5.6
    - NIST-800-171-3.1.11
    - NIST-800-53-AC-12
    - NIST-800-53-AC-17(a)
    - NIST-800-53-AC-17(a)
    - NIST-800-53-AC-2(5)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-SC-10
    - PCI-DSS-Req-8.1.8
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sshd_set_idle_timeout
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export export-name="oval:ssg-sshd_required:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_required"/>
            <check-export export-name="oval:ssg-var_sshd_set_keepalive:var:1" value-id="xccdf_org.ssgproject.content_value_var_sshd_set_keepalive"/>
            <check-export export-name="oval:ssg-sshd_idle_timeout_value:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_idle_timeout_value"/>
            <check-content-ref name="oval:ssg-sshd_set_idle_timeout:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-sshd_set_idle_timeout_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_sshd_set_loglevel_verbose" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Set SSH Daemon LogLevel to VERBOSE</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">VERBOSE</html:code> parameter configures the SSH daemon to record login and logout activity.
To specify the log level in
SSH, add or correct the following line in the <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/ssh/sshd_config</html:code> file:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">LogLevel VERBOSE</html:pre></description>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000032-GPOS-00013</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-000067</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(1)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">SSH provides several logging levels with varying amounts of verbosity. <html:code xmlns:html="http://www.w3.org/1999/xhtml">DEBUG</html:code> is specifically
not recommended other than strictly for debugging SSH communications since it provides
so much data that it is difficult to identify important security information. <html:code xmlns:html="http://www.w3.org/1999/xhtml">INFO</html:code> or 
<html:code xmlns:html="http://www.w3.org/1999/xhtml">VERBOSE</html:code> level is the basic level that only records login activity of SSH users. In many
situations, such as Incident Response, it is important to determine when a particular user was active
on a system. The logout record can eliminate those users who disconnected, which helps narrow the
field.</rationale>
          <platform idref="cpe:/a:machine"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sshd_set_loglevel_verbose" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="restrict"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

if [ -e "/etc/ssh/sshd_config" ] ; then
    LC_ALL=C sed -i "/^\s*LogLevel\s\+/Id" "/etc/ssh/sshd_config"
else
    touch "/etc/ssh/sshd_config"
fi
cp "/etc/ssh/sshd_config" "/etc/ssh/sshd_config.bak"
# Insert before the line matching the regex '^Match'.
line_number="$(LC_ALL=C grep -n "^Match" "/etc/ssh/sshd_config.bak" | LC_ALL=C sed 's/:.*//g')"
if [ -z "$line_number" ]; then
    # There was no match of '^Match', insert at
    # the end of the file.
    printf '%s\n' "LogLevel VERBOSE" &gt;&gt; "/etc/ssh/sshd_config"
else
    head -n "$(( line_number - 1 ))" "/etc/ssh/sshd_config.bak" &gt; "/etc/ssh/sshd_config"
    printf '%s\n' "LogLevel VERBOSE" &gt;&gt; "/etc/ssh/sshd_config"
    tail -n "+$(( line_number ))" "/etc/ssh/sshd_config.bak" &gt;&gt; "/etc/ssh/sshd_config"
fi
# Clean up after ourselves.
rm "/etc/ssh/sshd_config.bak"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sshd_set_loglevel_verbose" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Set SSH Daemon LogLevel to VERBOSE
  block:

    - name: Check for duplicate values
      lineinfile:
        path: /etc/ssh/sshd_config
        create: false
        regexp: (?i)^\s*LogLevel\s+
        state: absent
      check_mode: true
      changed_when: false
      register: dupes

    - name: Deduplicate values from /etc/ssh/sshd_config
      lineinfile:
        path: /etc/ssh/sshd_config
        create: false
        regexp: (?i)^\s*LogLevel\s+
        state: absent
      when: dupes.found is defined and dupes.found &gt; 1

    - name: Insert correct line to /etc/ssh/sshd_config
      lineinfile:
        path: /etc/ssh/sshd_config
        create: true
        regexp: (?i)^\s*LogLevel\s+
        line: LogLevel VERBOSE
        state: present
        insertbefore: ^[#\s]*Match
        validate: /usr/sbin/sshd -t -f %s
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-17(1)
    - NIST-800-53-AC-17(a)
    - NIST-800-53-CM-6(a)
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sshd_set_loglevel_verbose
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export export-name="oval:ssg-sshd_required:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_required"/>
            <check-content-ref name="oval:ssg-sshd_set_loglevel_verbose:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-sshd_set_loglevel_verbose_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_sshd_enable_gssapi_auth" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Enable GSSAPI Authentication</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Sites setup to use Kerberos or other GSSAPI Authenticaion require setting
sshd to accept this authentication.
To enable GSSAPI authentication, add or correct the following line in the
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/ssh/sshd_config</html:code> file:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">GSSAPIAuthentication yes</html:pre></description>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Kerberos authentication for SSH is often implemented using GSSAPI. If
Kerberos is enabled through SSH, the SSH daemon provides a means of access
to the system's Kerberos implementation. Vulnerabilities in the system's
Kerberos implementations may be subject to exploitation.

For enterprises, Kerberos is often enabled and used with GSSAPI for 
centralized user account management which may necessitate enabling of
GSSAPI functionality in SSH. </rationale>
          <platform idref="cpe:/a:machine"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sshd_enable_gssapi_auth" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="restrict"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

if [ -e "/etc/ssh/sshd_config" ] ; then
    LC_ALL=C sed -i "/^\s*GSSAPIAuthentication\s\+/Id" "/etc/ssh/sshd_config"
else
    touch "/etc/ssh/sshd_config"
fi
cp "/etc/ssh/sshd_config" "/etc/ssh/sshd_config.bak"
# Insert before the line matching the regex '^Match'.
line_number="$(LC_ALL=C grep -n "^Match" "/etc/ssh/sshd_config.bak" | LC_ALL=C sed 's/:.*//g')"
if [ -z "$line_number" ]; then
    # There was no match of '^Match', insert at
    # the end of the file.
    printf '%s\n' "GSSAPIAuthentication yes" &gt;&gt; "/etc/ssh/sshd_config"
else
    head -n "$(( line_number - 1 ))" "/etc/ssh/sshd_config.bak" &gt; "/etc/ssh/sshd_config"
    printf '%s\n' "GSSAPIAuthentication yes" &gt;&gt; "/etc/ssh/sshd_config"
    tail -n "+$(( line_number ))" "/etc/ssh/sshd_config.bak" &gt;&gt; "/etc/ssh/sshd_config"
fi
# Clean up after ourselves.
rm "/etc/ssh/sshd_config.bak"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sshd_enable_gssapi_auth" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Enable GSSAPI Authentication
  block:

    - name: Check for duplicate values
      lineinfile:
        path: /etc/ssh/sshd_config
        create: false
        regexp: (?i)^\s*GSSAPIAuthentication\s+
        state: absent
      check_mode: true
      changed_when: false
      register: dupes

    - name: Deduplicate values from /etc/ssh/sshd_config
      lineinfile:
        path: /etc/ssh/sshd_config
        create: false
        regexp: (?i)^\s*GSSAPIAuthentication\s+
        state: absent
      when: dupes.found is defined and dupes.found &gt; 1

    - name: Insert correct line to /etc/ssh/sshd_config
      lineinfile:
        path: /etc/ssh/sshd_config
        create: true
        regexp: (?i)^\s*GSSAPIAuthentication\s+
        line: GSSAPIAuthentication yes
        state: present
        insertbefore: ^[#\s]*Match
        validate: /usr/sbin/sshd -t -f %s
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sshd_enable_gssapi_auth
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export export-name="oval:ssg-sshd_required:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_required"/>
            <check-content-ref name="oval:ssg-sshd_enable_gssapi_auth:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-sshd_enable_gssapi_auth_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_sshd_set_max_auth_tries" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Set SSH authentication attempt limit</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">MaxAuthTries</html:code> parameter specifies the maximum number of authentication attempts
permitted per connection. Once the number of failures reaches half this value, additional failures are logged.
to set MaxAUthTries edit <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/ssh/sshd_config</html:code> as follows:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml" xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2">MaxAuthTries <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sshd_max_auth_tries_value" use="legacy"/></html:pre></description>
          <reference href="">0421</reference>
          <reference href="">0422</reference>
          <reference href="">0431</reference>
          <reference href="">0974</reference>
          <reference href="">1173</reference>
          <reference href="">1401</reference>
          <reference href="">1504</reference>
          <reference href="">1505</reference>
          <reference href="">1546</reference>
          <reference href="">1557</reference>
          <reference href="">1558</reference>
          <reference href="">1559</reference>
          <reference href="">1560</reference>
          <reference href="">1561</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Setting the MaxAuthTries parameter to a low number will minimize the risk of successful
brute force attacks to the SSH server.</rationale>
          <platform idref="cpe:/a:machine"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sshd_set_max_auth_tries" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then


sshd_max_auth_tries_value="<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_sshd_max_auth_tries_value" use="legacy"/>"



if [ -e "/etc/ssh/sshd_config" ] ; then
    LC_ALL=C sed -i "/^\s*MaxAuthTries\s\+/Id" "/etc/ssh/sshd_config"
else
    touch "/etc/ssh/sshd_config"
fi
cp "/etc/ssh/sshd_config" "/etc/ssh/sshd_config.bak"
# Insert before the line matching the regex '^Match'.
line_number="$(LC_ALL=C grep -n "^Match" "/etc/ssh/sshd_config.bak" | LC_ALL=C sed 's/:.*//g')"
if [ -z "$line_number" ]; then
    # There was no match of '^Match', insert at
    # the end of the file.
    printf '%s\n' "MaxAuthTries $sshd_max_auth_tries_value" &gt;&gt; "/etc/ssh/sshd_config"
else
    head -n "$(( line_number - 1 ))" "/etc/ssh/sshd_config.bak" &gt; "/etc/ssh/sshd_config"
    printf '%s\n' "MaxAuthTries $sshd_max_auth_tries_value" &gt;&gt; "/etc/ssh/sshd_config"
    tail -n "+$(( line_number ))" "/etc/ssh/sshd_config.bak" &gt;&gt; "/etc/ssh/sshd_config"
fi
# Clean up after ourselves.
rm "/etc/ssh/sshd_config.bak"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sshd_set_max_auth_tries" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: XCCDF Value sshd_max_auth_tries_value # promote to variable
  set_fact:
    sshd_max_auth_tries_value: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_sshd_max_auth_tries_value" use="legacy"/>
  tags:
    - always

- name: Set SSH authentication attempt limit
  block:

    - name: Check for duplicate values
      lineinfile:
        path: /etc/ssh/sshd_config
        create: false
        regexp: (?i)^\s*MaxAuthTries\s+
        state: absent
      check_mode: true
      changed_when: false
      register: dupes

    - name: Deduplicate values from /etc/ssh/sshd_config
      lineinfile:
        path: /etc/ssh/sshd_config
        create: false
        regexp: (?i)^\s*MaxAuthTries\s+
        state: absent
      when: dupes.found is defined and dupes.found &gt; 1

    - name: Insert correct line to /etc/ssh/sshd_config
      lineinfile:
        path: /etc/ssh/sshd_config
        create: true
        regexp: (?i)^\s*MaxAuthTries\s+
        line: MaxAuthTries {{ sshd_max_auth_tries_value }}
        state: present
        insertbefore: ^[#\s]*Match
        validate: /usr/sbin/sshd -t -f %s
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sshd_set_max_auth_tries
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export export-name="oval:ssg-sshd_max_auth_tries_value:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_max_auth_tries_value"/>
            <check-content-ref name="oval:ssg-sshd_set_max_auth_tries:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-sshd_set_max_auth_tries_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_sshd_set_loglevel_info" selected="false" role="full" severity="low">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Set LogLevel to INFO</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The INFO parameter specifices that record login and logout activity will be logged.
To specify the log level in
SSH, add or correct the following line in the <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/ssh/sshd_config</html:code> file:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">LogLevel INFO</html:pre></description>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">SSH provides several logging levels with varying amounts of verbosity. <html:code xmlns:html="http://www.w3.org/1999/xhtml">DEBUG</html:code> is specifically
not recommended other than strictly for debugging SSH communications since it provides
so much data that it is difficult to identify important security information. <html:code xmlns:html="http://www.w3.org/1999/xhtml">INFO</html:code> level is the
basic level that only records login activity of SSH users. In many situations, such as Incident
Response, it is important to determine when a particular user was active on a system. The
logout record can eliminate those users who disconnected, which helps narrow the field.</rationale>
          <platform idref="cpe:/a:machine"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sshd_set_loglevel_info" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="restrict"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

if [ -e "/etc/ssh/sshd_config" ] ; then
    LC_ALL=C sed -i "/^\s*LogLevel\s\+/Id" "/etc/ssh/sshd_config"
else
    touch "/etc/ssh/sshd_config"
fi
cp "/etc/ssh/sshd_config" "/etc/ssh/sshd_config.bak"
# Insert before the line matching the regex '^Match'.
line_number="$(LC_ALL=C grep -n "^Match" "/etc/ssh/sshd_config.bak" | LC_ALL=C sed 's/:.*//g')"
if [ -z "$line_number" ]; then
    # There was no match of '^Match', insert at
    # the end of the file.
    printf '%s\n' "LogLevel INFO" &gt;&gt; "/etc/ssh/sshd_config"
else
    head -n "$(( line_number - 1 ))" "/etc/ssh/sshd_config.bak" &gt; "/etc/ssh/sshd_config"
    printf '%s\n' "LogLevel INFO" &gt;&gt; "/etc/ssh/sshd_config"
    tail -n "+$(( line_number ))" "/etc/ssh/sshd_config.bak" &gt;&gt; "/etc/ssh/sshd_config"
fi
# Clean up after ourselves.
rm "/etc/ssh/sshd_config.bak"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sshd_set_loglevel_info" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Set LogLevel to INFO
  block:

    - name: Check for duplicate values
      lineinfile:
        path: /etc/ssh/sshd_config
        create: false
        regexp: (?i)^\s*LogLevel\s+
        state: absent
      check_mode: true
      changed_when: false
      register: dupes

    - name: Deduplicate values from /etc/ssh/sshd_config
      lineinfile:
        path: /etc/ssh/sshd_config
        create: false
        regexp: (?i)^\s*LogLevel\s+
        state: absent
      when: dupes.found is defined and dupes.found &gt; 1

    - name: Insert correct line to /etc/ssh/sshd_config
      lineinfile:
        path: /etc/ssh/sshd_config
        create: true
        regexp: (?i)^\s*LogLevel\s+
        line: LogLevel INFO
        state: present
        insertbefore: ^[#\s]*Match
        validate: /usr/sbin/sshd -t -f %s
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-17(a)
    - NIST-800-53-CM-6(a)
    - low_complexity
    - low_disruption
    - low_severity
    - no_reboot_needed
    - restrict_strategy
    - sshd_set_loglevel_info
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export export-name="oval:ssg-sshd_required:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_required"/>
            <check-content-ref name="oval:ssg-sshd_set_loglevel_info:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-sshd_set_loglevel_info_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_sshd_disable_x11_forwarding" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable X11 Forwarding</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The X11Forwarding parameter provides the ability to tunnel X11 traffic
through the connection to enable remote graphic connections.
SSH has the capability to encrypt remote X11 connections when SSH's
<html:code xmlns:html="http://www.w3.org/1999/xhtml">X11Forwarding</html:code> option is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
To disable X11 Forwarding, add or correct the
following line in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/ssh/sshd_config</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">X11Forwarding no</html:pre></description>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(b)</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable X11 forwarding unless there is an operational requirement to use X11
applications directly. There is a small risk that the remote X11 servers of
users who are logged in via SSH with X11 forwarding could be compromised by
other users on the X11 server. Note that even if X11 forwarding is disabled,
users can always install their own forwarders.</rationale>
          <platform idref="cpe:/a:machine"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sshd_disable_x11_forwarding" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="restrict"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

if [ -e "/etc/ssh/sshd_config" ] ; then
    LC_ALL=C sed -i "/^\s*X11Forwarding\s\+/Id" "/etc/ssh/sshd_config"
else
    touch "/etc/ssh/sshd_config"
fi
cp "/etc/ssh/sshd_config" "/etc/ssh/sshd_config.bak"
# Insert before the line matching the regex '^Match'.
line_number="$(LC_ALL=C grep -n "^Match" "/etc/ssh/sshd_config.bak" | LC_ALL=C sed 's/:.*//g')"
if [ -z "$line_number" ]; then
    # There was no match of '^Match', insert at
    # the end of the file.
    printf '%s\n' "X11Forwarding no" &gt;&gt; "/etc/ssh/sshd_config"
else
    head -n "$(( line_number - 1 ))" "/etc/ssh/sshd_config.bak" &gt; "/etc/ssh/sshd_config"
    printf '%s\n' "X11Forwarding no" &gt;&gt; "/etc/ssh/sshd_config"
    tail -n "+$(( line_number ))" "/etc/ssh/sshd_config.bak" &gt;&gt; "/etc/ssh/sshd_config"
fi
# Clean up after ourselves.
rm "/etc/ssh/sshd_config.bak"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sshd_disable_x11_forwarding" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Disable X11 Forwarding
  block:

    - name: Check for duplicate values
      lineinfile:
        path: /etc/ssh/sshd_config
        create: false
        regexp: (?i)^\s*X11Forwarding\s+
        state: absent
      check_mode: true
      changed_when: false
      register: dupes

    - name: Deduplicate values from /etc/ssh/sshd_config
      lineinfile:
        path: /etc/ssh/sshd_config
        create: false
        regexp: (?i)^\s*X11Forwarding\s+
        state: absent
      when: dupes.found is defined and dupes.found &gt; 1

    - name: Insert correct line to /etc/ssh/sshd_config
      lineinfile:
        path: /etc/ssh/sshd_config
        create: true
        regexp: (?i)^\s*X11Forwarding\s+
        line: X11Forwarding no
        state: present
        insertbefore: ^[#\s]*Match
        validate: /usr/sbin/sshd -t -f %s
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-CM-6(b)
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sshd_disable_x11_forwarding
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export export-name="oval:ssg-sshd_required:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_required"/>
            <check-content-ref name="oval:ssg-sshd_disable_x11_forwarding:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-sshd_disable_x11_forwarding_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_sshd_disable_root_password_login" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable SSH root Login with a Password (Insecure)</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To disable password-based root logins over SSH, add or correct the following
line in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/ssh/sshd_config</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">PermitRootLogin prohibit-password</html:pre></description>
          <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">While this disables password-based root logins, direct root logins
through other means such as through SSH keys or GSSAPI will still be
permitted. Permitting any sort of root login remotely opens up the
root account to attack.
To fully disable direct root logins over SSH (which is considered a
best practice) and prevent remote attacks against the root account,
see CCE-27100-7, CCE-27445-6, CCE-80901-2, and similar.</warning>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Even though the communications channel may be encrypted, an additional
layer of security is gained by preventing use of a password.
This also helps to minimize direct attack attempts on root's password.</rationale>
          <platform idref="cpe:/a:machine"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sshd_disable_root_password_login" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="restrict"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

if [ -e "/etc/ssh/sshd_config" ] ; then
    LC_ALL=C sed -i "/^\s*PermitRootLogin\s\+/Id" "/etc/ssh/sshd_config"
else
    touch "/etc/ssh/sshd_config"
fi
cp "/etc/ssh/sshd_config" "/etc/ssh/sshd_config.bak"
# Insert before the line matching the regex '^Match'.
line_number="$(LC_ALL=C grep -n "^Match" "/etc/ssh/sshd_config.bak" | LC_ALL=C sed 's/:.*//g')"
if [ -z "$line_number" ]; then
    # There was no match of '^Match', insert at
    # the end of the file.
    printf '%s\n' "PermitRootLogin prohibit-password" &gt;&gt; "/etc/ssh/sshd_config"
else
    head -n "$(( line_number - 1 ))" "/etc/ssh/sshd_config.bak" &gt; "/etc/ssh/sshd_config"
    printf '%s\n' "PermitRootLogin prohibit-password" &gt;&gt; "/etc/ssh/sshd_config"
    tail -n "+$(( line_number ))" "/etc/ssh/sshd_config.bak" &gt;&gt; "/etc/ssh/sshd_config"
fi
# Clean up after ourselves.
rm "/etc/ssh/sshd_config.bak"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sshd_disable_root_password_login" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Disable SSH root Login with a Password (Insecure)
  block:

    - name: Check for duplicate values
      lineinfile:
        path: /etc/ssh/sshd_config
        create: false
        regexp: (?i)^\s*PermitRootLogin\s+
        state: absent
      check_mode: true
      changed_when: false
      register: dupes

    - name: Deduplicate values from /etc/ssh/sshd_config
      lineinfile:
        path: /etc/ssh/sshd_config
        create: false
        regexp: (?i)^\s*PermitRootLogin\s+
        state: absent
      when: dupes.found is defined and dupes.found &gt; 1

    - name: Insert correct line to /etc/ssh/sshd_config
      lineinfile:
        path: /etc/ssh/sshd_config
        create: true
        regexp: (?i)^\s*PermitRootLogin\s+
        line: PermitRootLogin prohibit-password
        state: present
        insertbefore: ^[#\s]*Match
        validate: /usr/sbin/sshd -t -f %s
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sshd_disable_root_password_login
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export export-name="oval:ssg-sshd_required:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_required"/>
            <check-content-ref name="oval:ssg-sshd_disable_root_password_login:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-sshd_disable_root_password_login_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_sshd_disable_root_login" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable SSH Root Login</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The root user should never be allowed to login to a
system directly over a network.
To disable root login via SSH, add or correct the following line
in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/ssh/sshd_config</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">PermitRootLogin no</html:pre></description>
          <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.6</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.1</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.5</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-000770</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(4)(i)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(1)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(3)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(1)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(2)(ii)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(2)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-2</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-2(5)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
          <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FIA_UAU.1</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000109-GPOS-00056</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
          <reference href="">SRG-OS-000480-VMM-002000</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.11</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.12</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.2.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.10</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.06</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.10</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.10.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.11.1.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.11.1.5</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.11.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.1.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.2.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.18.1.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.6.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.7.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.7.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.7.3.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.8.2.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.8.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.6</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.3.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.5</reference>
          <reference href="https://www.cisecurity.org/controls/">1</reference>
          <reference href="https://www.cisecurity.org/controls/">11</reference>
          <reference href="https://www.cisecurity.org/controls/">12</reference>
          <reference href="https://www.cisecurity.org/controls/">13</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">16</reference>
          <reference href="https://www.cisecurity.org/controls/">18</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">5</reference>
          <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R19)</reference>
          <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">NT007(R21)</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Even though the communications channel may be encrypted, an additional layer of
security is gained by extending the policy of not logging directly on as root.
In addition, logging in with a user-specific account provides individual
accountability of actions performed on the system and also helps to minimize
direct attack attempts on root's password.</rationale>
          <platform idref="cpe:/a:machine"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sshd_disable_root_login" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="restrict"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

if [ -e "/etc/ssh/sshd_config" ] ; then
    LC_ALL=C sed -i "/^\s*PermitRootLogin\s\+/Id" "/etc/ssh/sshd_config"
else
    touch "/etc/ssh/sshd_config"
fi
cp "/etc/ssh/sshd_config" "/etc/ssh/sshd_config.bak"
# Insert before the line matching the regex '^Match'.
line_number="$(LC_ALL=C grep -n "^Match" "/etc/ssh/sshd_config.bak" | LC_ALL=C sed 's/:.*//g')"
if [ -z "$line_number" ]; then
    # There was no match of '^Match', insert at
    # the end of the file.
    printf '%s\n' "PermitRootLogin no" &gt;&gt; "/etc/ssh/sshd_config"
else
    head -n "$(( line_number - 1 ))" "/etc/ssh/sshd_config.bak" &gt; "/etc/ssh/sshd_config"
    printf '%s\n' "PermitRootLogin no" &gt;&gt; "/etc/ssh/sshd_config"
    tail -n "+$(( line_number ))" "/etc/ssh/sshd_config.bak" &gt;&gt; "/etc/ssh/sshd_config"
fi
# Clean up after ourselves.
rm "/etc/ssh/sshd_config.bak"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sshd_disable_root_login" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Disable SSH Root Login
  block:

    - name: Check for duplicate values
      lineinfile:
        path: /etc/ssh/sshd_config
        create: false
        regexp: (?i)^\s*PermitRootLogin\s+
        state: absent
      check_mode: true
      changed_when: false
      register: dupes

    - name: Deduplicate values from /etc/ssh/sshd_config
      lineinfile:
        path: /etc/ssh/sshd_config
        create: false
        regexp: (?i)^\s*PermitRootLogin\s+
        state: absent
      when: dupes.found is defined and dupes.found &gt; 1

    - name: Insert correct line to /etc/ssh/sshd_config
      lineinfile:
        path: /etc/ssh/sshd_config
        create: true
        regexp: (?i)^\s*PermitRootLogin\s+
        line: PermitRootLogin no
        state: present
        insertbefore: ^[#\s]*Match
        validate: /usr/sbin/sshd -t -f %s
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.5.6
    - NIST-800-171-3.1.1
    - NIST-800-171-3.1.5
    - NIST-800-53-
    - NIST-800-53-AC-17(a)
    - NIST-800-53-AC-6(2)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-IA-2
    - NIST-800-53-IA-2(5)
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sshd_disable_root_login
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export export-name="oval:ssg-sshd_required:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_required"/>
            <check-content-ref name="oval:ssg-sshd_disable_root_login:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-sshd_disable_root_login_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_sshd_limit_user_access" selected="false" role="full" severity="unknown">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Limit Users' SSH Access</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">By default, the SSH configuration allows any user with an account
to access the system. In order to specify the users that are allowed to login
via SSH and deny all other users, add or correct the following line in the
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/ssh/sshd_config</html:code> file:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">AllowUsers USER1 USER2</html:pre>
Where <html:code xmlns:html="http://www.w3.org/1999/xhtml">USER1</html:code> and <html:code xmlns:html="http://www.w3.org/1999/xhtml">USER2</html:code> are valid user names.</description>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.12</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-3</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.11</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.12</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.2.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.06</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.6.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.7.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.5</reference>
          <reference href="https://www.cisecurity.org/controls/">11</reference>
          <reference href="https://www.cisecurity.org/controls/">12</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">16</reference>
          <reference href="https://www.cisecurity.org/controls/">18</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">5</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Specifying which accounts are allowed SSH access into the system reduces the
possibility of unauthorized access to the system.</rationale>
          <platform idref="cpe:/a:machine"/>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-sshd_limit_user_access_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_sshd_disable_tcp_forwarding" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable SSH TCP Forwarding</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">AllowTcpForwarding</html:code> parameter specifies whether TCP forwarding is permitted.
To disable TCP forwarding, add or correct the
following line in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/ssh/sshd_config</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">AllowTcpForwarding no</html:pre></description>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Leaving port forwarding enabled can expose the organization to security risks and back-doors.</rationale>
          <platform idref="cpe:/a:machine"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sshd_disable_tcp_forwarding" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="restrict"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

if [ -e "/etc/ssh/sshd_config" ] ; then
    LC_ALL=C sed -i "/^\s*AllowTcpForwarding\s\+/Id" "/etc/ssh/sshd_config"
else
    touch "/etc/ssh/sshd_config"
fi
cp "/etc/ssh/sshd_config" "/etc/ssh/sshd_config.bak"
# Insert before the line matching the regex '^Match'.
line_number="$(LC_ALL=C grep -n "^Match" "/etc/ssh/sshd_config.bak" | LC_ALL=C sed 's/:.*//g')"
if [ -z "$line_number" ]; then
    # There was no match of '^Match', insert at
    # the end of the file.
    printf '%s\n' "AllowTcpForwarding no" &gt;&gt; "/etc/ssh/sshd_config"
else
    head -n "$(( line_number - 1 ))" "/etc/ssh/sshd_config.bak" &gt; "/etc/ssh/sshd_config"
    printf '%s\n' "AllowTcpForwarding no" &gt;&gt; "/etc/ssh/sshd_config"
    tail -n "+$(( line_number ))" "/etc/ssh/sshd_config.bak" &gt;&gt; "/etc/ssh/sshd_config"
fi
# Clean up after ourselves.
rm "/etc/ssh/sshd_config.bak"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sshd_disable_tcp_forwarding" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Disable SSH TCP Forwarding
  block:

    - name: Check for duplicate values
      lineinfile:
        path: /etc/ssh/sshd_config
        create: false
        regexp: (?i)^\s*AllowTcpForwarding\s+
        state: absent
      check_mode: true
      changed_when: false
      register: dupes

    - name: Deduplicate values from /etc/ssh/sshd_config
      lineinfile:
        path: /etc/ssh/sshd_config
        create: false
        regexp: (?i)^\s*AllowTcpForwarding\s+
        state: absent
      when: dupes.found is defined and dupes.found &gt; 1

    - name: Insert correct line to /etc/ssh/sshd_config
      lineinfile:
        path: /etc/ssh/sshd_config
        create: true
        regexp: (?i)^\s*AllowTcpForwarding\s+
        line: AllowTcpForwarding no
        state: present
        insertbefore: ^[#\s]*Match
        validate: /usr/sbin/sshd -t -f %s
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sshd_disable_tcp_forwarding
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export export-name="oval:ssg-sshd_required:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_required"/>
            <check-content-ref name="oval:ssg-sshd_disable_tcp_forwarding:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-sshd_disable_tcp_forwarding_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_disable_host_auth" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable Host-Based Authentication</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">SSH's cryptographic host-based authentication is
more secure than <html:code xmlns:html="http://www.w3.org/1999/xhtml">.rhosts</html:code> authentication. However, it is
not recommended that hosts unilaterally trust one another, even
within an organization.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
To disable host-based authentication, add or correct the
following line in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/ssh/sshd_config</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">HostbasedAuthentication no</html:pre></description>
          <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.6</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.12</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(4)(i)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(1)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(3)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(1)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(2)(ii)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-3</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
          <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FIA_UAU.1</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00229</reference>
          <reference href="">SRG-OS-000480-VMM-002000</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.11</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.12</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.2.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.3</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.06</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.5.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.6.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.2.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.2.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.6.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.7.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.5</reference>
          <reference href="https://www.cisecurity.org/controls/">11</reference>
          <reference href="https://www.cisecurity.org/controls/">12</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">16</reference>
          <reference href="https://www.cisecurity.org/controls/">18</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">5</reference>
          <reference href="https://www.cisecurity.org/controls/">9</reference>
          <reference href="">0421</reference>
          <reference href="">0422</reference>
          <reference href="">0431</reference>
          <reference href="">0974</reference>
          <reference href="">1173</reference>
          <reference href="">1401</reference>
          <reference href="">1504</reference>
          <reference href="">1505</reference>
          <reference href="">1546</reference>
          <reference href="">1557</reference>
          <reference href="">1558</reference>
          <reference href="">1559</reference>
          <reference href="">1560</reference>
          <reference href="">1561</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">SSH trust relationships mean a compromise on one host
can allow an attacker to move trivially to other hosts.</rationale>
          <platform idref="cpe:/a:machine"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="disable_host_auth" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="restrict"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

if [ -e "/etc/ssh/sshd_config" ] ; then
    LC_ALL=C sed -i "/^\s*HostbasedAuthentication\s\+/Id" "/etc/ssh/sshd_config"
else
    touch "/etc/ssh/sshd_config"
fi
cp "/etc/ssh/sshd_config" "/etc/ssh/sshd_config.bak"
# Insert before the line matching the regex '^Match'.
line_number="$(LC_ALL=C grep -n "^Match" "/etc/ssh/sshd_config.bak" | LC_ALL=C sed 's/:.*//g')"
if [ -z "$line_number" ]; then
    # There was no match of '^Match', insert at
    # the end of the file.
    printf '%s\n' "HostbasedAuthentication no" &gt;&gt; "/etc/ssh/sshd_config"
else
    head -n "$(( line_number - 1 ))" "/etc/ssh/sshd_config.bak" &gt; "/etc/ssh/sshd_config"
    printf '%s\n' "HostbasedAuthentication no" &gt;&gt; "/etc/ssh/sshd_config"
    tail -n "+$(( line_number ))" "/etc/ssh/sshd_config.bak" &gt;&gt; "/etc/ssh/sshd_config"
fi
# Clean up after ourselves.
rm "/etc/ssh/sshd_config.bak"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="disable_host_auth" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Disable Host-Based Authentication
  block:

    - name: Check for duplicate values
      lineinfile:
        path: /etc/ssh/sshd_config
        create: false
        regexp: (?i)^\s*HostbasedAuthentication\s+
        state: absent
      check_mode: true
      changed_when: false
      register: dupes

    - name: Deduplicate values from /etc/ssh/sshd_config
      lineinfile:
        path: /etc/ssh/sshd_config
        create: false
        regexp: (?i)^\s*HostbasedAuthentication\s+
        state: absent
      when: dupes.found is defined and dupes.found &gt; 1

    - name: Insert correct line to /etc/ssh/sshd_config
      lineinfile:
        path: /etc/ssh/sshd_config
        create: true
        regexp: (?i)^\s*HostbasedAuthentication\s+
        line: HostbasedAuthentication no
        state: present
        insertbefore: ^[#\s]*Match
        validate: /usr/sbin/sshd -t -f %s
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.5.6
    - NIST-800-171-3.1.12
    - NIST-800-53-AC-17(a)
    - NIST-800-53-AC-3
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - disable_host_auth
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="disable_host_auth" system="urn:xccdf:fix:script:kubernetes">apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,%23%09%24OpenBSD%3A%20sshd_config%2Cv%201.103%202018%2F04%2F09%2020%3A41%3A22%20tj%20Exp%20%24%0A%0A%23%20This%20is%20the%20sshd%20server%20system-wide%20configuration%20file.%20%20See%0A%23%20sshd_config%285%29%20for%20more%20information.%0A%0A%23%20This%20sshd%20was%20compiled%20with%20PATH%3D%2Fusr%2Flocal%2Fbin%3A%2Fusr%2Fbin%3A%2Fusr%2Flocal%2Fsbin%3A%2Fusr%2Fsbin%0A%0A%23%20The%20strategy%20used%20for%20options%20in%20the%20default%20sshd_config%20shipped%20with%0A%23%20OpenSSH%20is%20to%20specify%20options%20with%20their%20default%20value%20where%0A%23%20possible%2C%20but%20leave%20them%20commented.%20%20Uncommented%20options%20override%20the%0A%23%20default%20value.%0A%0A%23%20If%20you%20want%20to%20change%20the%20port%20on%20a%20SELinux%20system%2C%20you%20have%20to%20tell%0A%23%20SELinux%20about%20this%20change.%0A%23%20semanage%20port%20-a%20-t%20ssh_port_t%20-p%20tcp%20%23PORTNUMBER%0A%23%0A%23Port%2022%0A%23AddressFamily%20any%0A%23ListenAddress%200.0.0.0%0A%23ListenAddress%20%3A%3A%0A%0AHostKey%20%2Fetc%2Fssh%2Fssh_host_rsa_key%0AHostKey%20%2Fetc%2Fssh%2Fssh_host_ecdsa_key%0AHostKey%20%2Fetc%2Fssh%2Fssh_host_ed25519_key%0A%0A%23%20Ciphers%20and%20keying%0ARekeyLimit%20512M%201h%0A%0A%23%20System-wide%20Crypto%20policy%3A%0A%23%20This%20system%20is%20following%20system-wide%20crypto%20policy.%20The%20changes%20to%0A%23%20Ciphers%2C%20MACs%2C%20KexAlgoritms%20and%20GSSAPIKexAlgorithsm%20will%20not%20have%20any%0A%23%20effect%20here.%20They%20will%20be%20overridden%20by%20command-line%20options%20passed%20on%0A%23%20the%20server%20start%20up.%0A%23%20To%20opt%20out%2C%20uncomment%20a%20line%20with%20redefinition%20of%20%20CRYPTO_POLICY%3D%0A%23%20variable%20in%20%20%2Fetc%2Fsysconfig%2Fsshd%20%20to%20overwrite%20the%20policy.%0A%23%20For%20more%20information%2C%20see%20manual%20page%20for%20update-crypto-policies%288%29.%0A%0A%23%20Logging%0A%23SyslogFacility%20AUTH%0ASyslogFacility%20AUTHPRIV%0A%23LogLevel%20INFO%0A%0A%23%20Authentication%3A%0A%0A%23LoginGraceTime%202m%0APermitRootLogin%20no%0AStrictModes%20yes%0A%23MaxAuthTries%206%0A%23MaxSessions%2010%0A%0APubkeyAuthentication%20yes%0A%0A%23%20The%20default%20is%20to%20check%20both%20.ssh%2Fauthorized_keys%20and%20.ssh%2Fauthorized_keys2%0A%23%20but%20this%20is%20overridden%20so%20installations%20will%20only%20check%20.ssh%2Fauthorized_keys%0AAuthorizedKeysFile%09.ssh%2Fauthorized_keys%0A%0A%23AuthorizedPrincipalsFile%20none%0A%0A%23AuthorizedKeysCommand%20none%0A%23AuthorizedKeysCommandUser%20nobody%0A%0A%23%20For%20this%20to%20work%20you%20will%20also%20need%20host%20keys%20in%20%2Fetc%2Fssh%2Fssh_known_hosts%0AHostbasedAuthentication%20no%0A%23%20Change%20to%20yes%20if%20you%20don%27t%20trust%20~%2F.ssh%2Fknown_hosts%20for%0A%23%20HostbasedAuthentication%0AIgnoreUserKnownHosts%20yes%0A%23%20Don%27t%20read%20the%20user%27s%20~%2F.rhosts%20and%20~%2F.shosts%20files%0AIgnoreRhosts%20yes%0A%0A%23%20To%20disable%20tunneled%20clear%20text%20passwords%2C%20change%20to%20no%20here%21%0A%23PasswordAuthentication%20yes%0APermitEmptyPasswords%20no%0APasswordAuthentication%20no%0A%0A%23%20Change%20to%20no%20to%20disable%20s%2Fkey%20passwords%0A%23ChallengeResponseAuthentication%20yes%0AChallengeResponseAuthentication%20no%0A%0A%23%20Kerberos%20options%0AKerberosAuthentication%20no%0A%23KerberosOrLocalPasswd%20yes%0A%23KerberosTicketCleanup%20yes%0A%23KerberosGetAFSToken%20no%0A%23KerberosUseKuserok%20yes%0A%0A%23%20GSSAPI%20options%0AGSSAPIAuthentication%20no%0AGSSAPICleanupCredentials%20no%0A%23GSSAPIStrictAcceptorCheck%20yes%0A%23GSSAPIKeyExchange%20no%0A%23GSSAPIEnablek5users%20no%0A%0A%23%20Set%20this%20to%20%27yes%27%20to%20enable%20PAM%20authentication%2C%20account%20processing%2C%0A%23%20and%20session%20processing.%20If%20this%20is%20enabled%2C%20PAM%20authentication%20will%0A%23%20be%20allowed%20through%20the%20ChallengeResponseAuthentication%20and%0A%23%20PasswordAuthentication.%20%20Depending%20on%20your%20PAM%20configuration%2C%0A%23%20PAM%20authentication%20via%20ChallengeResponseAuthentication%20may%20bypass%0A%23%20the%20setting%20of%20%22PermitRootLogin%20without-password%22.%0A%23%20If%20you%20just%20want%20the%20PAM%20account%20and%20session%20checks%20to%20run%20without%0A%23%20PAM%20authentication%2C%20then%20enable%20this%20but%20set%20PasswordAuthentication%0A%23%20and%20ChallengeResponseAuthentication%20to%20%27no%27.%0A%23%20WARNING%3A%20%27UsePAM%20no%27%20is%20not%20supported%20in%20Fedora%20and%20may%20cause%20several%0A%23%20problems.%0AUsePAM%20yes%0A%0A%23AllowAgentForwarding%20yes%0A%23AllowTcpForwarding%20yes%0A%23GatewayPorts%20no%0AX11Forwarding%20yes%0A%23X11DisplayOffset%2010%0A%23X11UseLocalhost%20yes%0A%23PermitTTY%20yes%0A%0A%23%20It%20is%20recommended%20to%20use%20pam_motd%20in%20%2Fetc%2Fpam.d%2Fsshd%20instead%20of%20PrintMotd%2C%0A%23%20as%20it%20is%20more%20configurable%20and%20versatile%20than%20the%20built-in%20version.%0APrintMotd%20no%0A%0APrintLastLog%20yes%0A%23TCPKeepAlive%20yes%0APermitUserEnvironment%20no%0ACompression%20no%0AClientAliveInterval%20600%0AClientAliveCountMax%200%0A%23UseDNS%20no%0A%23PidFile%20%2Fvar%2Frun%2Fsshd.pid%0A%23MaxStartups%2010%3A30%3A100%0A%23PermitTunnel%20no%0A%23ChrootDirectory%20none%0A%23VersionAddendum%20none%0A%0A%23%20no%20default%20banner%20path%0ABanner%20%2Fetc%2Fissue%0A%0A%23%20Accept%20locale-related%20environment%20variables%0AAcceptEnv%20LANG%20LC_CTYPE%20LC_NUMERIC%20LC_TIME%20LC_COLLATE%20LC_MONETARY%20LC_MESSAGES%0AAcceptEnv%20LC_PAPER%20LC_NAME%20LC_ADDRESS%20LC_TELEPHONE%20LC_MEASUREMENT%0AAcceptEnv%20LC_IDENTIFICATION%20LC_ALL%20LANGUAGE%0AAcceptEnv%20XMODIFIERS%0A%0A%23%20override%20default%20of%20no%20subsystems%0ASubsystem%09sftp%09%2Fusr%2Flibexec%2Fopenssh%2Fsftp-server%0A%0A%23%20Example%20of%20overriding%20settings%20on%20a%20per-user%20basis%0A%23Match%20User%20anoncvs%0A%23%09X11Forwarding%20no%0A%23%09AllowTcpForwarding%20no%0A%23%09PermitTTY%20no%0A%23%09ForceCommand%20cvs%20server%0A%0AUsePrivilegeSeparation%20sandbox
        mode: 0600
        path: /etc/ssh/sshd_config
        overwrite: true
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export export-name="oval:ssg-sshd_required:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_required"/>
            <check-content-ref name="oval:ssg-disable_host_auth:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-disable_host_auth_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_sshd_allow_only_protocol2" selected="false" role="full" severity="high">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Allow Only SSH Protocol 2</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Only SSH protocol version 2 connections should be
permitted. The default setting in
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/ssh/sshd_config</html:code> is correct, and can be
verified by ensuring that the following
line appears:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">Protocol 2</html:pre></description>
          <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">As of <html:code xmlns:html="http://www.w3.org/1999/xhtml">openssh-server</html:code> version <html:code xmlns:html="http://www.w3.org/1999/xhtml">7.4</html:code> and above, the only protocol
supported is version 2, and line <html:pre xmlns:html="http://www.w3.org/1999/xhtml">Protocol 2</html:pre> in
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/ssh/sshd_config</html:code> is not necessary.</warning>
          <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">NT007(R1)</reference>
          <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.6</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.13</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.5.4</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-000197</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(4)(i)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(1)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(3)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(1)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(2)(ii)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(2)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(1)(c)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-13</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">MA-4(6)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000074-GPOS-00042</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
          <reference href="">SRG-OS-000033-VMM-000140</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.2.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS01.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.10</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.10</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.11.2.6</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.18.1.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.6.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.6.2.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.7.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.6</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.3.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.3</reference>
          <reference href="https://www.cisecurity.org/controls/">1</reference>
          <reference href="https://www.cisecurity.org/controls/">12</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">16</reference>
          <reference href="https://www.cisecurity.org/controls/">5</reference>
          <reference href="https://www.cisecurity.org/controls/">8</reference>
          <reference href="">0487</reference>
          <reference href="">1449</reference>
          <reference href="">1506</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">SSH protocol version 1 is an insecure implementation of the SSH protocol and
has many well-known vulnerability exploits. Exploits of the SSH daemon could provide
immediate root access to the system.</rationale>
          <platform idref="cpe:/a:machine"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sshd_allow_only_protocol2" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Allow Only SSH Protocol 2
  block:

    - name: Check for duplicate values
      lineinfile:
        path: /etc/ssh/sshd_config
        create: false
        regexp: (?i)^\s*Protocol\s+
        state: absent
      check_mode: true
      changed_when: false
      register: dupes

    - name: Deduplicate values from /etc/ssh/sshd_config
      lineinfile:
        path: /etc/ssh/sshd_config
        create: false
        regexp: (?i)^\s*Protocol\s+
        state: absent
      when: dupes.found is defined and dupes.found &gt; 1

    - name: Insert correct line to /etc/ssh/sshd_config
      lineinfile:
        path: /etc/ssh/sshd_config
        create: true
        regexp: (?i)^\s*Protocol\s+
        line: Protocol 2
        state: present
        insertbefore: ^[#\s]*Match
        validate: /usr/sbin/sshd -t -f %s
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.5.6
    - NIST-800-171-3.1.13
    - NIST-800-171-3.5.4
    - NIST-800-53-AC-17(2)
    - NIST-800-53-AC-17(a)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(1)(c)
    - NIST-800-53-MA-4(6)
    - NIST-800-53-SC-13
    - high_severity
    - low_complexity
    - low_disruption
    - no_reboot_needed
    - restrict_strategy
    - sshd_allow_only_protocol2
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export export-name="oval:ssg-sshd_required:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_required"/>
            <check-content-ref name="oval:ssg-sshd_allow_only_protocol2:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-sshd_allow_only_protocol2_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_sshd_enable_warning_banner" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Enable SSH Warning Banner</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To enable the warning banner and ensure it is consistent
across the system, add or correct the following line in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/ssh/sshd_config</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">Banner /etc/issue</html:pre>
Another section contains information on how to create an
appropriate system-wide warning banner.</description>
          <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.6</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.9</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-000048</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-000050</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-001384</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-001385</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-001386</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-001387</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-001388</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(4)(i)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(1)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(3)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(1)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(2)(ii)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-8(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-8(c)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</reference>
          <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FTA_TAB.1</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000023-GPOS-00006</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000024-GPOS-00007</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000228-GPOS-00088</reference>
          <reference href="">SRG-OS-000023-VMM-000060</reference>
          <reference href="">SRG-OS-000024-VMM-000070</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.10</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.10</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.18.1.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.3.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.3</reference>
          <reference href="https://www.cisecurity.org/controls/">1</reference>
          <reference href="https://www.cisecurity.org/controls/">12</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">16</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The warning message reinforces policy awareness during the logon process and
facilitates possible legal action against attackers. Alternatively, systems
whose ownership should not be obvious should ensure usage of a banner that does
not provide easy attribution.</rationale>
          <platform idref="cpe:/a:machine"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sshd_enable_warning_banner" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="restrict"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

if [ -e "/etc/ssh/sshd_config" ] ; then
    LC_ALL=C sed -i "/^\s*Banner\s\+/Id" "/etc/ssh/sshd_config"
else
    touch "/etc/ssh/sshd_config"
fi
cp "/etc/ssh/sshd_config" "/etc/ssh/sshd_config.bak"
# Insert before the line matching the regex '^Match'.
line_number="$(LC_ALL=C grep -n "^Match" "/etc/ssh/sshd_config.bak" | LC_ALL=C sed 's/:.*//g')"
if [ -z "$line_number" ]; then
    # There was no match of '^Match', insert at
    # the end of the file.
    printf '%s\n' "Banner /etc/issue" &gt;&gt; "/etc/ssh/sshd_config"
else
    head -n "$(( line_number - 1 ))" "/etc/ssh/sshd_config.bak" &gt; "/etc/ssh/sshd_config"
    printf '%s\n' "Banner /etc/issue" &gt;&gt; "/etc/ssh/sshd_config"
    tail -n "+$(( line_number ))" "/etc/ssh/sshd_config.bak" &gt;&gt; "/etc/ssh/sshd_config"
fi
# Clean up after ourselves.
rm "/etc/ssh/sshd_config.bak"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sshd_enable_warning_banner" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Enable SSH Warning Banner
  block:

    - name: Check for duplicate values
      lineinfile:
        path: /etc/ssh/sshd_config
        create: false
        regexp: (?i)^\s*Banner\s+
        state: absent
      check_mode: true
      changed_when: false
      register: dupes

    - name: Deduplicate values from /etc/ssh/sshd_config
      lineinfile:
        path: /etc/ssh/sshd_config
        create: false
        regexp: (?i)^\s*Banner\s+
        state: absent
      when: dupes.found is defined and dupes.found &gt; 1

    - name: Insert correct line to /etc/ssh/sshd_config
      lineinfile:
        path: /etc/ssh/sshd_config
        create: true
        regexp: (?i)^\s*Banner\s+
        line: Banner /etc/issue
        state: present
        insertbefore: ^[#\s]*Match
        validate: /usr/sbin/sshd -t -f %s
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.5.6
    - NIST-800-171-3.1.9
    - NIST-800-53-AC-17(a)
    - NIST-800-53-AC-8(a)
    - NIST-800-53-AC-8(c)
    - NIST-800-53-CM-6(a)
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sshd_enable_warning_banner
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export export-name="oval:ssg-sshd_required:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_required"/>
            <check-content-ref name="oval:ssg-sshd_enable_warning_banner:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-sshd_enable_warning_banner_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_sshd_disable_compression" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable Compression Or Set Compression to delayed</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Compression is useful for slow network connections over long
distances but can cause performance issues on local LANs. If use of compression
is required, it should be enabled only after a user has authenticated; otherwise,
it should be disabled. To disable compression or delay compression until after
a user has successfully authenticated, add or correct the following line in the
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/ssh/sshd_config</html:code> file:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml" xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2">Compression <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_sshd_disable_compression" use="legacy"/></html:pre></description>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.12</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(4)(i)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(1)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(3)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(1)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(2)(ii)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
          <reference href="">SRG-OS-000480-VMM-002000</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.3</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.5.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.6.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.2.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.2.4</reference>
          <reference href="https://www.cisecurity.org/controls/">11</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">9</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">If compression is allowed in an SSH connection prior to authentication,
vulnerabilities in the compression software could result in compromise of the
system from an unauthenticated connection, potentially with root privileges.</rationale>
          <platform idref="cpe:/a:machine"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sshd_disable_compression" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: XCCDF Value var_sshd_disable_compression # promote to variable
  set_fact:
    var_sshd_disable_compression: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_sshd_disable_compression" use="legacy"/>
  tags:
    - always

- name: Disable Compression Or Set Compression to delayed
  block:

    - name: Check for duplicate values
      lineinfile:
        path: /etc/ssh/sshd_config
        create: false
        regexp: (?i)^\s*Compression\s+
        state: absent
      check_mode: true
      changed_when: false
      register: dupes

    - name: Deduplicate values from /etc/ssh/sshd_config
      lineinfile:
        path: /etc/ssh/sshd_config
        create: false
        regexp: (?i)^\s*Compression\s+
        state: absent
      when: dupes.found is defined and dupes.found &gt; 1

    - name: Insert correct line to /etc/ssh/sshd_config
      lineinfile:
        path: /etc/ssh/sshd_config
        create: true
        regexp: (?i)^\s*Compression\s+
        line: Compression {{ var_sshd_disable_compression }}
        state: present
        insertbefore: ^[#\s]*Match
        validate: /usr/sbin/sshd -t -f %s
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.12
    - NIST-800-53-AC-17(a)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sshd_disable_compression
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export export-name="oval:ssg-sshd_required:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_required"/>
            <check-export export-name="oval:ssg-var_sshd_disable_compression:var:1" value-id="xccdf_org.ssgproject.content_value_var_sshd_disable_compression"/>
            <check-content-ref name="oval:ssg-sshd_disable_compression:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-sshd_disable_compression_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_sshd_x11_use_localhost" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Prevent remote hosts from connecting to the proxy display</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The SSH daemon should prevent remote hosts from connecting to the proxy
display. Make sure that the option <html:code xmlns:html="http://www.w3.org/1999/xhtml">X11UseLocalhost</html:code> is set to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">yes</html:code> within the SSH server configuration file.</description>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(b)</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">When X11 forwarding is enabled, there may be additional exposure to the
server and client displays if the sshd proxy display is configured to listen
on the wildcard address. By default, sshd binds the forwarding server to the
loopback address and sets the hostname part of the <html:code xmlns:html="http://www.w3.org/1999/xhtml">DISPLAY</html:code>
environment variable to localhost. This prevents remote hosts from
connecting to the proxy display.  </rationale>
          <platform idref="cpe:/a:machine"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sshd_x11_use_localhost" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="restrict"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

if [ -e "/etc/ssh/sshd_config" ] ; then
    LC_ALL=C sed -i "/^\s*X11UseLocalhost\s\+/Id" "/etc/ssh/sshd_config"
else
    touch "/etc/ssh/sshd_config"
fi
cp "/etc/ssh/sshd_config" "/etc/ssh/sshd_config.bak"
# Insert before the line matching the regex '^Match'.
line_number="$(LC_ALL=C grep -n "^Match" "/etc/ssh/sshd_config.bak" | LC_ALL=C sed 's/:.*//g')"
if [ -z "$line_number" ]; then
    # There was no match of '^Match', insert at
    # the end of the file.
    printf '%s\n' "X11UseLocalhost yes" &gt;&gt; "/etc/ssh/sshd_config"
else
    head -n "$(( line_number - 1 ))" "/etc/ssh/sshd_config.bak" &gt; "/etc/ssh/sshd_config"
    printf '%s\n' "X11UseLocalhost yes" &gt;&gt; "/etc/ssh/sshd_config"
    tail -n "+$(( line_number ))" "/etc/ssh/sshd_config.bak" &gt;&gt; "/etc/ssh/sshd_config"
fi
# Clean up after ourselves.
rm "/etc/ssh/sshd_config.bak"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sshd_x11_use_localhost" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Prevent remote hosts from connecting to the proxy display
  block:

    - name: Check for duplicate values
      lineinfile:
        path: /etc/ssh/sshd_config
        create: false
        regexp: (?i)^\s*X11UseLocalhost\s+
        state: absent
      check_mode: true
      changed_when: false
      register: dupes

    - name: Deduplicate values from /etc/ssh/sshd_config
      lineinfile:
        path: /etc/ssh/sshd_config
        create: false
        regexp: (?i)^\s*X11UseLocalhost\s+
        state: absent
      when: dupes.found is defined and dupes.found &gt; 1

    - name: Insert correct line to /etc/ssh/sshd_config
      lineinfile:
        path: /etc/ssh/sshd_config
        create: true
        regexp: (?i)^\s*X11UseLocalhost\s+
        line: X11UseLocalhost yes
        state: present
        insertbefore: ^[#\s]*Match
        validate: /usr/sbin/sshd -t -f %s
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-CM-6(b)
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sshd_x11_use_localhost
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export export-name="oval:ssg-sshd_required:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_required"/>
            <check-content-ref name="oval:ssg-sshd_x11_use_localhost:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-sshd_x11_use_localhost_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_sshd_enable_strictmodes" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Enable Use of Strict Mode Checking</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">SSHs <html:code xmlns:html="http://www.w3.org/1999/xhtml">StrictModes</html:code> option checks file and ownership permissions in
the user's home directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">.ssh</html:code> folder before accepting login. If world-
writable permissions are found, logon is rejected. To enable <html:code xmlns:html="http://www.w3.org/1999/xhtml">StrictModes</html:code> in SSH,
add or correct the following line in the <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/ssh/sshd_config</html:code> file:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">StrictModes yes</html:pre></description>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.12</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(4)(i)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(1)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(3)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(1)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(2)(ii)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
          <reference href="">SRG-OS-000480-VMM-002000</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.10.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.11.1.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.11.1.5</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.11.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.1.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.2.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.6.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.7.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.7.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.7.3.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.8.2.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.8.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.5</reference>
          <reference href="https://www.cisecurity.org/controls/">12</reference>
          <reference href="https://www.cisecurity.org/controls/">13</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">16</reference>
          <reference href="https://www.cisecurity.org/controls/">18</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">5</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">If other users have access to modify user-specific SSH configuration files, they
may be able to log into the system as another user.</rationale>
          <platform idref="cpe:/a:machine"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sshd_enable_strictmodes" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="restrict"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

if [ -e "/etc/ssh/sshd_config" ] ; then
    LC_ALL=C sed -i "/^\s*StrictModes\s\+/Id" "/etc/ssh/sshd_config"
else
    touch "/etc/ssh/sshd_config"
fi
cp "/etc/ssh/sshd_config" "/etc/ssh/sshd_config.bak"
# Insert before the line matching the regex '^Match'.
line_number="$(LC_ALL=C grep -n "^Match" "/etc/ssh/sshd_config.bak" | LC_ALL=C sed 's/:.*//g')"
if [ -z "$line_number" ]; then
    # There was no match of '^Match', insert at
    # the end of the file.
    printf '%s\n' "StrictModes yes" &gt;&gt; "/etc/ssh/sshd_config"
else
    head -n "$(( line_number - 1 ))" "/etc/ssh/sshd_config.bak" &gt; "/etc/ssh/sshd_config"
    printf '%s\n' "StrictModes yes" &gt;&gt; "/etc/ssh/sshd_config"
    tail -n "+$(( line_number ))" "/etc/ssh/sshd_config.bak" &gt;&gt; "/etc/ssh/sshd_config"
fi
# Clean up after ourselves.
rm "/etc/ssh/sshd_config.bak"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sshd_enable_strictmodes" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Enable Use of Strict Mode Checking
  block:

    - name: Check for duplicate values
      lineinfile:
        path: /etc/ssh/sshd_config
        create: false
        regexp: (?i)^\s*StrictModes\s+
        state: absent
      check_mode: true
      changed_when: false
      register: dupes

    - name: Deduplicate values from /etc/ssh/sshd_config
      lineinfile:
        path: /etc/ssh/sshd_config
        create: false
        regexp: (?i)^\s*StrictModes\s+
        state: absent
      when: dupes.found is defined and dupes.found &gt; 1

    - name: Insert correct line to /etc/ssh/sshd_config
      lineinfile:
        path: /etc/ssh/sshd_config
        create: true
        regexp: (?i)^\s*StrictModes\s+
        line: StrictModes yes
        state: present
        insertbefore: ^[#\s]*Match
        validate: /usr/sbin/sshd -t -f %s
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.12
    - NIST-800-53-AC-17(a)
    - NIST-800-53-AC-6
    - NIST-800-53-CM-6(a)
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sshd_enable_strictmodes
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export export-name="oval:ssg-sshd_required:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_required"/>
            <check-content-ref name="oval:ssg-sshd_enable_strictmodes:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-sshd_enable_strictmodes_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_sshd_disable_empty_passwords" selected="false" role="full" severity="high">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable SSH Access via Empty Passwords</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To explicitly disallow SSH login from accounts with
empty passwords, add or correct the following line in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/ssh/sshd_config</html:code>:
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">PermitEmptyPasswords no</html:pre>
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Any accounts with empty passwords should be disabled immediately, and PAM configuration
should prevent users from being able to assign themselves empty passwords.</description>
          <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">NT007(R17)</reference>
          <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.6</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.1</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.5</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-000766</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(4)(i)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(1)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(3)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(1)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(2)(ii)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
          <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FIA_UAU.1</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000106-GPOS-00053</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00229</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
          <reference href="">SRG-OS-000480-VMM-002000</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.11</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.12</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.2.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.3</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.06</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.10.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.11.1.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.11.1.5</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.11.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.5.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.6.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.1.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.2.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.2.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.2.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.6.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.7.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.7.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.7.3.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.8.2.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.8.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.5</reference>
          <reference href="https://www.cisecurity.org/controls/">11</reference>
          <reference href="https://www.cisecurity.org/controls/">12</reference>
          <reference href="https://www.cisecurity.org/controls/">13</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">16</reference>
          <reference href="https://www.cisecurity.org/controls/">18</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">5</reference>
          <reference href="https://www.cisecurity.org/controls/">9</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Configuring this setting for the SSH daemon provides additional assurance
that remote login via SSH will require a password, even in the event of
misconfiguration elsewhere.</rationale>
          <platform idref="cpe:/a:machine"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sshd_disable_empty_passwords" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="restrict"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

if [ -e "/etc/ssh/sshd_config" ] ; then
    LC_ALL=C sed -i "/^\s*PermitEmptyPasswords\s\+/Id" "/etc/ssh/sshd_config"
else
    touch "/etc/ssh/sshd_config"
fi
cp "/etc/ssh/sshd_config" "/etc/ssh/sshd_config.bak"
# Insert before the line matching the regex '^Match'.
line_number="$(LC_ALL=C grep -n "^Match" "/etc/ssh/sshd_config.bak" | LC_ALL=C sed 's/:.*//g')"
if [ -z "$line_number" ]; then
    # There was no match of '^Match', insert at
    # the end of the file.
    printf '%s\n' "PermitEmptyPasswords no" &gt;&gt; "/etc/ssh/sshd_config"
else
    head -n "$(( line_number - 1 ))" "/etc/ssh/sshd_config.bak" &gt; "/etc/ssh/sshd_config"
    printf '%s\n' "PermitEmptyPasswords no" &gt;&gt; "/etc/ssh/sshd_config"
    tail -n "+$(( line_number ))" "/etc/ssh/sshd_config.bak" &gt;&gt; "/etc/ssh/sshd_config"
fi
# Clean up after ourselves.
rm "/etc/ssh/sshd_config.bak"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sshd_disable_empty_passwords" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Disable SSH Access via Empty Passwords
  block:

    - name: Check for duplicate values
      lineinfile:
        path: /etc/ssh/sshd_config
        create: false
        regexp: (?i)^\s*PermitEmptyPasswords\s+
        state: absent
      check_mode: true
      changed_when: false
      register: dupes

    - name: Deduplicate values from /etc/ssh/sshd_config
      lineinfile:
        path: /etc/ssh/sshd_config
        create: false
        regexp: (?i)^\s*PermitEmptyPasswords\s+
        state: absent
      when: dupes.found is defined and dupes.found &gt; 1

    - name: Insert correct line to /etc/ssh/sshd_config
      lineinfile:
        path: /etc/ssh/sshd_config
        create: true
        regexp: (?i)^\s*PermitEmptyPasswords\s+
        line: PermitEmptyPasswords no
        state: present
        insertbefore: ^[#\s]*Match
        validate: /usr/sbin/sshd -t -f %s
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.5.6
    - NIST-800-171-3.1.1
    - NIST-800-171-3.1.5
    - NIST-800-53-AC-17(a)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - high_severity
    - low_complexity
    - low_disruption
    - no_reboot_needed
    - restrict_strategy
    - sshd_disable_empty_passwords
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export export-name="oval:ssg-sshd_required:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_required"/>
            <check-content-ref name="oval:ssg-sshd_disable_empty_passwords:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-sshd_disable_empty_passwords_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_sshd_disable_kerb_auth" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable Kerberos Authentication</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Unless needed, SSH should not permit extraneous or unnecessary
authentication mechanisms like Kerberos. To disable Kerberos authentication, add
or correct the following line in the <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/ssh/sshd_config</html:code> file:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">KerberosAuthentication no</html:pre></description>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.12</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-000318</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-000368</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-001812</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-001813</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-001814</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(4)(i)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(1)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(3)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(1)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(2)(ii)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
          <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FTP_ITC_EXT.1</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000364-GPOS-00151</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
          <reference href="">SRG-OS-000480-VMM-002000</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.3</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.5.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.6.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.2.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.2.4</reference>
          <reference href="https://www.cisecurity.org/controls/">11</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">9</reference>
          <reference href="">0421</reference>
          <reference href="">0422</reference>
          <reference href="">0431</reference>
          <reference href="">0974</reference>
          <reference href="">1173</reference>
          <reference href="">1401</reference>
          <reference href="">1504</reference>
          <reference href="">1505</reference>
          <reference href="">1546</reference>
          <reference href="">1557</reference>
          <reference href="">1558</reference>
          <reference href="">1559</reference>
          <reference href="">1560</reference>
          <reference href="">1561</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Kerberos authentication for SSH is often implemented using GSSAPI. If Kerberos
is enabled through SSH, the SSH daemon provides a means of access to the
system's Kerberos implementation. Vulnerabilities in the system's Kerberos
implementations may be subject to exploitation.</rationale>
          <platform idref="cpe:/a:machine"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sshd_disable_kerb_auth" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="restrict"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

if [ -e "/etc/ssh/sshd_config" ] ; then
    LC_ALL=C sed -i "/^\s*KerberosAuthentication\s\+/Id" "/etc/ssh/sshd_config"
else
    touch "/etc/ssh/sshd_config"
fi
cp "/etc/ssh/sshd_config" "/etc/ssh/sshd_config.bak"
# Insert before the line matching the regex '^Match'.
line_number="$(LC_ALL=C grep -n "^Match" "/etc/ssh/sshd_config.bak" | LC_ALL=C sed 's/:.*//g')"
if [ -z "$line_number" ]; then
    # There was no match of '^Match', insert at
    # the end of the file.
    printf '%s\n' "KerberosAuthentication no" &gt;&gt; "/etc/ssh/sshd_config"
else
    head -n "$(( line_number - 1 ))" "/etc/ssh/sshd_config.bak" &gt; "/etc/ssh/sshd_config"
    printf '%s\n' "KerberosAuthentication no" &gt;&gt; "/etc/ssh/sshd_config"
    tail -n "+$(( line_number ))" "/etc/ssh/sshd_config.bak" &gt;&gt; "/etc/ssh/sshd_config"
fi
# Clean up after ourselves.
rm "/etc/ssh/sshd_config.bak"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sshd_disable_kerb_auth" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Disable Kerberos Authentication
  block:

    - name: Check for duplicate values
      lineinfile:
        path: /etc/ssh/sshd_config
        create: false
        regexp: (?i)^\s*KerberosAuthentication\s+
        state: absent
      check_mode: true
      changed_when: false
      register: dupes

    - name: Deduplicate values from /etc/ssh/sshd_config
      lineinfile:
        path: /etc/ssh/sshd_config
        create: false
        regexp: (?i)^\s*KerberosAuthentication\s+
        state: absent
      when: dupes.found is defined and dupes.found &gt; 1

    - name: Insert correct line to /etc/ssh/sshd_config
      lineinfile:
        path: /etc/ssh/sshd_config
        create: true
        regexp: (?i)^\s*KerberosAuthentication\s+
        line: KerberosAuthentication no
        state: present
        insertbefore: ^[#\s]*Match
        validate: /usr/sbin/sshd -t -f %s
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.12
    - NIST-800-53-AC-17(a)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sshd_disable_kerb_auth
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export export-name="oval:ssg-sshd_required:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_required"/>
            <check-content-ref name="oval:ssg-sshd_disable_kerb_auth:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-sshd_disable_kerb_auth_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_sshd_use_priv_separation" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Enable Use of Privilege Separation</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">When enabled, SSH will create an unprivileged child process that
has the privilege of the authenticated user. To enable privilege separation in
SSH, add or correct the following line in the <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/ssh/sshd_config</html:code> file:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml" xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2">UsePrivilegeSeparation <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_sshd_priv_separation" use="legacy"/></html:pre></description>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.12</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(4)(i)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(1)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(3)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(1)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(2)(ii)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.10.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.11.1.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.11.1.5</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.11.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.1.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.2.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.1.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.6.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.7.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.7.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.7.3.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.8.2.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.8.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.5</reference>
          <reference href="https://www.cisecurity.org/controls/">12</reference>
          <reference href="https://www.cisecurity.org/controls/">13</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">16</reference>
          <reference href="https://www.cisecurity.org/controls/">18</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">5</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">SSH daemon privilege separation causes the SSH process to drop root privileges
when not needed which would decrease the impact of software vulnerabilities in
the unprivileged section.</rationale>
          <platform idref="cpe:/a:machine"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sshd_use_priv_separation" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="restrict"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then


var_sshd_priv_separation="<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_sshd_priv_separation" use="legacy"/>"



if [ -e "/etc/ssh/sshd_config" ] ; then
    LC_ALL=C sed -i "/^\s*UsePrivilegeSeparation\s\+/Id" "/etc/ssh/sshd_config"
else
    touch "/etc/ssh/sshd_config"
fi
cp "/etc/ssh/sshd_config" "/etc/ssh/sshd_config.bak"
# Insert before the line matching the regex '^Match'.
line_number="$(LC_ALL=C grep -n "^Match" "/etc/ssh/sshd_config.bak" | LC_ALL=C sed 's/:.*//g')"
if [ -z "$line_number" ]; then
    # There was no match of '^Match', insert at
    # the end of the file.
    printf '%s\n' "UsePrivilegeSeparation $var_sshd_priv_separation" &gt;&gt; "/etc/ssh/sshd_config"
else
    head -n "$(( line_number - 1 ))" "/etc/ssh/sshd_config.bak" &gt; "/etc/ssh/sshd_config"
    printf '%s\n' "UsePrivilegeSeparation $var_sshd_priv_separation" &gt;&gt; "/etc/ssh/sshd_config"
    tail -n "+$(( line_number ))" "/etc/ssh/sshd_config.bak" &gt;&gt; "/etc/ssh/sshd_config"
fi
# Clean up after ourselves.
rm "/etc/ssh/sshd_config.bak"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sshd_use_priv_separation" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: XCCDF Value var_sshd_priv_separation # promote to variable
  set_fact:
    var_sshd_priv_separation: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_sshd_priv_separation" use="legacy"/>
  tags:
    - always

- name: Enable Use of Privilege Separation
  block:

    - name: Check for duplicate values
      lineinfile:
        path: /etc/ssh/sshd_config
        create: false
        regexp: (?i)^\s*UsePrivilegeSeparation\s+
        state: absent
      check_mode: true
      changed_when: false
      register: dupes

    - name: Deduplicate values from /etc/ssh/sshd_config
      lineinfile:
        path: /etc/ssh/sshd_config
        create: false
        regexp: (?i)^\s*UsePrivilegeSeparation\s+
        state: absent
      when: dupes.found is defined and dupes.found &gt; 1

    - name: Insert correct line to /etc/ssh/sshd_config
      lineinfile:
        path: /etc/ssh/sshd_config
        create: true
        regexp: (?i)^\s*UsePrivilegeSeparation\s+
        line: UsePrivilegeSeparation {{ var_sshd_priv_separation }}
        state: present
        insertbefore: ^[#\s]*Match
        validate: /usr/sbin/sshd -t -f %s
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.12
    - NIST-800-53-AC-17(a)
    - NIST-800-53-AC-6
    - NIST-800-53-CM-6(a)
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sshd_use_priv_separation
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export export-name="oval:ssg-sshd_required:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_required"/>
            <check-export export-name="oval:ssg-var_sshd_priv_separation:var:1" value-id="xccdf_org.ssgproject.content_value_var_sshd_priv_separation"/>
            <check-content-ref name="oval:ssg-sshd_use_priv_separation:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-sshd_use_priv_separation_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_sshd_disable_rhosts_rsa" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable SSH Support for Rhosts RSA Authentication</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">SSH can allow authentication through the obsolete rsh
command through the use of the authenticating user's SSH keys. This should be disabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
To ensure this behavior is disabled, add or correct the
following line in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/ssh/sshd_config</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">RhostsRSAAuthentication no</html:pre></description>
          <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">As of <html:code xmlns:html="http://www.w3.org/1999/xhtml">openssh-server</html:code> version <html:code xmlns:html="http://www.w3.org/1999/xhtml">7.4</html:code> and above,
the <html:code xmlns:html="http://www.w3.org/1999/xhtml">RhostsRSAAuthentication</html:code> option has been deprecated, and the line
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">RhostsRSAAuthentication no</html:pre> in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/ssh/sshd_config</html:code> is not
necessary.</warning>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.12</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(4)(i)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(1)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(3)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(1)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(2)(ii)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
          <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FIA_UAU.1</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.3</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.5.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.6.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.2.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.2.4</reference>
          <reference href="https://www.cisecurity.org/controls/">11</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">9</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Configuring this setting for the SSH daemon provides additional
assurance that remote login via SSH will require a password, even
in the event of misconfiguration elsewhere.</rationale>
          <platform idref="cpe:/a:machine"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sshd_disable_rhosts_rsa" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_function_replace_or_append" use="legacy"/>
replace_or_append '/etc/ssh/sshd_config' '^RhostsRSAAuthentication' 'no' '' '%s %s'

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sshd_disable_rhosts_rsa" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Disable SSH Support for Rhosts RSA Authentication
  block:

    - name: Check for duplicate values
      lineinfile:
        path: /etc/ssh/sshd_config
        create: false
        regexp: (?i)^\s*RhostsRSAAuthentication\s+
        state: absent
      check_mode: true
      changed_when: false
      register: dupes

    - name: Deduplicate values from /etc/ssh/sshd_config
      lineinfile:
        path: /etc/ssh/sshd_config
        create: false
        regexp: (?i)^\s*RhostsRSAAuthentication\s+
        state: absent
      when: dupes.found is defined and dupes.found &gt; 1

    - name: Insert correct line to /etc/ssh/sshd_config
      lineinfile:
        path: /etc/ssh/sshd_config
        create: true
        regexp: (?i)^\s*RhostsRSAAuthentication\s+
        line: RhostsRSAAuthentication no
        state: present
        insertbefore: ^[#\s]*Match
        validate: /usr/sbin/sshd -t -f %s
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.12
    - NIST-800-53-AC-17(a)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sshd_disable_rhosts_rsa
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export export-name="oval:ssg-sshd_required:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_required"/>
            <check-content-ref name="oval:ssg-sshd_disable_rhosts_rsa:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-sshd_disable_rhosts_rsa_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_sshd_do_not_permit_user_env" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Do Not Allow SSH Environment Options</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To ensure users are not able to override environment
variables of the SSH daemon, add or correct the following line
in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/ssh/sshd_config</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">PermitUserEnvironment no</html:pre></description>
          <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.6</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.12</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(4)(i)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(1)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(3)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(1)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(2)(ii)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00229</reference>
          <reference href="">SRG-OS-000480-VMM-002000</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.3</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.5.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.6.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.2.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.2.4</reference>
          <reference href="https://www.cisecurity.org/controls/">11</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">9</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">SSH environment options potentially allow users to bypass
access restriction in some configurations.</rationale>
          <platform idref="cpe:/a:machine"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sshd_do_not_permit_user_env" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="restrict"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

if [ -e "/etc/ssh/sshd_config" ] ; then
    LC_ALL=C sed -i "/^\s*PermitUserEnvironment\s\+/Id" "/etc/ssh/sshd_config"
else
    touch "/etc/ssh/sshd_config"
fi
cp "/etc/ssh/sshd_config" "/etc/ssh/sshd_config.bak"
# Insert before the line matching the regex '^Match'.
line_number="$(LC_ALL=C grep -n "^Match" "/etc/ssh/sshd_config.bak" | LC_ALL=C sed 's/:.*//g')"
if [ -z "$line_number" ]; then
    # There was no match of '^Match', insert at
    # the end of the file.
    printf '%s\n' "PermitUserEnvironment no" &gt;&gt; "/etc/ssh/sshd_config"
else
    head -n "$(( line_number - 1 ))" "/etc/ssh/sshd_config.bak" &gt; "/etc/ssh/sshd_config"
    printf '%s\n' "PermitUserEnvironment no" &gt;&gt; "/etc/ssh/sshd_config"
    tail -n "+$(( line_number ))" "/etc/ssh/sshd_config.bak" &gt;&gt; "/etc/ssh/sshd_config"
fi
# Clean up after ourselves.
rm "/etc/ssh/sshd_config.bak"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sshd_do_not_permit_user_env" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Do Not Allow SSH Environment Options
  block:

    - name: Check for duplicate values
      lineinfile:
        path: /etc/ssh/sshd_config
        create: false
        regexp: (?i)^\s*PermitUserEnvironment\s+
        state: absent
      check_mode: true
      changed_when: false
      register: dupes

    - name: Deduplicate values from /etc/ssh/sshd_config
      lineinfile:
        path: /etc/ssh/sshd_config
        create: false
        regexp: (?i)^\s*PermitUserEnvironment\s+
        state: absent
      when: dupes.found is defined and dupes.found &gt; 1

    - name: Insert correct line to /etc/ssh/sshd_config
      lineinfile:
        path: /etc/ssh/sshd_config
        create: true
        regexp: (?i)^\s*PermitUserEnvironment\s+
        line: PermitUserEnvironment no
        state: present
        insertbefore: ^[#\s]*Match
        validate: /usr/sbin/sshd -t -f %s
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.5.6
    - NIST-800-171-3.1.12
    - NIST-800-53-AC-17(a)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sshd_do_not_permit_user_env
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export export-name="oval:ssg-sshd_required:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_required"/>
            <check-content-ref name="oval:ssg-sshd_do_not_permit_user_env:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-sshd_do_not_permit_user_env_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_sshd_disable_rhosts" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable SSH Support for .rhosts Files</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">SSH can emulate the behavior of the obsolete rsh
command in allowing users to enable insecure access to their
accounts via <html:code xmlns:html="http://www.w3.org/1999/xhtml">.rhosts</html:code> files.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
To ensure this behavior is disabled, add or correct the
following line in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/ssh/sshd_config</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">IgnoreRhosts yes</html:pre></description>
          <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.6</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.12</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
          <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FIA_UAU.1</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
          <reference href="">SRG-OS-000107-VMM-000530</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.11</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.12</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.2.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.3</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.06</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.5.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.6.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.2.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.2.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.6.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.7.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.5</reference>
          <reference href="https://www.cisecurity.org/controls/">11</reference>
          <reference href="https://www.cisecurity.org/controls/">12</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">16</reference>
          <reference href="https://www.cisecurity.org/controls/">18</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">5</reference>
          <reference href="https://www.cisecurity.org/controls/">9</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">SSH trust relationships mean a compromise on one host
can allow an attacker to move trivially to other hosts.</rationale>
          <platform idref="cpe:/a:machine"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sshd_disable_rhosts" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="restrict"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

if [ -e "/etc/ssh/sshd_config" ] ; then
    LC_ALL=C sed -i "/^\s*IgnoreRhosts\s\+/Id" "/etc/ssh/sshd_config"
else
    touch "/etc/ssh/sshd_config"
fi
cp "/etc/ssh/sshd_config" "/etc/ssh/sshd_config.bak"
# Insert before the line matching the regex '^Match'.
line_number="$(LC_ALL=C grep -n "^Match" "/etc/ssh/sshd_config.bak" | LC_ALL=C sed 's/:.*//g')"
if [ -z "$line_number" ]; then
    # There was no match of '^Match', insert at
    # the end of the file.
    printf '%s\n' "IgnoreRhosts yes" &gt;&gt; "/etc/ssh/sshd_config"
else
    head -n "$(( line_number - 1 ))" "/etc/ssh/sshd_config.bak" &gt; "/etc/ssh/sshd_config"
    printf '%s\n' "IgnoreRhosts yes" &gt;&gt; "/etc/ssh/sshd_config"
    tail -n "+$(( line_number ))" "/etc/ssh/sshd_config.bak" &gt;&gt; "/etc/ssh/sshd_config"
fi
# Clean up after ourselves.
rm "/etc/ssh/sshd_config.bak"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sshd_disable_rhosts" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Disable SSH Support for .rhosts Files
  block:

    - name: Check for duplicate values
      lineinfile:
        path: /etc/ssh/sshd_config
        create: false
        regexp: (?i)^\s*IgnoreRhosts\s+
        state: absent
      check_mode: true
      changed_when: false
      register: dupes

    - name: Deduplicate values from /etc/ssh/sshd_config
      lineinfile:
        path: /etc/ssh/sshd_config
        create: false
        regexp: (?i)^\s*IgnoreRhosts\s+
        state: absent
      when: dupes.found is defined and dupes.found &gt; 1

    - name: Insert correct line to /etc/ssh/sshd_config
      lineinfile:
        path: /etc/ssh/sshd_config
        create: true
        regexp: (?i)^\s*IgnoreRhosts\s+
        line: IgnoreRhosts yes
        state: present
        insertbefore: ^[#\s]*Match
        validate: /usr/sbin/sshd -t -f %s
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.5.6
    - NIST-800-171-3.1.12
    - NIST-800-53-AC-17(a)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sshd_disable_rhosts
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export export-name="oval:ssg-sshd_required:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_required"/>
            <check-content-ref name="oval:ssg-sshd_disable_rhosts:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-sshd_disable_rhosts_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_sshd_set_keepalive" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Set SSH Client Alive Count Max</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The SSH server sends at most <html:code xmlns:html="http://www.w3.org/1999/xhtml">ClientAliveCountMax</html:code> messages
during a SSH session and waits for a response from the SSH client.
The option <html:code xmlns:html="http://www.w3.org/1999/xhtml">ClientAliveInterval</html:code> configures timeout after
each <html:code xmlns:html="http://www.w3.org/1999/xhtml">ClientAliveCountMax</html:code> message. If the SSH server does not
receive a response from the client, then the connection is considered idle
and terminated.
For SSH earlier than v8.2, a <html:code xmlns:html="http://www.w3.org/1999/xhtml">ClientAliveCountMax</html:code> value of <html:code xmlns:html="http://www.w3.org/1999/xhtml">0</html:code>
causes an idle timeout precisely when the <html:code xmlns:html="http://www.w3.org/1999/xhtml">ClientAliveInterval</html:code> is set.
Starting with v8.2, a value of <html:code xmlns:html="http://www.w3.org/1999/xhtml">0</html:code> disables the timeout functionality
completely. If the option is set to a number greater than <html:code xmlns:html="http://www.w3.org/1999/xhtml">0</html:code>, then
the idle session will be disconnected after
<html:code xmlns:html="http://www.w3.org/1999/xhtml">ClientAliveInterval * ClientAliveCountMax</html:code> seconds.</description>
          <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.6</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.11</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-000879</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-001133</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-002361</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(4)(i)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(1)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(3)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(1)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(2)(ii)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-2(5)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-12</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-10</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-2</reference>
          <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-8.1.8</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000163-GPOS-00072</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000279-GPOS-00109</reference>
          <reference href="">SRG-OS-000480-VMM-002000</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.2.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.3</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI03.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI03.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI03.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.10</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.10</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.4.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.4.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.2.5</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.18.1.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.6.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.6.1.5</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.7.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.6</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.3.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.5</reference>
          <reference href="https://www.cisecurity.org/controls/">1</reference>
          <reference href="https://www.cisecurity.org/controls/">12</reference>
          <reference href="https://www.cisecurity.org/controls/">13</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">16</reference>
          <reference href="https://www.cisecurity.org/controls/">18</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">5</reference>
          <reference href="https://www.cisecurity.org/controls/">7</reference>
          <reference href="https://www.cisecurity.org/controls/">8</reference>
          <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R29)</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">This ensures a user login will be terminated as soon as the <html:code xmlns:html="http://www.w3.org/1999/xhtml">ClientAliveInterval</html:code>
is reached.</rationale>
          <platform idref="cpe:/a:machine"/>
          <requires idref="xccdf_org.ssgproject.content_rule_sshd_set_idle_timeout"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sshd_set_keepalive" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then


var_sshd_set_keepalive="<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_sshd_set_keepalive" use="legacy"/>"



if [ -e "/etc/ssh/sshd_config" ] ; then
    LC_ALL=C sed -i "/^\s*ClientAliveCountMax\s\+/Id" "/etc/ssh/sshd_config"
else
    touch "/etc/ssh/sshd_config"
fi
cp "/etc/ssh/sshd_config" "/etc/ssh/sshd_config.bak"
# Insert before the line matching the regex '^Match'.
line_number="$(LC_ALL=C grep -n "^Match" "/etc/ssh/sshd_config.bak" | LC_ALL=C sed 's/:.*//g')"
if [ -z "$line_number" ]; then
    # There was no match of '^Match', insert at
    # the end of the file.
    printf '%s\n' "ClientAliveCountMax $var_sshd_set_keepalive" &gt;&gt; "/etc/ssh/sshd_config"
else
    head -n "$(( line_number - 1 ))" "/etc/ssh/sshd_config.bak" &gt; "/etc/ssh/sshd_config"
    printf '%s\n' "ClientAliveCountMax $var_sshd_set_keepalive" &gt;&gt; "/etc/ssh/sshd_config"
    tail -n "+$(( line_number ))" "/etc/ssh/sshd_config.bak" &gt;&gt; "/etc/ssh/sshd_config"
fi
# Clean up after ourselves.
rm "/etc/ssh/sshd_config.bak"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sshd_set_keepalive" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: XCCDF Value var_sshd_set_keepalive # promote to variable
  set_fact:
    var_sshd_set_keepalive: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_sshd_set_keepalive" use="legacy"/>
  tags:
    - always

- name: Set SSH Client Alive Count Max
  block:

    - name: Check for duplicate values
      lineinfile:
        path: /etc/ssh/sshd_config
        create: false
        regexp: (?i)^\s*ClientAliveCountMax\s+
        state: absent
      check_mode: true
      changed_when: false
      register: dupes

    - name: Deduplicate values from /etc/ssh/sshd_config
      lineinfile:
        path: /etc/ssh/sshd_config
        create: false
        regexp: (?i)^\s*ClientAliveCountMax\s+
        state: absent
      when: dupes.found is defined and dupes.found &gt; 1

    - name: Insert correct line to /etc/ssh/sshd_config
      lineinfile:
        path: /etc/ssh/sshd_config
        create: true
        regexp: (?i)^\s*ClientAliveCountMax\s+
        line: ClientAliveCountMax {{ var_sshd_set_keepalive }}
        state: present
        insertbefore: ^[#\s]*Match
        validate: /usr/sbin/sshd -t -f %s
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.5.6
    - NIST-800-171-3.1.11
    - NIST-800-53-AC-12
    - NIST-800-53-AC-17(a)
    - NIST-800-53-AC-2(5)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-SC-10
    - PCI-DSS-Req-8.1.8
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sshd_set_keepalive
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export export-name="oval:ssg-sshd_required:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_required"/>
            <check-export export-name="oval:ssg-var_sshd_set_keepalive:var:1" value-id="xccdf_org.ssgproject.content_value_var_sshd_set_keepalive"/>
            <check-content-ref name="oval:ssg-sshd_set_keepalive:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-sshd_set_keepalive_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_sshd_set_keepalive_0" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Set SSH Client Alive Count Max to zero</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The SSH server sends at most <html:code xmlns:html="http://www.w3.org/1999/xhtml">ClientAliveCountMax</html:code> messages
during a SSH session and waits for a response from the SSH client.
The option <html:code xmlns:html="http://www.w3.org/1999/xhtml">ClientAliveInterval</html:code> configures timeout after
each <html:code xmlns:html="http://www.w3.org/1999/xhtml">ClientAliveCountMax</html:code> message. If the SSH server does not
receive a response from the client, then the connection is considered idle
and terminated.

To ensure the SSH idle timeout occurs precisely when the
<html:code xmlns:html="http://www.w3.org/1999/xhtml">ClientAliveInterval</html:code> is set, set the <html:code xmlns:html="http://www.w3.org/1999/xhtml">ClientAliveCountMax</html:code> to
value of <html:code xmlns:html="http://www.w3.org/1999/xhtml">0</html:code>.</description>
          <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.6</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.11</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-000879</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-001133</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-002361</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(4)(i)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(1)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(3)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(1)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(2)(ii)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-2(5)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-12</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-10</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-2</reference>
          <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-8.1.8</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000163-GPOS-00072</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000279-GPOS-00109</reference>
          <reference href="">SRG-OS-000480-VMM-002000</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.2.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.3</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI03.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI03.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI03.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.10</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.10</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.4.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.4.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.2.5</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.18.1.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.6.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.6.1.5</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.7.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.2.6</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.3.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.9.4.5</reference>
          <reference href="https://www.cisecurity.org/controls/">1</reference>
          <reference href="https://www.cisecurity.org/controls/">12</reference>
          <reference href="https://www.cisecurity.org/controls/">13</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">16</reference>
          <reference href="https://www.cisecurity.org/controls/">18</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">5</reference>
          <reference href="https://www.cisecurity.org/controls/">7</reference>
          <reference href="https://www.cisecurity.org/controls/">8</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">This ensures a user login will be terminated as soon as the <html:code xmlns:html="http://www.w3.org/1999/xhtml">ClientAliveInterval</html:code>
is reached.</rationale>
          <platform idref="cpe:/a:machine"/>
          <requires idref="xccdf_org.ssgproject.content_rule_sshd_set_idle_timeout"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sshd_set_keepalive_0" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="restrict"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

if [ -e "/etc/ssh/sshd_config" ] ; then
    LC_ALL=C sed -i "/^\s*ClientAliveCountMax\s\+/Id" "/etc/ssh/sshd_config"
else
    touch "/etc/ssh/sshd_config"
fi
cp "/etc/ssh/sshd_config" "/etc/ssh/sshd_config.bak"
# Insert before the line matching the regex '^Match'.
line_number="$(LC_ALL=C grep -n "^Match" "/etc/ssh/sshd_config.bak" | LC_ALL=C sed 's/:.*//g')"
if [ -z "$line_number" ]; then
    # There was no match of '^Match', insert at
    # the end of the file.
    printf '%s\n' "ClientAliveCountMax 0" &gt;&gt; "/etc/ssh/sshd_config"
else
    head -n "$(( line_number - 1 ))" "/etc/ssh/sshd_config.bak" &gt; "/etc/ssh/sshd_config"
    printf '%s\n' "ClientAliveCountMax 0" &gt;&gt; "/etc/ssh/sshd_config"
    tail -n "+$(( line_number ))" "/etc/ssh/sshd_config.bak" &gt;&gt; "/etc/ssh/sshd_config"
fi
# Clean up after ourselves.
rm "/etc/ssh/sshd_config.bak"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sshd_set_keepalive_0" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Set SSH Client Alive Count Max to zero
  block:

    - name: Check for duplicate values
      lineinfile:
        path: /etc/ssh/sshd_config
        create: false
        regexp: (?i)^\s*ClientAliveCountMax\s+
        state: absent
      check_mode: true
      changed_when: false
      register: dupes

    - name: Deduplicate values from /etc/ssh/sshd_config
      lineinfile:
        path: /etc/ssh/sshd_config
        create: false
        regexp: (?i)^\s*ClientAliveCountMax\s+
        state: absent
      when: dupes.found is defined and dupes.found &gt; 1

    - name: Insert correct line to /etc/ssh/sshd_config
      lineinfile:
        path: /etc/ssh/sshd_config
        create: true
        regexp: (?i)^\s*ClientAliveCountMax\s+
        line: ClientAliveCountMax 0
        state: present
        insertbefore: ^[#\s]*Match
        validate: /usr/sbin/sshd -t -f %s
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.5.6
    - NIST-800-171-3.1.11
    - NIST-800-53-AC-12
    - NIST-800-53-AC-17(a)
    - NIST-800-53-AC-2(5)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-SC-10
    - PCI-DSS-Req-8.1.8
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sshd_set_keepalive_0
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export export-name="oval:ssg-sshd_required:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_required"/>
            <check-content-ref name="oval:ssg-sshd_set_keepalive_0:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-sshd_set_keepalive_0_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_sshd_enable_x11_forwarding" selected="false" role="full" severity="high">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Enable Encrypted X11 Forwarding</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">By default, remote X11 connections are not encrypted when initiated
by users. SSH has the capability to encrypt remote X11 connections when SSH's
<html:code xmlns:html="http://www.w3.org/1999/xhtml">X11Forwarding</html:code> option is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
To enable X11 Forwarding, add or correct the
following line in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/ssh/sshd_config</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">X11Forwarding yes</html:pre></description>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.13</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(2)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-7</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.3</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.3.3</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI03.08</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI07.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.1.4</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.5.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.6.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.1.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.13.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.2.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.2.4</reference>
          <reference href="https://www.cisecurity.org/controls/">1</reference>
          <reference href="https://www.cisecurity.org/controls/">11</reference>
          <reference href="https://www.cisecurity.org/controls/">12</reference>
          <reference href="https://www.cisecurity.org/controls/">13</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">16</reference>
          <reference href="https://www.cisecurity.org/controls/">18</reference>
          <reference href="https://www.cisecurity.org/controls/">20</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">4</reference>
          <reference href="https://www.cisecurity.org/controls/">6</reference>
          <reference href="https://www.cisecurity.org/controls/">9</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Non-encrypted X displays allow an attacker to capture keystrokes and to execute commands
remotely.</rationale>
          <platform idref="cpe:/a:machine"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sshd_enable_x11_forwarding" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="restrict"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

if [ -e "/etc/ssh/sshd_config" ] ; then
    LC_ALL=C sed -i "/^\s*X11Forwarding\s\+/Id" "/etc/ssh/sshd_config"
else
    touch "/etc/ssh/sshd_config"
fi
cp "/etc/ssh/sshd_config" "/etc/ssh/sshd_config.bak"
# Insert before the line matching the regex '^Match'.
line_number="$(LC_ALL=C grep -n "^Match" "/etc/ssh/sshd_config.bak" | LC_ALL=C sed 's/:.*//g')"
if [ -z "$line_number" ]; then
    # There was no match of '^Match', insert at
    # the end of the file.
    printf '%s\n' "X11Forwarding yes" &gt;&gt; "/etc/ssh/sshd_config"
else
    head -n "$(( line_number - 1 ))" "/etc/ssh/sshd_config.bak" &gt; "/etc/ssh/sshd_config"
    printf '%s\n' "X11Forwarding yes" &gt;&gt; "/etc/ssh/sshd_config"
    tail -n "+$(( line_number ))" "/etc/ssh/sshd_config.bak" &gt;&gt; "/etc/ssh/sshd_config"
fi
# Clean up after ourselves.
rm "/etc/ssh/sshd_config.bak"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sshd_enable_x11_forwarding" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Enable Encrypted X11 Forwarding
  block:

    - name: Check for duplicate values
      lineinfile:
        path: /etc/ssh/sshd_config
        create: false
        regexp: (?i)^\s*X11Forwarding\s+
        state: absent
      check_mode: true
      changed_when: false
      register: dupes

    - name: Deduplicate values from /etc/ssh/sshd_config
      lineinfile:
        path: /etc/ssh/sshd_config
        create: false
        regexp: (?i)^\s*X11Forwarding\s+
        state: absent
      when: dupes.found is defined and dupes.found &gt; 1

    - name: Insert correct line to /etc/ssh/sshd_config
      lineinfile:
        path: /etc/ssh/sshd_config
        create: true
        regexp: (?i)^\s*X11Forwarding\s+
        line: X11Forwarding yes
        state: present
        insertbefore: ^[#\s]*Match
        validate: /usr/sbin/sshd -t -f %s
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.13
    - NIST-800-53-AC-17(2)
    - NIST-800-53-AC-17(a)
    - NIST-800-53-CM-6(a)
    - high_severity
    - low_complexity
    - low_disruption
    - no_reboot_needed
    - restrict_strategy
    - sshd_enable_x11_forwarding
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export export-name="oval:ssg-sshd_required:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_required"/>
            <check-content-ref name="oval:ssg-sshd_enable_x11_forwarding:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-sshd_enable_x11_forwarding_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_sshd_disable_pubkey_auth" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable PubkeyAuthentication Authentication</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Unless needed, SSH should not permit extraneous or unnecessary
authentication mechanisms. To disable PubkeyAuthentication authentication, add or
correct the following line in the <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/ssh/sshd_config</html:code> file:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">PubkeyAuthentication no</html:pre></description>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">PubkeyAuthentication authentication is used to provide additional authentication mechanisms to
applications. Allowing PubkeyAuthentication authentication through SSH allows users to
generate their own authentication tokens, increasing the attack surface of the system.</rationale>
          <platform idref="cpe:/a:machine"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sshd_disable_pubkey_auth" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="restrict"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

if [ -e "/etc/ssh/sshd_config" ] ; then
    LC_ALL=C sed -i "/^\s*PubkeyAuthentication\s\+/Id" "/etc/ssh/sshd_config"
else
    touch "/etc/ssh/sshd_config"
fi
cp "/etc/ssh/sshd_config" "/etc/ssh/sshd_config.bak"
# Insert before the line matching the regex '^Match'.
line_number="$(LC_ALL=C grep -n "^Match" "/etc/ssh/sshd_config.bak" | LC_ALL=C sed 's/:.*//g')"
if [ -z "$line_number" ]; then
    # There was no match of '^Match', insert at
    # the end of the file.
    printf '%s\n' "PubkeyAuthentication no" &gt;&gt; "/etc/ssh/sshd_config"
else
    head -n "$(( line_number - 1 ))" "/etc/ssh/sshd_config.bak" &gt; "/etc/ssh/sshd_config"
    printf '%s\n' "PubkeyAuthentication no" &gt;&gt; "/etc/ssh/sshd_config"
    tail -n "+$(( line_number ))" "/etc/ssh/sshd_config.bak" &gt;&gt; "/etc/ssh/sshd_config"
fi
# Clean up after ourselves.
rm "/etc/ssh/sshd_config.bak"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sshd_disable_pubkey_auth" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Disable PubkeyAuthentication Authentication
  block:

    - name: Check for duplicate values
      lineinfile:
        path: /etc/ssh/sshd_config
        create: false
        regexp: (?i)^\s*PubkeyAuthentication\s+
        state: absent
      check_mode: true
      changed_when: false
      register: dupes

    - name: Deduplicate values from /etc/ssh/sshd_config
      lineinfile:
        path: /etc/ssh/sshd_config
        create: false
        regexp: (?i)^\s*PubkeyAuthentication\s+
        state: absent
      when: dupes.found is defined and dupes.found &gt; 1

    - name: Insert correct line to /etc/ssh/sshd_config
      lineinfile:
        path: /etc/ssh/sshd_config
        create: true
        regexp: (?i)^\s*PubkeyAuthentication\s+
        line: PubkeyAuthentication no
        state: present
        insertbefore: ^[#\s]*Match
        validate: /usr/sbin/sshd -t -f %s
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sshd_disable_pubkey_auth
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export export-name="oval:ssg-sshd_required:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_required"/>
            <check-content-ref name="oval:ssg-sshd_disable_pubkey_auth:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-sshd_disable_pubkey_auth_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_sshd_disable_user_known_hosts" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable SSH Support for User Known Hosts</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">SSH can allow system users to connect to systems if a cache of the remote
systems public keys is available.  This should be disabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
To ensure this behavior is disabled, add or correct the
following line in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/ssh/sshd_config</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">IgnoreUserKnownHosts yes</html:pre></description>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.12</reference>
          <reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(4)(i)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(1)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(3)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(1)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(2)(ii)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
          <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FIA_UAU.1</reference>
          <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.2</reference>
          <reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.3</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.1.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.5.1</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.12.6.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.2.2</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.2.3</reference>
          <reference href="https://www.iso.org/standard/54534.html">A.14.2.4</reference>
          <reference href="https://www.cisecurity.org/controls/">11</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">9</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Configuring this setting for the SSH daemon provides additional
assurance that remote login via SSH will require a password, even
in the event of misconfiguration elsewhere.</rationale>
          <platform idref="cpe:/a:machine"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sshd_disable_user_known_hosts" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="restrict"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

if [ -e "/etc/ssh/sshd_config" ] ; then
    LC_ALL=C sed -i "/^\s*IgnoreUserKnownHosts\s\+/Id" "/etc/ssh/sshd_config"
else
    touch "/etc/ssh/sshd_config"
fi
cp "/etc/ssh/sshd_config" "/etc/ssh/sshd_config.bak"
# Insert before the line matching the regex '^Match'.
line_number="$(LC_ALL=C grep -n "^Match" "/etc/ssh/sshd_config.bak" | LC_ALL=C sed 's/:.*//g')"
if [ -z "$line_number" ]; then
    # There was no match of '^Match', insert at
    # the end of the file.
    printf '%s\n' "IgnoreUserKnownHosts yes" &gt;&gt; "/etc/ssh/sshd_config"
else
    head -n "$(( line_number - 1 ))" "/etc/ssh/sshd_config.bak" &gt; "/etc/ssh/sshd_config"
    printf '%s\n' "IgnoreUserKnownHosts yes" &gt;&gt; "/etc/ssh/sshd_config"
    tail -n "+$(( line_number ))" "/etc/ssh/sshd_config.bak" &gt;&gt; "/etc/ssh/sshd_config"
fi
# Clean up after ourselves.
rm "/etc/ssh/sshd_config.bak"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sshd_disable_user_known_hosts" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Disable SSH Support for User Known Hosts
  block:

    - name: Check for duplicate values
      lineinfile:
        path: /etc/ssh/sshd_config
        create: false
        regexp: (?i)^\s*IgnoreUserKnownHosts\s+
        state: absent
      check_mode: true
      changed_when: false
      register: dupes

    - name: Deduplicate values from /etc/ssh/sshd_config
      lineinfile:
        path: /etc/ssh/sshd_config
        create: false
        regexp: (?i)^\s*IgnoreUserKnownHosts\s+
        state: absent
      when: dupes.found is defined and dupes.found &gt; 1

    - name: Insert correct line to /etc/ssh/sshd_config
      lineinfile:
        path: /etc/ssh/sshd_config
        create: true
        regexp: (?i)^\s*IgnoreUserKnownHosts\s+
        line: IgnoreUserKnownHosts yes
        state: present
        insertbefore: ^[#\s]*Match
        validate: /usr/sbin/sshd -t -f %s
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.12
    - NIST-800-53-AC-17(a)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sshd_disable_user_known_hosts
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export export-name="oval:ssg-sshd_required:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_required"/>
            <check-content-ref name="oval:ssg-sshd_disable_user_known_hosts:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-sshd_disable_user_known_hosts_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_sshd_set_max_sessions" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Set SSH MaxSessions limit</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">MaxSessions</html:code> parameter specifies the maximum number of open sessions permitted
from a given connection. To set MaxSessions edit
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/ssh/sshd_config</html:code> as follows: <html:pre xmlns:html="http://www.w3.org/1999/xhtml" xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2">MaxSessions <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_sshd_max_sessions" use="legacy"/></html:pre></description>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To protect a system from denial of service due to a large number of concurrent
sessions, use the rate limiting function of MaxSessions to protect availability
of sshd logins and prevent overwhelming the daemon.</rationale>
          <platform idref="cpe:/a:machine"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sshd_set_max_sessions" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="configure"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then


var_sshd_max_sessions="<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_sshd_max_sessions" use="legacy"/>"



if [ -e "/etc/ssh/sshd_config" ] ; then
    LC_ALL=C sed -i "/^\s*MaxSessions\s\+/Id" "/etc/ssh/sshd_config"
else
    touch "/etc/ssh/sshd_config"
fi
cp "/etc/ssh/sshd_config" "/etc/ssh/sshd_config.bak"
# Insert before the line matching the regex '^Match'.
line_number="$(LC_ALL=C grep -n "^Match" "/etc/ssh/sshd_config.bak" | LC_ALL=C sed 's/:.*//g')"
if [ -z "$line_number" ]; then
    # There was no match of '^Match', insert at
    # the end of the file.
    printf '%s\n' "MaxSessions $var_sshd_max_sessions" &gt;&gt; "/etc/ssh/sshd_config"
else
    head -n "$(( line_number - 1 ))" "/etc/ssh/sshd_config.bak" &gt; "/etc/ssh/sshd_config"
    printf '%s\n' "MaxSessions $var_sshd_max_sessions" &gt;&gt; "/etc/ssh/sshd_config"
    tail -n "+$(( line_number ))" "/etc/ssh/sshd_config.bak" &gt;&gt; "/etc/ssh/sshd_config"
fi
# Clean up after ourselves.
rm "/etc/ssh/sshd_config.bak"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sshd_set_max_sessions" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: XCCDF Value var_sshd_max_sessions # promote to variable
  set_fact:
    var_sshd_max_sessions: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_sshd_max_sessions" use="legacy"/>
  tags:
    - always

- name: Set SSH MaxSessions limit
  block:

    - name: Check for duplicate values
      lineinfile:
        path: /etc/ssh/sshd_config
        create: false
        regexp: (?i)^\s*MaxSessions\s+
        state: absent
      check_mode: true
      changed_when: false
      register: dupes

    - name: Deduplicate values from /etc/ssh/sshd_config
      lineinfile:
        path: /etc/ssh/sshd_config
        create: false
        regexp: (?i)^\s*MaxSessions\s+
        state: absent
      when: dupes.found is defined and dupes.found &gt; 1

    - name: Insert correct line to /etc/ssh/sshd_config
      lineinfile:
        path: /etc/ssh/sshd_config
        create: true
        regexp: (?i)^\s*MaxSessions\s+
        line: MaxSessions {{ var_sshd_max_sessions }}
        state: present
        insertbefore: ^[#\s]*Match
        validate: /usr/sbin/sshd -t -f %s
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - sshd_set_max_sessions
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export export-name="oval:ssg-var_sshd_max_sessions:var:1" value-id="xccdf_org.ssgproject.content_value_var_sshd_max_sessions"/>
            <check-export export-name="oval:ssg-sshd_required:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_required"/>
            <check-content-ref name="oval:ssg-sshd_set_max_sessions:def:1" href="ssg-fedora-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-sshd_set_max_sessions_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
          </check>
        </Rule>
        <Group id="xccdf_org.ssgproject.content_group_sshd_strengthen_firewall">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Strengthen Firewall Configuration if Possible</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">If the SSH server is expected to only receive connections from
the local network, then strengthen the default firewall rule for the SSH service
to only accept connections from the appropriate network segment(s).
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Determine an appropriate network block, <html:code xmlns:html="http://www.w3.org/1999/xhtml">netwk</html:code>, network mask, <html:code xmlns:html="http://www.w3.org/1999/xhtml">mask</html:code>, and
network protocol, <html:code xmlns:html="http://www.w3.org/1999/xhtml">ip_protocol</html:code>, representing the systems on your network which will
be allowed to access this SSH server.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Run the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">firewall-cmd --permanent --add-rich-rule='rule family="ip_protocol" source address="netwk/mask" service name="ssh" accept'</html:pre></description>
          <platform idref="cpe:/a:machine"/>
        </Group>
      </Group>
    </Group>
    <Group id="xccdf_org.ssgproject.content_group_base">
      <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Base Services</title>
      <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">This section addresses the base services that are installed on a
Fedora default installation which are not covered in other
sections. Some of these services listen on the network and
should be treated with particular discretion. Other services are local
system utilities that may or may not be extraneous. In general, system services
should be disabled if not required.</description>
      <Rule id="xccdf_org.ssgproject.content_rule_package_abrt_removed" selected="false" role="full" severity="medium">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Uninstall Automatic Bug Reporting Tool (abrt)</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The Automatic Bug Reporting Tool (<html:code xmlns:html="http://www.w3.org/1999/xhtml">abrt</html:code>) collects
and reports crash data when an application crash is detected. Using a variety
of plugins, abrt can email crash reports to system administrators, log crash
reports to files, or forward crash reports to a centralized issue tracking
system such as RHTSupport.
The <html:code xmlns:html="http://www.w3.org/1999/xhtml">abrt</html:code> package can be removed with the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">
$ sudo dnf erase abrt</html:pre></description>
        <reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000095-GPOS-00049</reference>
        <reference href="https://public.cyber.mil/stigs/cci/">CCI-000381</reference>
        <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Mishandling crash data could expose sensitive information about
vulnerabilities in software executing on the system, as well as sensitive
information from within a process's address space or registers.</rationale>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_abrt_removed" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="disable">
# CAUTION: This remediation script will remove abrt
#	   from the system, and may remove any packages
#	   that depend on abrt. Execute this
#	   remediation AFTER testing on a non-production
#	   system!

if rpm -q --quiet "abrt" ; then
    dnf remove -y "abrt"
fi
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_abrt_removed" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="disable">- name: Ensure abrt is removed
  package:
    name: abrt
    state: absent
  tags:
    - disable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - package_abrt_removed
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_abrt_removed" system="urn:xccdf:fix:script:puppet" complexity="low" disruption="low" strategy="disable">include remove_abrt

class remove_abrt {
  package { 'abrt':
    ensure =&gt; 'purged',
  }
}
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_abrt_removed" system="urn:redhat:anaconda:pre" complexity="low" disruption="low" strategy="disable">
package --remove=abrt
</fix>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref name="oval:ssg-package_abrt_removed:def:1" href="ssg-fedora-oval.xml"/>
        </check>
        <check system="http://scap.nist.gov/schema/ocil/2">
          <check-content-ref name="ocil:ssg-package_abrt_removed_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
        </check>
      </Rule>
    </Group>
  </Group>
  <Group id="xccdf_org.ssgproject.content_group_intro">
    <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Introduction</title>
    <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The purpose of this guidance is to provide security configuration
recommendations and baselines for the Fedora operating
system. Recommended settings for the basic operating system are provided,
as well as for many network services that the system can provide to other systems.
The guide is intended for system administrators. Readers are assumed to
possess basic system administration skills for Unix-like systems, as well
as some familiarity with the product's documentation and administration
conventions. Some instructions within this guide are complex.
All directions should be followed completely and with understanding of
their effects in order to avoid serious adverse effects on the system
and its security.</description>
    <Group id="xccdf_org.ssgproject.content_group_how-to-use">
      <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">How to Use This Guide</title>
      <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Readers should heed the following points when using the guide.</description>
      <Group id="xccdf_org.ssgproject.content_group_intro-read-sections-completely">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Read Sections Completely and in Order</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Each section may build on information and recommendations discussed in
prior sections. Each section should be read and understood completely;
instructions should never be blindly applied. Relevant discussion may
occur after instructions for an action.</description>
      </Group>
      <Group id="xccdf_org.ssgproject.content_group_intro-test-non-production">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Test in Non-Production Environment</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">This guidance should always be tested in a non-production environment
before deployment. This test environment should simulate the setup in
which the system will be deployed as closely as possible.</description>
      </Group>
      <Group id="xccdf_org.ssgproject.content_group_intro-reboot-required">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Reboot Required</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">A system reboot is implicitly required after some actions in order to
complete the reconfiguration of the system. In many cases, the changes
will not take effect until a reboot is performed. In order to ensure
that changes are applied properly and to test functionality, always
reboot the system after applying a set of recommendations from this guide.</description>
      </Group>
      <Group id="xccdf_org.ssgproject.content_group_intro-formatting-conventions">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Formatting Conventions</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Commands intended for shell execution, as well as configuration file text,
are featured in a <html:code xmlns:html="http://www.w3.org/1999/xhtml">monospace font</html:code>. <html:i xmlns:html="http://www.w3.org/1999/xhtml">Italics</html:i> are used
to indicate instances where the system administrator must substitute
the appropriate information into a command or configuration file.</description>
      </Group>
      <Group id="xccdf_org.ssgproject.content_group_intro-root-shell-assumed">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Root Shell Environment Assumed</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Most of the actions listed in this document are written with the
assumption that they will be executed by the root user running the
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/bin/bash</html:code> shell. Commands preceded with a hash mark (#)
assume that the administrator will execute the commands as root, i.e.
apply the command via <html:code xmlns:html="http://www.w3.org/1999/xhtml">sudo</html:code> whenever possible, or use
<html:code xmlns:html="http://www.w3.org/1999/xhtml">su</html:code> to gain root privileges if <html:code xmlns:html="http://www.w3.org/1999/xhtml">sudo</html:code> cannot be
used. Commands which can be executed as a non-root user are are preceded
by a dollar sign ($) prompt.</description>
      </Group>
    </Group>
    <Group id="xccdf_org.ssgproject.content_group_general-principles">
      <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">General Principles</title>
      <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The following general principles motivate much of the advice in this
guide and should also influence any configuration decisions that are
not explicitly covered.</description>
      <Group id="xccdf_org.ssgproject.content_group_principle-minimize-software">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Minimize Software to Minimize Vulnerability</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The simplest way to avoid vulnerabilities in software is to avoid
installing that software. On Fedora,the RPM Package Manager (originally Red Hat Package Manager, abbreviated RPM)
allows for careful management of
the set of software packages installed on a system. Installed software
contributes to system vulnerability in several ways. Packages that
include setuid programs may provide local attackers a potential path to
privilege escalation. Packages that include network services may give
this opportunity to network-based attackers. Packages that include
programs which are predictably executed by local users (e.g. after
graphical login) may provide opportunities for trojan horses or other
attack code to be run undetected. The number of software packages
installed on a system can almost always be significantly pruned to include
only the software for which there is an environmental or operational need.</description>
      </Group>
      <Group id="xccdf_org.ssgproject.content_group_principle-encrypt-transmitted-data">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Encrypt Transmitted Data Whenever Possible</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Data transmitted over a network, whether wired or wireless, is susceptible
to passive monitoring. Whenever practical solutions for encrypting
such data exist, they should be applied. Even if data is expected to
be transmitted only over a local network, it should still be encrypted.
Encrypting authentication data, such as passwords, is particularly
important. Networks of Fedora machines can and should be configured
so that no unencrypted authentication data is ever transmitted between
machines.</description>
      </Group>
      <Group id="xccdf_org.ssgproject.content_group_principle-separate-servers">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Run Different Network Services on Separate Systems</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Whenever possible, a server should be dedicated to serving exactly one
network service. This limits the number of other services that can
be compromised in the event that an attacker is able to successfully
exploit a software flaw in one network service.</description>
      </Group>
      <Group id="xccdf_org.ssgproject.content_group_principle-least-privilege">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Least Privilege</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Grant the least privilege necessary for user accounts and software to perform tasks.
For example, <html:code xmlns:html="http://www.w3.org/1999/xhtml">sudo</html:code> can be implemented to limit authorization to super user
accounts on the system only to designated personnel. Another example is to limit
logins on server systems to only those administrators who need to log into them in
order to perform administration tasks. Using SELinux also follows the principle of
least privilege: SELinux policy can confine software to perform only actions on the
system that are specifically allowed. This can be far more restrictive than the
actions permissible by the traditional Unix permissions model.</description>
      </Group>
      <Group id="xccdf_org.ssgproject.content_group_principle-use-security-tools">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Configure Security Tools to Improve System Robustness</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Several tools exist which can be effectively used to improve a system's
resistance to and detection of unknown attacks. These tools can improve
robustness against attack at the cost of relatively little configuration
effort. In particular, this guide recommends and discusses the use of
host-based firewalling, SELinux for protection against
vulnerable services, and a logging and auditing infrastructure for
detection of problems.</description>
      </Group>
    </Group>
  </Group>
  <TestResult id="xccdf_org.open-scap_testresult_xccdf_org.ssgproject.content_profile_ospp_customized" start-time="2021-08-16T15:11:58+01:00" end-time="2021-08-16T15:24:09+01:00" version="0.1.56" test-system="cpe:/a:redhat:openscap:1.3.5">
    <benchmark href="/tmp/scap-workbench-HxoWcp/ssg-fedora-ds.xml" id="xccdf_org.ssgproject.content_benchmark_FEDORA"/>
    <title>OSCAP Scan Result</title>
    <identity authenticated="false" privileged="false">jrodak</identity>
    <profile idref="xccdf_org.ssgproject.content_profile_ospp_customized"/>
    <target>rh-hony</target>
    <target-address>127.0.0.1</target-address>
    <target-address>10.43.21.233</target-address>
    <target-address>10.200.153.45</target-address>
    <target-address>192.168.122.1</target-address>
    <target-address>0:0:0:0:0:0:0:1</target-address>
    <target-address>2620:52:0:2b15:76a6:117d:1d6:7579</target-address>
    <target-address>fe80:0:0:0:648:e757:55c:e02e</target-address>
    <target-address>fe80:0:0:0:3bc2:6468:e470:d804</target-address>
    <target-address>fe80:0:0:0:fc21:e6ff:feca:b1f9</target-address>
    <target-facts>
      <fact name="urn:xccdf:fact:scanner:name" type="string">OpenSCAP</fact>
      <fact name="urn:xccdf:fact:scanner:version" type="string">1.3.5</fact>
      <fact name="urn:xccdf:fact:asset:identifier:fqdn" type="string">rh-hony</fact>
      <fact name="urn:xccdf:fact:asset:identifier:host_name" type="string">rh-hony</fact>
      <fact name="urn:xccdf:fact:ethernet:MAC" type="string">00:00:00:00:00:00</fact>
      <fact name="urn:xccdf:fact:asset:identifier:mac" type="string">00:00:00:00:00:00</fact>
      <fact name="urn:xccdf:fact:ethernet:MAC" type="string">00:50:B6:8E:49:DA</fact>
      <fact name="urn:xccdf:fact:asset:identifier:mac" type="string">00:50:B6:8E:49:DA</fact>
      <fact name="urn:xccdf:fact:ethernet:MAC" type="string">00:2B:67:04:65:C0</fact>
      <fact name="urn:xccdf:fact:asset:identifier:mac" type="string">00:2B:67:04:65:C0</fact>
      <fact name="urn:xccdf:fact:ethernet:MAC" type="string">74:D8:3E:1A:0C:3E</fact>
      <fact name="urn:xccdf:fact:asset:identifier:mac" type="string">74:D8:3E:1A:0C:3E</fact>
      <fact name="urn:xccdf:fact:ethernet:MAC" type="string">52:54:00:E8:16:C5</fact>
      <fact name="urn:xccdf:fact:asset:identifier:mac" type="string">52:54:00:E8:16:C5</fact>
      <fact name="urn:xccdf:fact:ethernet:MAC" type="string">FE:21:E6:CA:B1:F9</fact>
      <fact name="urn:xccdf:fact:asset:identifier:mac" type="string">FE:21:E6:CA:B1:F9</fact>
      <fact name="urn:xccdf:fact:asset:identifier:ipv4" type="string">127.0.0.1</fact>
      <fact name="urn:xccdf:fact:asset:identifier:ipv4" type="string">10.43.21.233</fact>
      <fact name="urn:xccdf:fact:asset:identifier:ipv4" type="string">10.200.153.45</fact>
      <fact name="urn:xccdf:fact:asset:identifier:ipv4" type="string">192.168.122.1</fact>
      <fact name="urn:xccdf:fact:asset:identifier:ipv6" type="string">::1</fact>
      <fact name="urn:xccdf:fact:asset:identifier:ipv6" type="string">2620:52:0:2b15:76a6:117d:1d6:7579</fact>
      <fact name="urn:xccdf:fact:asset:identifier:ipv6" type="string">fe80::648:e757:55c:e02e</fact>
      <fact name="urn:xccdf:fact:asset:identifier:ipv6" type="string">fe80::3bc2:6468:e470:d804</fact>
      <fact name="urn:xccdf:fact:asset:identifier:ipv6" type="string">fe80::fc21:e6ff:feca:b1f9</fact>
    </target-facts>
    <platform idref="cpe:/a:libuser"/>
    <platform idref="cpe:/a:chrony"/>
    <platform idref="cpe:/a:not_s390x_arch"/>
    <platform idref="cpe:/a:pam"/>
    <platform idref="cpe:/a:gdm"/>
    <platform idref="cpe:/a:uefi"/>
    <platform idref="cpe:/o:fedoraproject:fedora:32"/>
    <platform idref="cpe:/a:grub2"/>
    <platform idref="cpe:/a:sudo"/>
    <platform idref="cpe:/a:login_defs"/>
    <platform idref="cpe:/a:sssd"/>
    <platform idref="cpe:/a:machine"/>
    <platform idref="cpe:/a:yum"/>
    <set-value idref="xccdf_org.ssgproject.content_value_function_create_audit_remediation_unsuccessful_file_modification_detailed">function create_audit_remediation_unsuccessful_file_modification_detailed {
	mkdir -p "$(dirname "$1")"
	# The - option to mark a here document limit string (&lt;&lt;-EOF) suppresses leading tabs (but not spaces) in the output.
	cat &lt;&lt;-EOF &gt; "$1"
		## This content is a section of an Audit config snapshot recommended for linux systems that target OSPP compliance.
		## The following content has been retreived on 2019-03-11 from: https://github.com/linux-audit/audit-userspace/blob/master/rules/30-ospp-v42.rules

		## The purpose of these rules is to meet the requirements for Operating
		## System Protection Profile (OSPP)v4.2. These rules depends on having
		## 10-base-config.rules, 11-loginuid.rules, and 43-module-load.rules installed.

		## Unsuccessful file creation (open with O_CREAT)
		-a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&amp;0100 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
		-a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&amp;0100 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
		-a always,exit -F arch=b32 -S open -F a1&amp;0100 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
		-a always,exit -F arch=b64 -S open -F a1&amp;0100 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
		-a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&amp;0100 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
		-a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&amp;0100 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
		-a always,exit -F arch=b32 -S open -F a1&amp;0100 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
		-a always,exit -F arch=b64 -S open -F a1&amp;0100 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
		-a always,exit -F arch=b32 -S creat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
		-a always,exit -F arch=b64 -S creat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
		-a always,exit -F arch=b32 -S creat -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
		-a always,exit -F arch=b64 -S creat -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create

		## Unsuccessful file modifications (open for write or truncate)
		-a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&amp;01003 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
		-a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&amp;01003 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
		-a always,exit -F arch=b32 -S open -F a1&amp;01003 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
		-a always,exit -F arch=b64 -S open -F a1&amp;01003 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
		-a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&amp;01003 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
		-a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&amp;01003 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
		-a always,exit -F arch=b32 -S open -F a1&amp;01003 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
		-a always,exit -F arch=b64 -S open -F a1&amp;01003 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
		-a always,exit -F arch=b32 -S truncate,ftruncate -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
		-a always,exit -F arch=b64 -S truncate,ftruncate -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
		-a always,exit -F arch=b32 -S truncate,ftruncate -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
		-a always,exit -F arch=b64 -S truncate,ftruncate -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification

		## Unsuccessful file access (any other opens) This has to go last.
		-a always,exit -F arch=b32 -S open,creat,truncate,ftruncate,openat,open_by_handle_at -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-access
		-a always,exit -F arch=b64 -S open,creat,truncate,ftruncate,openat,open_by_handle_at -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-access
		-a always,exit -F arch=b32 -S open,creat,truncate,ftruncate,openat,open_by_handle_at -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-access
		-a always,exit -F arch=b64 -S open,creat,truncate,ftruncate,openat,open_by_handle_at -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-access
	EOF
}</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_function_die"># Print a message to stderr and exit the shell
# $1: The message to print.
# $2: The error code (optional, default is 1)
function die {
	local _message="$1" _rc="${2:-1}"
	printf '%s\n' "$_message" &gt;&amp;2
	exit "$_rc"
}</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_function_ensure_pam_module_options">function ensure_pam_module_options {
	if [ $# -lt 7 ] || [ $# -gt 8 ] ; then
                echo "$0 requires seven or eight arguments" &gt;&amp;2
                exit 1
        fi
	local _pamFile="$1" _type="$2" _control="$3" _module="$4" _option="$5" _valueRegex="$6" _defaultValue="$7"
	local _remove_argument=""
	if [ $# -eq 8 ] ; then
        	_remove_argument="$8"
		# convert it to lowercase
		_remove_argument=${_remove_argument,,}
	fi

	# make sure that we have a line like this in ${_pamFile} (additional options are left as-is):
	# ${_type} ${_control} ${_module} ${_option}=${_valueRegex}

	if ! [ -e "$_pamFile" ] ; then
		echo "$_pamFile doesn't exist" &gt;&amp;2
		exit 1
	fi

	# if remove argument only
	if [ "${_remove_argument}" = "yes" -o "${_remove_argument}" = "true" ] ; then
		sed --follow-symlinks -i -E -e "s/^(\\s*${_type}\\s+\\S+\\s+${_module}(\\s.+)?)\\s${_option}(=\\S+)?/\\1/" "${_pamFile}"
		exit 0
	fi

	# non-empty values need to be preceded by an equals sign
	[ -n "${_valueRegex}" ] &amp;&amp; _valueRegex="=${_valueRegex}"
	# add an equals sign to non-empty values
	[ -n "${_defaultValue}" ] &amp;&amp; _defaultValue="=${_defaultValue}"

	# fix 'type' if it's wrong
	if grep -q -P "^\\s*(?"'!'"${_type}\\s)[[:alnum:]]+\\s+[[:alnum:]]+\\s+${_module}" &lt; "${_pamFile}" ; then
		sed --follow-symlinks -i -E -e "s/^(\\s*)[[:alnum:]]+(\\s+[[:alnum:]]+\\s+${_module})/\\1${_type}\\2/" "${_pamFile}"
	fi

	# fix 'control' if it's wrong
	if grep -q -P "^\\s*${_type}\\s+(?"'!'"${_control})[[:alnum:]]+\\s+${_module}" &lt; "${_pamFile}" ; then
		sed --follow-symlinks -i -E -e "s/^(\\s*${_type}\\s+)[[:alnum:]]+(\\s+${_module})/\\1${_control}\\2/" "${_pamFile}"
	fi

	# fix the value for 'option' if one exists but does not match '_valueRegex'
    if grep -q -P "^\\s*${_type}\\s+${_control}\\s+${_module}(\\s.+)?\\s+${_option}(?"'!'"${_valueRegex}(\\s|\$))" &lt; "${_pamFile}" ; then
		sed --follow-symlinks -i -E -e "s/^(\\s*${_type}\\s+${_control}\\s+${_module}(\\s.+)?\\s)${_option}=[^[:space:]]+/\\1${_option}${_defaultValue}/" "${_pamFile}"

    # add 'option=default' if option is not set
	elif grep -q -E "^\\s*${_type}\\s+${_control}\\s+${_module}" &lt; "${_pamFile}" &amp;&amp;
         grep    -E "^\\s*${_type}\\s+${_control}\\s+${_module}" &lt; "${_pamFile}" | grep -q -E -v "\\s${_option}(=|\\s|\$)" ; then

		sed --follow-symlinks -i -E -e "s/^(\\s*${_type}\\s+${_control}\\s+${_module}[^\\n]*)/\\1 ${_option}${_defaultValue}/" "${_pamFile}"
	# add a new entry if none exists
	elif ! grep -q -P "^\\s*${_type}\\s+${_control}\\s+${_module}(\\s.+)?\\s+${_option}${_valueRegex}(\\s|\$)" &lt; "${_pamFile}" ; then
		echo "${_type} ${_control} ${_module} ${_option}${_defaultValue}" &gt;&gt; "${_pamFile}"
	fi
}</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_function_fix_audit_syscall_rule"># Function to fix syscall audit rule for given system call. It is
# based on example audit syscall rule definitions as outlined in
# /usr/share/doc/audit-2.3.7/stig.rules file provided with the audit
# package. It will combine multiple system calls belonging to the same
# syscall group into one audit rule (rather than to create audit rule per
# different system call) to avoid audit infrastructure performance penalty
# in the case of 'one-audit-rule-definition-per-one-system-call'. See:
#
#   https://www.redhat.com/archives/linux-audit/2014-November/msg00009.html
#
# for further details.
#
# Expects five arguments (each of them is required) in the form of:
# * audit tool				tool used to load audit rules,
# 					either 'auditctl', or 'augenrules
# * audit rules' pattern		audit rule skeleton for same syscall
# * syscall group			greatest common string this rule shares
# 					with other rules from the same group
# * architecture			architecture this rule is intended for
# * full form of new rule to add	expected full form of audit rule as to be
# 					added into audit.rules file
#
# Note: The 2-th up to 4-th arguments are used to determine how many existing
# audit rules will be inspected for resemblance with the new audit rule
# (5-th argument) the function is going to add. The rule's similarity check
# is performed to optimize audit.rules definition (merge syscalls of the same
# group into one rule) to avoid the "single-syscall-per-audit-rule" performance
# penalty.
#
# Example call:
#
#	See e.g. 'audit_rules_file_deletion_events.sh' remediation script
#
function fix_audit_syscall_rule {

# Load function arguments into local variables
local tool="$1"
local pattern="$2"
local group="$3"
local arch="$4"
local full_rule="$5"

# Check sanity of the input
if [ $# -ne "5" ]
then
	echo "Usage: fix_audit_syscall_rule 'tool' 'pattern' 'group' 'arch' 'full rule'"
	echo "Aborting."
	exit 1
fi

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
# 
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
declare -a files_to_inspect

retval=0

# First check sanity of the specified audit tool
if [ "$tool" != 'auditctl' ] &amp;&amp; [ "$tool" != 'augenrules' ]
then
	echo "Unknown audit rules loading tool: $1. Aborting."
	echo "Use either 'auditctl' or 'augenrules'!"
	return 1
# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
elif [ "$tool" == 'auditctl' ]
then
	files_to_inspect+=('/etc/audit/audit.rules' )
# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
elif [ "$tool" == 'augenrules' ]
then
	# Extract audit $key from audit rule so we can use it later
	matches=()
	key=$(expr "$full_rule" : '.*-k[[:space:]]\([^[:space:]]\+\)' '|' "$full_rule" : '.*-F[[:space:]]key=\([^[:space:]]\+\)')
	readarray -t matches &lt; &lt;(sed -s -n -e "\;${pattern};!d" -e "/${arch}/!d" -e "/${group}/!d;F" /etc/audit/rules.d/*.rules)
	if [ $? -ne 0 ]
	then
		retval=1
	fi
	for match in "${matches[@]}"
	do
		files_to_inspect+=("${match}")
	done
	# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
	if [ ${#files_to_inspect[@]} -eq "0" ]
	then
		file_to_inspect="/etc/audit/rules.d/$key.rules"
		files_to_inspect=("$file_to_inspect")
		if [ ! -e "$file_to_inspect" ]
		then
			touch "$file_to_inspect"
			chmod 0640 "$file_to_inspect"
		fi
	fi
fi

#
# Indicator that we want to append $full_rule into $audit_file by default
local append_expected_rule=0

for audit_file in "${files_to_inspect[@]}"
do
	# Filter existing $audit_file rules' definitions to select those that:
	# * follow the rule pattern, and
	# * meet the hardware architecture requirement, and
	# * are current syscall group specific
	readarray -t existing_rules &lt; &lt;(sed -e "\;${pattern};!d" -e "/${arch}/!d" -e "/${group}/!d"  "$audit_file")
	if [ $? -ne 0 ]
	then
		retval=1
	fi

	# Process rules found case-by-case
	for rule in "${existing_rules[@]}"
	do
		# Found rule is for same arch &amp; key, but differs (e.g. in count of -S arguments)
		if [ "${rule}" != "${full_rule}" ]
		then
			# If so, isolate just '(-S \w)+' substring of that rule
			rule_syscalls=$(echo "$rule" | grep -o -P '(-S \w+ )+')
			# Check if list of '-S syscall' arguments of that rule is subset
			# of '-S syscall' list of expected $full_rule
			if grep -q -- "$rule_syscalls" &lt;&lt;&lt; "$full_rule"
			then
				# Rule is covered (i.e. the list of -S syscalls for this rule is
				# subset of -S syscalls of $full_rule =&gt; existing rule can be deleted
				# Thus delete the rule from audit.rules &amp; our array
				sed -i -e "\;${rule};d" "$audit_file"
				if [ $? -ne 0 ]
				then
					retval=1
				fi
				existing_rules=("${existing_rules[@]//$rule/}")
			else
				# Rule isn't covered by $full_rule - it besides -S syscall arguments
				# for this group contains also -S syscall arguments for other syscall
				# group. Example: '-S lchown -S fchmod -S fchownat' =&gt; group='chown'
				# since 'lchown' &amp; 'fchownat' share 'chown' substring
				# Therefore:
				# * 1) delete the original rule from audit.rules
				# (original '-S lchown -S fchmod -S fchownat' rule would be deleted)
				# * 2) delete the -S syscall arguments for this syscall group, but
				# keep those not belonging to this syscall group
				# (original '-S lchown -S fchmod -S fchownat' would become '-S fchmod'
				# * 3) append the modified (filtered) rule again into audit.rules
				# if the same rule not already present
				#
				# 1) Delete the original rule
				sed -i -e "\;${rule};d" "$audit_file"
				if [ $? -ne 0 ]
				then
					retval=1
				fi

				# 2) Delete syscalls for this group, but keep those from other groups
				# Convert current rule syscall's string into array splitting by '-S' delimiter
				IFS_BKP="$IFS"
				IFS=$'-S'
				read -a rule_syscalls_as_array &lt;&lt;&lt; "$rule_syscalls"
				# Reset IFS back to default
				IFS="$IFS_BKP"
				# Splitting by "-S" can't be replaced by the readarray functionality easily

				# Declare new empty string to hold '-S syscall' arguments from other groups
				new_syscalls_for_rule=''
				# Walk through existing '-S syscall' arguments
				for syscall_arg in "${rule_syscalls_as_array[@]}"
				do
					# Skip empty $syscall_arg values
					if [ "$syscall_arg" == '' ]
					then
						continue
					fi
					# If the '-S syscall' doesn't belong to current group add it to the new list
					# (together with adding '-S' delimiter back for each of such item found)
					if grep -q -v -- "$group" &lt;&lt;&lt; "$syscall_arg"
					then
						new_syscalls_for_rule="$new_syscalls_for_rule -S $syscall_arg"
					fi
				done
				# Replace original '-S syscall' list with the new one for this rule
				updated_rule=${rule//$rule_syscalls/$new_syscalls_for_rule}
				# Squeeze repeated whitespace characters in rule definition (if any) into one
				updated_rule=$(echo "$updated_rule" | tr -s '[:space:]')
				# 3) Append the modified / filtered rule again into audit.rules
				#    (but only in case it's not present yet to prevent duplicate definitions)
				if ! grep -q -- "$updated_rule" "$audit_file"
				then
					echo "$updated_rule" &gt;&gt; "$audit_file"
				fi
			fi
		else
			# $audit_file already contains the expected rule form for this
			# architecture &amp; key =&gt; don't insert it second time
			append_expected_rule=1
		fi
	done

	# We deleted all rules that were subset of the expected one for this arch &amp; key.
	# Also isolated rules containing system calls not from this system calls group.
	# Now append the expected rule if it's not present in $audit_file yet
	if [[ ${append_expected_rule} -eq "0" ]]
	then
		echo "$full_rule" &gt;&gt; "$audit_file"
	fi
done

return $retval

}</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_function_fix_audit_watch_rule"># Function to fix audit file system object watch rule for given path:
# * if rule exists, also verifies the -w bits match the requirements
# * if rule doesn't exist yet, appends expected rule form to $files_to_inspect
#   audit rules file, depending on the tool which was used to load audit rules
#
# Expects four arguments (each of them is required) in the form of:
# * audit tool				tool used to load audit rules,
# 					either 'auditctl', or 'augenrules'
# * path                        	value of -w audit rule's argument
# * required access bits        	value of -p audit rule's argument
# * key                         	value of -k audit rule's argument
#
# Example call:
#
#       fix_audit_watch_rule "auditctl" "/etc/localtime" "wa" "audit_time_rules"
#
function fix_audit_watch_rule {

# Load function arguments into local variables
local tool="$1"
local path="$2"
local required_access_bits="$3"
local key="$4"

# Check sanity of the input
if [ $# -ne "4" ]
then
	echo "Usage: fix_audit_watch_rule 'tool' 'path' 'bits' 'key'"
	echo "Aborting."
	exit 1
fi

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
declare -a files_to_inspect
files_to_inspect=()

# Check sanity of the specified audit tool
if [ "$tool" != 'auditctl' ] &amp;&amp; [ "$tool" != 'augenrules' ]
then
	echo "Unknown audit rules loading tool: $1. Aborting."
	echo "Use either 'auditctl' or 'augenrules'!"
	exit 1
# If the audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# into the list of files to be inspected
elif [ "$tool" == 'auditctl' ]
then
	files_to_inspect+=('/etc/audit/audit.rules')
# If the audit is 'augenrules', then check if rule is already defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to list of files for inspection.
# If rule isn't defined, add '/etc/audit/rules.d/$key.rules' to list of files for inspection.
elif [ "$tool" == 'augenrules' ]
then
	readarray -t matches &lt; &lt;(grep -P "[\s]*-w[\s]+$path" /etc/audit/rules.d/*.rules)

	# For each of the matched entries
	for match in "${matches[@]}"
	do
		# Extract filepath from the match
		rulesd_audit_file=$(echo $match | cut -f1 -d ':')
		# Append that path into list of files for inspection
		files_to_inspect+=("$rulesd_audit_file")
	done
	# Case when particular audit rule isn't defined yet
	if [ "${#files_to_inspect[@]}" -eq "0" ]
	then
		# Append '/etc/audit/rules.d/$key.rules' into list of files for inspection
		local key_rule_file="/etc/audit/rules.d/$key.rules"
		# If the $key.rules file doesn't exist yet, create it with correct permissions
		if [ ! -e "$key_rule_file" ]
		then
			touch "$key_rule_file"
			chmod 0640 "$key_rule_file"
		fi

		files_to_inspect+=("$key_rule_file")
	fi
fi

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do

	# Check if audit watch file system object rule for given path already present
	if grep -q -P -- "[\s]*-w[\s]+$path" "$audit_rules_file"
	then
		# Rule is found =&gt; verify yet if existing rule definition contains
		# all of the required access type bits

		# Escape slashes in path for use in sed pattern below
		local esc_path=${path//$'/'/$'\/'}
		# Define BRE whitespace class shortcut
		local sp="[[:space:]]"
		# Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
		current_access_bits=$(sed -ne "s/$sp*-w$sp\+$esc_path$sp\+-p$sp\+\([rxwa]\{1,4\}\).*/\1/p" "$audit_rules_file")
		# Split required access bits string into characters array
		# (to check bit's presence for one bit at a time)
		for access_bit in $(echo "$required_access_bits" | grep -o .)
		do
			# For each from the required access bits (e.g. 'w', 'a') check
			# if they are already present in current access bits for rule.
			# If not, append that bit at the end
			if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
			then
				# Concatenate the existing mask with the missing bit
				current_access_bits="$current_access_bits$access_bit"
			fi
		done
		# Propagate the updated rule's access bits (original + the required
		# ones) back into the /etc/audit/audit.rules file for that rule
		sed -i "s/\($sp*-w$sp\+$esc_path$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)/\1$current_access_bits\3/" "$audit_rules_file"
	else
		# Rule isn't present yet. Append it at the end of $audit_rules_file file
		# with proper key

		echo "-w $path -p $required_access_bits -k $key" &gt;&gt; "$audit_rules_file"
	fi
done
}</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_function_include_merge_files_by_lines">function include_merge_files_by_lines {
	:
}

# 1: Filename of the "master" file
# 2: Filename of the newly created file
function create_empty_file_like {
	local lines_count
	lines_count=$(cat "$1" | wc -l)
	for _ in $(seq 1 "$lines_count"); do
		printf '\n' &gt;&gt; "$2"
	done
}


# 1: Filename of the "master" file
# 2: Filename of sample flie
function second_file_is_same_except_newlines {
	local lines_of_master lines_of_sample len_of_master line_number i
	readarray -t lines_of_master &lt; "$1"
	readarray -t lines_of_sample &lt; "$2"

	len_of_master="${#lines_of_master[@]}"
	if test "$len_of_master" != "${#lines_of_sample[@]}"; then
		echo "Files '$1' and '$2' have different number of lines, $len_of_master and ${#lines_of_sample[@]} respectively."
		return 1
	fi

	for line_number in $(seq 1 "$len_of_master"); do
		i=$((line_number - 1))
		test -n "${lines_of_sample[$i]}" || continue
		if test "${lines_of_master[$i]}" != "${lines_of_sample[$i]}"; then
			echo "Line $line_number is different in files '$1' and '$2'."
			return 1
		fi
	done
}


# 1: Filename of the "master" file
# 2: Filename of sample flie
# 3: List of indices (1-based, space-separated string)
function merge_first_lines_to_second_on_indices {
	local lines_of_master lines_of_sample line_number i
	test -f "$2" || create_empty_file_like "$1" "$2"

	readarray -t lines_of_master &lt; "$1"
	readarray -t lines_of_sample &lt; "$2"

	error_msg="$(second_file_is_same_except_newlines "$1" "$2")"
	if test $? != 0; then
		echo "Error merging lines into '$2': $error_msg" &gt;&amp;2
		return 1
	fi

	for line_number in $3; do
		i=$((line_number - 1))
		lines_of_sample[$i]="${lines_of_master[$i]}"
	done

	printf "%s\n" "${lines_of_sample[@]}" &gt; "$2"
}</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_function_include_mount_options_functions">function include_mount_options_functions {
	:
}

# $1: type of filesystem
# $2: new mount point option
# $3: filesystem of new mount point (used when adding new entry in fstab)
# $4: mount type of new mount point (used when adding new entry in fstab)
function ensure_mount_option_for_vfstype {
        local _vfstype="$1" _new_opt="$2" _filesystem=$3 _type=$4 _vfstype_points=()
        readarray -t _vfstype_points &lt; &lt;(grep -E "[[:space:]]${_vfstype}[[:space:]]" /etc/fstab | awk '{print $2}')

        for _vfstype_point in "${_vfstype_points[@]}"
        do
                ensure_mount_option_in_fstab "$_vfstype_point" "$_new_opt" "$_filesystem" "$_type"
        done
}

# $1: mount point
# $2: new mount point option
# $3: device or virtual string (used when adding new entry in fstab)
# $4: mount type of mount point (used when adding new entry in fstab)
function ensure_mount_option_in_fstab {
	local _mount_point="$1" _new_opt="$2" _device=$3 _type=$4
	local _mount_point_match_regexp="" _previous_mount_opts=""
	_mount_point_match_regexp="$(get_mount_point_regexp "$_mount_point")"

	if [ "$(grep -c "$_mount_point_match_regexp" /etc/fstab)" -eq 0 ]; then
		# runtime opts without some automatic kernel/userspace-added defaults
		_previous_mount_opts=$(grep "$_mount_point_match_regexp" /etc/mtab | head -1 |  awk '{print $4}' \
					| sed -E "s/(rw|defaults|seclabel|${_new_opt})(,|$)//g;s/,$//")
		[ "$_previous_mount_opts" ] &amp;&amp; _previous_mount_opts+=","
		echo "${_device} ${_mount_point} ${_type} defaults,${_previous_mount_opts}${_new_opt} 0 0" &gt;&gt; /etc/fstab
	elif [ "$(grep "$_mount_point_match_regexp" /etc/fstab | grep -c "$_new_opt")" -eq 0 ]; then
		_previous_mount_opts=$(grep "$_mount_point_match_regexp" /etc/fstab | awk '{print $4}')
		sed -i "s|\(${_mount_point_match_regexp}.*${_previous_mount_opts}\)|\1,${_new_opt}|" /etc/fstab
	fi
}

# $1: mount point
function get_mount_point_regexp {
		printf "[[:space:]]%s[[:space:]]" "$1"
}

# $1: mount point
function assert_mount_point_in_fstab {
	local _mount_point_match_regexp
	_mount_point_match_regexp="$(get_mount_point_regexp "$1")"
	grep "$_mount_point_match_regexp" -q /etc/fstab \
		|| { echo "The mount point '$1' is not even in /etc/fstab, so we can't set up mount options" &gt;&amp;2; return 1; }
}

# $1: mount point
function remove_defaults_from_fstab_if_overriden {
	local _mount_point_match_regexp
	_mount_point_match_regexp="$(get_mount_point_regexp "$1")"
	if grep "$_mount_point_match_regexp" /etc/fstab | grep -q "defaults,"
	then
		sed -i "s|\(${_mount_point_match_regexp}.*\)defaults,|\1|" /etc/fstab
	fi
}

# $1: mount point
function ensure_partition_is_mounted {
	local _mount_point="$1"
	mkdir -p "$_mount_point" || return 1
	if mountpoint -q "$_mount_point"; then
		mount -o remount --target "$_mount_point"
	else
		mount --target "$_mount_point"
	fi
}</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_function_perform_audit_adjtimex_settimeofday_stime_remediation"># Function to fix syscall audit rule for given system call. It is
# based on example audit syscall rule definitions as outlined in
# /usr/share/doc/audit-2.3.7/stig.rules file provided with the audit
# package. It will combine multiple system calls belonging to the same
# syscall group into one audit rule (rather than to create audit rule per
# different system call) to avoid audit infrastructure performance penalty
# in the case of 'one-audit-rule-definition-per-one-system-call'. See:
#
#   https://www.redhat.com/archives/linux-audit/2014-November/msg00009.html
#
# for further details.
#
# Expects five arguments (each of them is required) in the form of:
# * audit tool				tool used to load audit rules,
# 					either 'auditctl', or 'augenrules
# * audit rules' pattern		audit rule skeleton for same syscall
# * syscall group			greatest common string this rule shares
# 					with other rules from the same group
# * architecture			architecture this rule is intended for
# * full form of new rule to add	expected full form of audit rule as to be
# 					added into audit.rules file
#
# Note: The 2-th up to 4-th arguments are used to determine how many existing
# audit rules will be inspected for resemblance with the new audit rule
# (5-th argument) the function is going to add. The rule's similarity check
# is performed to optimize audit.rules definition (merge syscalls of the same
# group into one rule) to avoid the "single-syscall-per-audit-rule" performance
# penalty.
#
# Example call:
#
#	See e.g. 'audit_rules_file_deletion_events.sh' remediation script
#
function fix_audit_syscall_rule {

# Load function arguments into local variables
local tool="$1"
local pattern="$2"
local group="$3"
local arch="$4"
local full_rule="$5"

# Check sanity of the input
if [ $# -ne "5" ]
then
	echo "Usage: fix_audit_syscall_rule 'tool' 'pattern' 'group' 'arch' 'full rule'"
	echo "Aborting."
	exit 1
fi

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
# 
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
declare -a files_to_inspect

retval=0

# First check sanity of the specified audit tool
if [ "$tool" != 'auditctl' ] &amp;&amp; [ "$tool" != 'augenrules' ]
then
	echo "Unknown audit rules loading tool: $1. Aborting."
	echo "Use either 'auditctl' or 'augenrules'!"
	return 1
# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
elif [ "$tool" == 'auditctl' ]
then
	files_to_inspect+=('/etc/audit/audit.rules' )
# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
elif [ "$tool" == 'augenrules' ]
then
	# Extract audit $key from audit rule so we can use it later
	matches=()
	key=$(expr "$full_rule" : '.*-k[[:space:]]\([^[:space:]]\+\)' '|' "$full_rule" : '.*-F[[:space:]]key=\([^[:space:]]\+\)')
	readarray -t matches &lt; &lt;(sed -s -n -e "\;${pattern};!d" -e "/${arch}/!d" -e "/${group}/!d;F" /etc/audit/rules.d/*.rules)
	if [ $? -ne 0 ]
	then
		retval=1
	fi
	for match in "${matches[@]}"
	do
		files_to_inspect+=("${match}")
	done
	# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
	if [ ${#files_to_inspect[@]} -eq "0" ]
	then
		file_to_inspect="/etc/audit/rules.d/$key.rules"
		files_to_inspect=("$file_to_inspect")
		if [ ! -e "$file_to_inspect" ]
		then
			touch "$file_to_inspect"
			chmod 0640 "$file_to_inspect"
		fi
	fi
fi

#
# Indicator that we want to append $full_rule into $audit_file by default
local append_expected_rule=0

for audit_file in "${files_to_inspect[@]}"
do
	# Filter existing $audit_file rules' definitions to select those that:
	# * follow the rule pattern, and
	# * meet the hardware architecture requirement, and
	# * are current syscall group specific
	readarray -t existing_rules &lt; &lt;(sed -e "\;${pattern};!d" -e "/${arch}/!d" -e "/${group}/!d"  "$audit_file")
	if [ $? -ne 0 ]
	then
		retval=1
	fi

	# Process rules found case-by-case
	for rule in "${existing_rules[@]}"
	do
		# Found rule is for same arch &amp; key, but differs (e.g. in count of -S arguments)
		if [ "${rule}" != "${full_rule}" ]
		then
			# If so, isolate just '(-S \w)+' substring of that rule
			rule_syscalls=$(echo "$rule" | grep -o -P '(-S \w+ )+')
			# Check if list of '-S syscall' arguments of that rule is subset
			# of '-S syscall' list of expected $full_rule
			if grep -q -- "$rule_syscalls" &lt;&lt;&lt; "$full_rule"
			then
				# Rule is covered (i.e. the list of -S syscalls for this rule is
				# subset of -S syscalls of $full_rule =&gt; existing rule can be deleted
				# Thus delete the rule from audit.rules &amp; our array
				sed -i -e "\;${rule};d" "$audit_file"
				if [ $? -ne 0 ]
				then
					retval=1
				fi
				existing_rules=("${existing_rules[@]//$rule/}")
			else
				# Rule isn't covered by $full_rule - it besides -S syscall arguments
				# for this group contains also -S syscall arguments for other syscall
				# group. Example: '-S lchown -S fchmod -S fchownat' =&gt; group='chown'
				# since 'lchown' &amp; 'fchownat' share 'chown' substring
				# Therefore:
				# * 1) delete the original rule from audit.rules
				# (original '-S lchown -S fchmod -S fchownat' rule would be deleted)
				# * 2) delete the -S syscall arguments for this syscall group, but
				# keep those not belonging to this syscall group
				# (original '-S lchown -S fchmod -S fchownat' would become '-S fchmod'
				# * 3) append the modified (filtered) rule again into audit.rules
				# if the same rule not already present
				#
				# 1) Delete the original rule
				sed -i -e "\;${rule};d" "$audit_file"
				if [ $? -ne 0 ]
				then
					retval=1
				fi

				# 2) Delete syscalls for this group, but keep those from other groups
				# Convert current rule syscall's string into array splitting by '-S' delimiter
				IFS_BKP="$IFS"
				IFS=$'-S'
				read -a rule_syscalls_as_array &lt;&lt;&lt; "$rule_syscalls"
				# Reset IFS back to default
				IFS="$IFS_BKP"
				# Splitting by "-S" can't be replaced by the readarray functionality easily

				# Declare new empty string to hold '-S syscall' arguments from other groups
				new_syscalls_for_rule=''
				# Walk through existing '-S syscall' arguments
				for syscall_arg in "${rule_syscalls_as_array[@]}"
				do
					# Skip empty $syscall_arg values
					if [ "$syscall_arg" == '' ]
					then
						continue
					fi
					# If the '-S syscall' doesn't belong to current group add it to the new list
					# (together with adding '-S' delimiter back for each of such item found)
					if grep -q -v -- "$group" &lt;&lt;&lt; "$syscall_arg"
					then
						new_syscalls_for_rule="$new_syscalls_for_rule -S $syscall_arg"
					fi
				done
				# Replace original '-S syscall' list with the new one for this rule
				updated_rule=${rule//$rule_syscalls/$new_syscalls_for_rule}
				# Squeeze repeated whitespace characters in rule definition (if any) into one
				updated_rule=$(echo "$updated_rule" | tr -s '[:space:]')
				# 3) Append the modified / filtered rule again into audit.rules
				#    (but only in case it's not present yet to prevent duplicate definitions)
				if ! grep -q -- "$updated_rule" "$audit_file"
				then
					echo "$updated_rule" &gt;&gt; "$audit_file"
				fi
			fi
		else
			# $audit_file already contains the expected rule form for this
			# architecture &amp; key =&gt; don't insert it second time
			append_expected_rule=1
		fi
	done

	# We deleted all rules that were subset of the expected one for this arch &amp; key.
	# Also isolated rules containing system calls not from this system calls group.
	# Now append the expected rule if it's not present in $audit_file yet
	if [[ ${append_expected_rule} -eq "0" ]]
	then
		echo "$full_rule" &gt;&gt; "$audit_file"
	fi
done

return $retval

}


# Function to perform remediation for the 'adjtimex', 'settimeofday', and 'stime' audit
# system calls on RHEL, Fedora or OL systems.
# Remediation performed for both possible tools: 'auditctl' and 'augenrules'.
#
# Note: 'stime' system call isn't known at 64-bit arch (see "$ ausyscall x86_64 stime" 's output)
# therefore excluded from the list of time group system calls to be audited on this arch
#
# Example Call:
#
#      perform_audit_adjtimex_settimeofday_stime_remediation
#
function perform_audit_adjtimex_settimeofday_stime_remediation {

# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do

	PATTERN="-a always,exit -F arch=${ARCH} -S .* -k *"
	# Create expected audit group and audit rule form for particular system call &amp; architecture
	if [ ${ARCH} = "b32" ]
	then
		# stime system call is known at 32-bit arch (see e.g "$ ausyscall i386 stime" 's output)
		# so append it to the list of time group system calls to be audited
		GROUP="\(adjtimex\|settimeofday\|stime\)"
		FULL_RULE="-a always,exit -F arch=${ARCH} -S adjtimex -S settimeofday -S stime -k audit_time_rules"
	elif [ ${ARCH} = "b64" ]
	then
		# stime system call isn't known at 64-bit arch (see "$ ausyscall x86_64 stime" 's output)
		# therefore don't add it to the list of time group system calls to be audited
		GROUP="\(adjtimex\|settimeofday\)"
		FULL_RULE="-a always,exit -F arch=${ARCH} -S adjtimex -S settimeofday -k audit_time_rules"
	fi
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	fix_audit_syscall_rule "auditctl" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
	fix_audit_syscall_rule "augenrules" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
done

}</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_function_perform_audit_rules_privileged_commands_remediation"># Function to perform remediation for 'audit_rules_privileged_commands' rule
#
# Expects two arguments:
#
# audit_tool		tool used to load audit rules
# 			One of 'auditctl' or 'augenrules'
#
# min_auid		Minimum original ID the user logged in with
#
# Example Call(s):
#
#      perform_audit_rules_privileged_commands_remediation "auditctl" "500"
#      perform_audit_rules_privileged_commands_remediation "augenrules"	"1000"
#
function perform_audit_rules_privileged_commands_remediation {
#
# Load function arguments into local variables
local tool="$1"
local min_auid="$2"

# Check sanity of the input
if [ $# -ne "2" ]
then
	echo "Usage: perform_audit_rules_privileged_commands_remediation 'auditctl | augenrules' '500 | 1000'"
	echo "Aborting."
	exit 1
fi

declare -a files_to_inspect=()

# Check sanity of the specified audit tool
if [ "$tool" != 'auditctl' ] &amp;&amp; [ "$tool" != 'augenrules' ]
then
	echo "Unknown audit rules loading tool: $1. Aborting."
	echo "Use either 'auditctl' or 'augenrules'!"
	exit 1
# If the audit tool is 'auditctl', then:
# * add '/etc/audit/audit.rules'to the list of files to be inspected,
# * specify '/etc/audit/audit.rules' as the output audit file, where
#   missing rules should be inserted
elif [ "$tool" == 'auditctl' ]
then
	files_to_inspect=("/etc/audit/audit.rules")
	output_audit_file="/etc/audit/audit.rules"
#
# If the audit tool is 'augenrules', then:
# * add '/etc/audit/rules.d/*.rules' to the list of files to be inspected
#   (split by newline),
# * specify /etc/audit/rules.d/privileged.rules' as the output file, where
#   missing rules should be inserted
elif [ "$tool" == 'augenrules' ]
then
	readarray -t files_to_inspect &lt; &lt;(find /etc/audit/rules.d -maxdepth 1 -type f -name '*.rules' -print)
	output_audit_file="/etc/audit/rules.d/privileged.rules"
fi

# Obtain the list of SUID/SGID binaries on the particular system (split by newline)
# into privileged_binaries array
privileged_binaries=()
readarray -t privileged_binaries &lt; &lt;(find / -not \( -fstype afs -o -fstype ceph -o -fstype cifs -o -fstype smb3 -o -fstype smbfs -o -fstype sshfs -o -fstype ncpfs -o -fstype ncp -o -fstype nfs -o -fstype nfs4 -o -fstype gfs -o -fstype gfs2 -o -fstype glusterfs -o -fstype gpfs -o -fstype pvfs2 -o -fstype ocfs2 -o -fstype lustre -o -fstype davfs -o -fstype fuse.sshfs \) -type f \( -perm -4000 -o -perm -2000 \) 2&gt; /dev/null)

# Keep list of SUID/SGID binaries that have been already handled within some previous iteration
declare -a sbinaries_to_skip=()

# For each found sbinary in privileged_binaries list
for sbinary in "${privileged_binaries[@]}"
do

	# Check if this sbinary wasn't already handled in some of the previous sbinary iterations
	# Return match only if whole sbinary definition matched (not in the case just prefix matched!!!)
	if [[ $(sed -ne "\|${sbinary}|p" &lt;&lt;&lt; "${sbinaries_to_skip[*]}") ]]
	then
		# If so, don't process it second time &amp; go to process next sbinary
		continue
	fi

	# Reset the counter of inspected files when starting to check
	# presence of existing audit rule for new sbinary
	local count_of_inspected_files=0

	# Define expected rule form for this binary
	expected_rule="-a always,exit -F path=${sbinary} -F auid&gt;=${min_auid} -F auid!=unset -F key=privileged"

	# If list of audit rules files to be inspected is empty, just add new rule and move on to next binary
	if [[ ${#files_to_inspect[@]} -eq 0 ]]; then
		echo "$expected_rule" &gt;&gt; "$output_audit_file"
		continue
	fi

	# Replace possible slash '/' character in sbinary definition so we could use it in sed expressions below
	sbinary_esc=${sbinary//$'/'/$'\/'}

	# For each audit rules file from the list of files to be inspected
	for afile in "${files_to_inspect[@]}"
	do

		# Search current audit rules file's content for match. Match criteria:
		# * existing rule is for the same SUID/SGID binary we are currently processing (but
		#   can contain multiple -F path= elements covering multiple SUID/SGID binaries)
		# * existing rule contains all arguments from expected rule form (though can contain
		#   them in arbitrary order)
	
		base_search=$(sed -e '/-a always,exit/!d' -e '/-F path='"${sbinary_esc}"'[^[:graph:]]/!d'		\
				-e '/-F path=[^[:space:]]\+/!d'						\
				-e '/-F auid&gt;='"${min_auid}"'/!d' -e '/-F auid!=\(4294967295\|unset\)/!d'	\
				-e '/-k \|-F key=/!d' "$afile")

		# Increase the count of inspected files for this sbinary
		count_of_inspected_files=$((count_of_inspected_files + 1))


		# Search current audit rules file's content for presence of rule pattern for this sbinary
		if [[ $base_search ]]
		then

			# Current audit rules file already contains rule for this binary =&gt;
			# Store the exact form of found rule for this binary for further processing
			concrete_rule=$base_search

			# Select all other SUID/SGID binaries possibly also present in the found rule

			readarray -t handled_sbinaries &lt; &lt;(grep -o -e "-F path=[^[:space:]]\+" &lt;&lt;&lt; "$concrete_rule")
			handled_sbinaries=("${handled_sbinaries[@]//-F path=/}")

			# Merge the list of such SUID/SGID binaries found in this iteration with global list ignoring duplicates
			readarray -t sbinaries_to_skip &lt; &lt;(for i in "${sbinaries_to_skip[@]}" "${handled_sbinaries[@]}"; do echo "$i"; done | sort -du)

			# if there is a -F perm flag, remove it
			if grep -q '.*-F\s\+perm=[rwxa]\+.*' &lt;&lt;&lt; "$concrete_rule"; then

				# Separate concrete_rule into three sections using hash '#'
				# sign as a delimiter around rule's permission section borders
				# note that the trailing space after perm flag is captured because there would be 
				# two consecutive spaces after joining remaining parts of the rule together
				concrete_rule="$(echo "$concrete_rule" | sed -n "s/\(.*\)\+\(-F perm=[rwax]\+\ \?\)\+/\1#\2#/p")"

				# Split concrete_rule into head, perm, and tail sections using hash '#' delimiter
				rule_head=$(cut -d '#' -f 1 &lt;&lt;&lt; "$concrete_rule")
				rule_perm=$(cut -d '#' -f 2 &lt;&lt;&lt; "$concrete_rule")
				rule_tail=$(cut -d '#' -f 3 &lt;&lt;&lt; "$concrete_rule")

				# Remove permissions section from existing rule in the file
				sed -i "s#${rule_head}\(.*\)${rule_tail}#${rule_head}${rule_tail}#" "$afile"
			fi
		# If the required audit rule for particular sbinary wasn't found yet, insert it under following conditions:
		#
		# * in the "auditctl" mode of operation insert particular rule each time
		#   (because in this mode there's only one file -- /etc/audit/audit.rules to be inspected for presence of this rule),
		#
		# * in the "augenrules" mode of operation insert particular rule only once and only in case we have already
		#   searched all of the files from /etc/audit/rules.d/*.rules location (since that audit rule can be defined
		#   in any of those files and if not, we want it to be inserted only once into /etc/audit/rules.d/privileged.rules file)
		#
		elif [ "$tool" == "auditctl" ] || [[ "$tool" == "augenrules" &amp;&amp; $count_of_inspected_files -eq "${#files_to_inspect[@]}" ]]
		then

			# Check if this sbinary wasn't already handled in some of the previous afile iterations
			# Return match only if whole sbinary definition matched (not in the case just prefix matched!!!)
			if [[ ! $(sed -ne "\|${sbinary}|p" &lt;&lt;&lt; "${sbinaries_to_skip[*]}") ]]
			then
				# Current audit rules file's content doesn't contain expected rule for this
				# SUID/SGID binary yet =&gt; append it
				echo "$expected_rule" &gt;&gt; "$output_audit_file"
			fi

			continue
		fi

	done

done
}</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_function_populate"># The populate function isn't directly used by SSG at the moment but it can be 
# used for testing purposes and will be used in SSG Testsuite in the future.

function populate {
# code to populate environment variables needed (for unit testing)
if [ -z "${!1}" ]; then
	echo "$1 is not defined. Exiting."
	exit
fi
}</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_function_replace_or_append"># Function to replace configuration setting in config file or add the configuration setting if
# it does not exist.
#
# Expects arguments:
#
# config_file:		Configuration file that will be modified
# key:			Configuration option to change
# value:		Value of the configuration option to change
# cce:			The CCE identifier or '@CCENUM@' if no CCE identifier exists
# format:		The printf-like format string that will be given stripped key and value as arguments,
#			so e.g. '%s=%s' will result in key=value subsitution (i.e. without spaces around =)
#
# Optional arugments:
#
# format:		Optional argument to specify the format of how key/value should be
# 			modified/appended in the configuration file. The default is key = value.
#
# Example Call(s):
#
#     With default format of 'key = value':
#     replace_or_append '/etc/sysctl.conf' '^kernel.randomize_va_space' '2' '@CCENUM@'
#
#     With custom key/value format:
#     replace_or_append '/etc/sysconfig/selinux' '^SELINUX=' 'disabled' '@CCENUM@' '%s=%s'
#
#     With a variable:
#     replace_or_append '/etc/sysconfig/selinux' '^SELINUX=' $var_selinux_state '@CCENUM@' '%s=%s'
#
function replace_or_append {
  local default_format='%s = %s' case_insensitive_mode=yes sed_case_insensitive_option='' grep_case_insensitive_option=''
  local config_file=$1
  local key=$2
  local value=$3
  local cce=$4
  local format=$5

  if [ "$case_insensitive_mode" = yes ]; then
    sed_case_insensitive_option="i"
    grep_case_insensitive_option="-i"
  fi
  [ -n "$format" ] || format="$default_format"
  # Check sanity of the input
  [ $# -ge "3" ] || { echo "Usage: replace_or_append &lt;config_file_location&gt; &lt;key_to_search&gt; &lt;new_value&gt; [&lt;CCE number or literal '@CCENUM@' if unknown&gt;] [printf-like format, default is '$default_format']" &gt;&amp;2; exit 1; }

  # Test if the config_file is a symbolic link. If so, use --follow-symlinks with sed.
  # Otherwise, regular sed command will do.
  sed_command=('sed' '-i')
  if test -L "$config_file"; then
    sed_command+=('--follow-symlinks')
  fi

  # Test that the cce arg is not empty or does not equal @CCENUM@.
  # If @CCENUM@ exists, it means that there is no CCE assigned.
  if [ -n "$cce" ] &amp;&amp; [ "$cce" != '@CCENUM@' ]; then
    cce="${cce}"
  else
    cce="CCE"
  fi

  # Strip any search characters in the key arg so that the key can be replaced without
  # adding any search characters to the config file.
  stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "$key")

  # shellcheck disable=SC2059
  printf -v formatted_output "$format" "$stripped_key" "$value"

  # If the key exists, change it. Otherwise, add it to the config_file.
  # We search for the key string followed by a word boundary (matched by \&gt;),
  # so if we search for 'setting', 'setting2' won't match.
  if LC_ALL=C grep -q -m 1 $grep_case_insensitive_option -e "${key}\\&gt;" "$config_file"; then
    "${sed_command[@]}" "s/${key}\\&gt;.*/$formatted_output/g$sed_case_insensitive_option" "$config_file"
  else
    # \n is precaution for case where file ends without trailing newline
    printf '\n# Per %s: Set %s in %s\n' "$cce" "$formatted_output" "$config_file" &gt;&gt; "$config_file"
    printf '%s\n' "$formatted_output" &gt;&gt; "$config_file"
  fi
}</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_function_set_faillock_option_to_value_in_pam_file">function set_faillock_option_to_value_in_pam_file {
	# If invoked with no arguments, exit. This is an intentional behavior.
	[ $# -gt 1 ] || return 0
	[ $# -ge 3 ] || die "$0 requires exactly zero, three, or four arguments"
	[ $# -le 4 ] || die "$0 requires exactly zero, three, or four arguments"
	local _pamFile="$1" _option="$2" _value="$3" _insert_lines_callback="$4"
	# pam_faillock.so already present?
	if grep -q "^auth.*pam_faillock.so.*" "$_pamFile"; then

		# pam_faillock.so present, is the option present?
		if grep -q "^auth.*[default=die].*pam_faillock.so.*authfail.*$_option=" "$_pamFile"; then

			# both pam_faillock.so &amp; option present, just correct option to the right value
			sed -i --follow-symlinks "s/\(^auth.*required.*pam_faillock.so.*preauth.*silent.*\)\($_option *= *\).*/\1\2$_value/" "$_pamFile"
			sed -i --follow-symlinks "s/\(^auth.*[default=die].*pam_faillock.so.*authfail.*\)\($_option *= *\).*/\1\2$_value/" "$_pamFile"

		# pam_faillock.so present, but the option not yet
		else

			# append correct option value to appropriate places
			sed -i --follow-symlinks "/^auth.*required.*pam_faillock.so.*preauth.*silent.*/ s/$/ $_option=$_value/" "$_pamFile"
			sed -i --follow-symlinks "/^auth.*[default=die].*pam_faillock.so.*authfail.*/ s/$/ $_option=$_value/" "$_pamFile"
		fi

	# pam_faillock.so not present yet
	else
		test -z "$_insert_lines_callback" || "$_insert_lines_callback" "$_option" "$_value" "$_pamFile"
		# insert pam_faillock.so preauth &amp; authfail rows with proper value of the option in question
	fi
}</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_ssh_client_rekey_limit_size">512M</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_ssh_client_rekey_limit_time">1h</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_system_crypto_policy">FIPS</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_mcafee_antivirus_definition_expire">2592000</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_sudo_dedicated_group">root</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_sudo_umask">0022</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_inactivity_timeout_value">900</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_screensaver_lock_delay">0</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_accounts_authorized_local_users_regex">^(root|bin|daemon|adm|lp|sync|shutdown|halt|mail|operator|games|ftp|nobody|pegasus|systemd-bus-proxy|systemd-network|dbus|polkitd|abrt|unbound|tss|libstoragemgmt|rpc|colord|usbmuxd$|pcp|saslauth|geoclue|setroubleshoot|rtkit|chrony|qemu|radvd|rpcuser|nfsnobody|pulse|gdm|gnome-initial-setup|postfix|avahi|ntp|sshd|tcpdump|oprofile|uuidd)$</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_login_banner_text">^\-\-[\s\n]+WARNING[\s\n]+\-\-[\s\n]+This[\s\n]+system[\s\n]+is[\s\n]+for[\s\n]+the[\s\n]+use[\s\n]+of[\s\n]+authorized[\s\n]+users[\s\n]+only\.[\s\n]+Individuals[\s\n]+using[\s\n]+this[\s\n]+computer[\s\n]+system[\s\n]+without[\s\n]+authority[\s\n]+or[\s\n]+in[\s\n]+excess[\s\n]+of[\s\n]+their[\s\n]+authority[\s\n]+are[\s\n]+subject[\s\n]+to[\s\n]+having[\s\n]+all[\s\n]+their[\s\n]+activities[\s\n]+on[\s\n]+this[\s\n]+system[\s\n]+monitored[\s\n]+and[\s\n]+recorded[\s\n]+by[\s\n]+system[\s\n]+personnel\.[\s\n]+Anyone[\s\n]+using[\s\n]+this[\s\n]+system[\s\n]+expressly[\s\n]+consents[\s\n]+to[\s\n]+such[\s\n]+monitoring[\s\n]+and[\s\n]+is[\s\n]+advised[\s\n]+that[\s\n]+if[\s\n]+such[\s\n]+monitoring[\s\n]+reveals[\s\n]+possible[\s\n]+evidence[\s\n]+of[\s\n]+criminal[\s\n]+activity[\s\n]+system[\s\n]+personal[\s\n]+may[\s\n]+provide[\s\n]+the[\s\n]+evidence[\s\n]+of[\s\n]+such[\s\n]+monitoring[\s\n]+to[\s\n]+law[\s\n]+enforcement[\s\n]+officials\.$</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_password_hashing_algorithm">SHA512</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_password_pam_unix_remember">5</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_deny">3</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_fail_interval">900</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_unlock_time">0</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_password_pam_delay">4000000</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_password_pam_remember">5</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_password_pam_dcredit">-1</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_password_pam_difok">8</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_password_pam_lcredit">-1</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_password_pam_maxclassrepeat">4</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_password_pam_maxrepeat">3</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_password_pam_minclass">3</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_password_pam_minlen">12</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_password_pam_ocredit">-1</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_password_pam_retry">3</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_password_pam_ucredit">-1</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_smartcard_drivers">default</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_accounts_maximum_age_login_defs">60</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_accounts_minimum_age_login_defs">7</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_accounts_password_minlen_login_defs">15</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_accounts_password_warn_age_login_defs">7</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_password_pam_unix_rounds">5000</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_account_disable_post_pw_expiration">35</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_accounts_fail_delay">4</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_accounts_max_concurrent_login_sessions">1</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_accounts_tmout">600</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_accounts_user_umask">027</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_audispd_disk_full_action">single</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_audispd_network_failure_action">single</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_audispd_remote_server">logcollector</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_auditd_action_mail_acct">root</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_auditd_admin_space_left_action">single</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_auditd_disk_error_action">single</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_auditd_disk_full_action">single</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_auditd_flush">data</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_auditd_max_log_file">6</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_auditd_max_log_file_action">rotate</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_auditd_num_logs">5</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_auditd_space_left">100</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_auditd_space_left_action">email</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_umask_for_daemons">022</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_removable_partition">/dev/cdrom</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_rsyslog_remote_loghost_address">logcollector</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_file_groupowner_logfiles_value">root</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_file_owner_logfiles_value">root</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_accept_redirects_value">0</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_accept_source_route_value">0</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_log_martians_value">1</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_rp_filter_value">1</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_secure_redirects_value">0</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_default_accept_redirects_value">0</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_default_accept_source_route_value">0</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_default_log_martians_value">1</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_default_rp_filter_value">1</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_default_secure_redirects_value">0</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_icmp_echo_ignore_broadcasts_value">1</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_icmp_ignore_bogus_error_responses_value">1</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_tcp_invalid_ratelimit_value">500</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_tcp_rfc1337_value">1</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_tcp_syncookies_value">1</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_sysconfig_network_IPV6_AUTOCONF_value">no</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_accept_ra_defrtr_value">0</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_accept_ra_pinfo_value">0</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_accept_ra_rtr_pref_value">0</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_accept_ra_value">0</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_accept_redirects_value">0</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_accept_source_route_value">0</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_autoconf_value">0</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_forwarding_value">0</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_max_addresses_value">1</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_router_solicitations_value">0</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_accept_ra_defrtr_value">0</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_accept_ra_pinfo_value">0</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_accept_ra_rtr_pref_value">0</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_accept_ra_value">0</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_accept_redirects_value">0</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_accept_source_route_value">0</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_autoconf_value">0</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_forwarding_value">0</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_max_addresses_value">1</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_router_solicitations_value">0</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_selinux_policy_name">targeted</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_selinux_state">enforcing</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_abrt_anon_write">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_abrt_handle_event">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_abrt_upload_watch_anon_write">true</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_antivirus_can_scan_system">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_antivirus_use_jit">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_auditadm_exec_content">true</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_authlogin_nsswitch_use_ldap">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_authlogin_radius">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_authlogin_yubikey">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_awstats_purge_apache_log_files">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_boinc_execmem">true</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_cdrecord_read_content">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_cluster_can_network_connect">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_cluster_manage_all_files">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_cluster_use_execmem">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_cobbler_anon_write">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_cobbler_can_network_connect">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_cobbler_use_cifs">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_cobbler_use_nfs">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_collectd_tcp_network_connect">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_condor_tcp_network_connect">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_conman_can_network">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_container_connect_any">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_cron_can_relabel">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_cron_system_cronjob_use_shares">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_cron_userdomain_transition">true</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_cups_execmem">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_cvs_read_shadow">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_daemons_dump_core">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_daemons_enable_cluster_mode">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_daemons_use_tcp_wrapper">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_daemons_use_tty">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_dbadm_exec_content">true</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_dbadm_manage_user_files">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_dbadm_read_user_files">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_deny_execmem">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_deny_ptrace">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_dhcpc_exec_iptables">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_dhcpd_use_ldap">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_domain_fd_use">true</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_domain_kernel_load_modules">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_entropyd_use_audio">true</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_exim_can_connect_db">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_exim_manage_user_files">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_exim_read_user_files">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_fcron_crond">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_fenced_can_network_connect">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_fenced_can_ssh">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_fips_mode">true</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_ftpd_anon_write">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_ftpd_connect_all_unreserved">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_ftpd_connect_db">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_ftpd_full_access">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_ftpd_use_cifs">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_ftpd_use_fusefs">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_ftpd_use_nfs">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_ftpd_use_passive_mode">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_git_cgi_enable_homedirs">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_git_cgi_use_cifs">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_git_cgi_use_nfs">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_git_session_bind_all_unreserved_ports">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_git_session_users">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_git_system_enable_homedirs">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_git_system_use_cifs">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_git_system_use_nfs">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_gitosis_can_sendmail">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_glance_api_can_network">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_glance_use_execmem">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_glance_use_fusefs">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_global_ssp">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_gluster_anon_write">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_gluster_export_all_ro">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_gluster_export_all_rw">true</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_gpg_web_anon_write">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_gssd_read_tmp">true</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_guest_exec_content">true</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_haproxy_connect_any">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_httpd_anon_write">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_httpd_builtin_scripting">true</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_httpd_can_check_spam">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_httpd_can_connect_ftp">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_httpd_can_connect_ldap">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_httpd_can_connect_mythtv">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_httpd_can_connect_zabbix">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_httpd_can_network_connect">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_httpd_can_network_connect_cobbler">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_httpd_can_network_connect_db">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_httpd_can_network_memcache">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_httpd_can_network_relay">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_httpd_can_sendmail">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_httpd_dbus_avahi">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_httpd_dbus_sssd">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_httpd_dontaudit_search_dirs">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_httpd_enable_cgi">true</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_httpd_enable_ftp_server">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_httpd_enable_homedirs">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_httpd_execmem">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_httpd_graceful_shutdown">true</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_httpd_manage_ipa">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_httpd_mod_auth_ntlm_winbind">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_httpd_mod_auth_pam">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_httpd_read_user_content">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_httpd_run_ipa">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_httpd_run_preupgrade">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_httpd_run_stickshift">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_httpd_serve_cobbler_files">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_httpd_setrlimit">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_httpd_ssi_exec">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_httpd_sys_script_anon_write">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_httpd_tmp_exec">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_httpd_tty_comm">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_httpd_unified">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_httpd_use_cifs">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_httpd_use_fusefs">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_httpd_use_gpg">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_httpd_use_nfs">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_httpd_use_openstack">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_httpd_use_sasl">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_httpd_verify_dns">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_icecast_use_any_tcp_ports">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_irc_use_any_tcp_ports">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_irssi_use_full_network">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_kdumpgui_run_bootloader">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_kerberos_enabled">true</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_ksmtuned_use_cifs">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_ksmtuned_use_nfs">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_logadm_exec_content">true</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_logging_syslogd_can_sendmail">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_logging_syslogd_run_nagios_plugins">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_logging_syslogd_use_tty">true</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_login_console_enabled">true</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_logrotate_use_nfs">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_logwatch_can_network_connect_mail">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_lsmd_plugin_connect_any">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_mailman_use_fusefs">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_mcelog_client">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_mcelog_exec_scripts">true</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_mcelog_foreground">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_mcelog_server">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_minidlna_read_generic_user_content">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_mmap_low_allowed">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_mock_enable_homedirs">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_mount_anyfile">true</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_mozilla_plugin_bind_unreserved_ports">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_mozilla_plugin_can_network_connect">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_mozilla_plugin_use_bluejeans">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_mozilla_plugin_use_gps">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_mozilla_plugin_use_spice">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_mozilla_read_content">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_mpd_enable_homedirs">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_mpd_use_cifs">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_mpd_use_nfs">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_mplayer_execstack">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_mysql_connect_any">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_nagios_run_pnp4nagios">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_nagios_run_sudo">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_named_tcp_bind_http_port">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_named_write_master_zones">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_neutron_can_network">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_nfs_export_all_ro">true</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_nfs_export_all_rw">true</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_nfsd_anon_write">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_nis_enabled">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_nscd_use_shm">true</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_openshift_use_nfs">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_openvpn_can_network_connect">true</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_openvpn_enable_homedirs">true</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_openvpn_run_unconfined">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_pcp_bind_all_unreserved_ports">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_pcp_read_generic_logs">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_piranha_lvs_can_network_connect">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_polipo_connect_all_unreserved">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_polipo_session_bind_all_unreserved_ports">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_polipo_session_users">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_polipo_use_cifs">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_polipo_use_nfs">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_polyinstantiation_enabled">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_postfix_local_write_mail_spool">true</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_postgresql_can_rsync">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_postgresql_selinux_transmit_client_label">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_postgresql_selinux_unconfined_dbadm">true</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_postgresql_selinux_users_ddl">true</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_pppd_can_insmod">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_pppd_for_user">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_privoxy_connect_any">true</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_prosody_bind_http_port">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_puppetagent_manage_all_files">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_puppetmaster_use_db">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_racoon_read_shadow">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_rsync_anon_write">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_rsync_client">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_rsync_export_all_ro">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_rsync_full_access">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_samba_create_home_dirs">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_samba_domain_controller">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_samba_enable_home_dirs">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_samba_export_all_ro">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_samba_export_all_rw">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_samba_load_libgfapi">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_samba_portmapper">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_samba_run_unconfined">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_samba_share_fusefs">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_samba_share_nfs">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_sanlock_use_fusefs">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_sanlock_use_nfs">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_sanlock_use_samba">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_saslauthd_read_shadow">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_secadm_exec_content">true</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_secure_mode">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_secure_mode_insmod">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_secure_mode_policyload">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_selinuxuser_direct_dri_enabled">true</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_selinuxuser_execheap">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_selinuxuser_execmod">true</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_selinuxuser_execstack">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_selinuxuser_mysql_connect_enabled">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_selinuxuser_ping">true</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_selinuxuser_postgresql_connect_enabled">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_selinuxuser_rw_noexattrfile">true</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_selinuxuser_share_music">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_selinuxuser_tcp_server">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_selinuxuser_udp_server">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_selinuxuser_use_ssh_chroot">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_sge_domain_can_network_connect">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_sge_use_nfs">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_smartmon_3ware">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_smbd_anon_write">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_spamassassin_can_network">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_spamd_enable_home_dirs">true</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_squid_connect_any">true</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_squid_use_tproxy">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_ssh_chroot_rw_homedirs">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_ssh_keysign">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_ssh_sysadm_login">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_staff_exec_content">true</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_staff_use_svirt">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_swift_can_network">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_sysadm_exec_content">true</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_telepathy_connect_all_ports">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_telepathy_tcp_connect_generic_network_ports">true</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_tftp_anon_write">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_tftp_home_dir">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_tmpreaper_use_nfs">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_tmpreaper_use_samba">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_tor_bind_all_unreserved_ports">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_tor_can_network_relay">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_unconfined_chrome_sandbox_transition">true</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_unconfined_login">true</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_unconfined_mozilla_plugin_transition">true</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_unprivuser_use_svirt">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_use_ecryptfs_home_dirs">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_use_fusefs_home_dirs">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_use_lpd_server">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_use_nfs_home_dirs">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_use_samba_home_dirs">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_user_exec_content">true</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_varnishd_connect_any">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_virt_read_qemu_ga_data">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_virt_rw_qemu_ga_data">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_virt_sandbox_use_all_caps">true</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_virt_sandbox_use_audit">true</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_virt_sandbox_use_mknod">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_virt_sandbox_use_netlink">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_virt_sandbox_use_sys_admin">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_virt_transition_userdomain">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_virt_use_comm">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_virt_use_execmem">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_virt_use_fusefs">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_virt_use_nfs">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_virt_use_rawip">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_virt_use_samba">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_virt_use_sanlock">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_virt_use_usb">true</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_virt_use_xserver">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_webadm_manage_user_files">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_webadm_read_user_files">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_wine_mmap_zero_ignore">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_xdm_bind_vnc_tcp_port">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_xdm_exec_bootloader">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_xdm_sysadm_login">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_xdm_write_home">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_xen_use_nfs">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_xend_run_blktap">true</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_xend_run_qemu">true</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_xguest_connect_network">true</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_xguest_exec_content">true</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_xguest_mount_media">true</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_xguest_use_bluetooth">true</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_xserver_clients_write_xshm">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_xserver_execmem">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_xserver_object_manager">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_zabbix_can_network">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_zarafa_setrlimit">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_zebra_write_config">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_zoneminder_anon_write">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_zoneminder_run_sudo">false</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_postfix_inet_interfaces">loopback-only</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_postfix_relayhost">smtp.$mydomain</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_postfix_root_mail_alias">system.administrator@mail.mil</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_snmpd_ro_string">changemero</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_snmpd_rw_string">changemerw</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_httpd_loglevel">warn</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_max_keepalive_requests">100</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_web_login_banner_text">^(You[\s\n]+are[\s\n]+accessing[\s\n]+a[\s\n]+U\.S\.[\s\n]+Government[\s\n]+\(USG\)[\s\n]+Information[\s\n]+System[\s\n]+\(IS\)[\s\n]+that[\s\n]+is[\s\n]+provided[\s\n]+for[\s\n]+USG\-authorized[\s\n]+use[\s\n]+only\.[\s\n]+By[\s\n]+using[\s\n]+this[\s\n]+IS[\s\n]+\(which[\s\n]+includes[\s\n]+any[\s\n]+device[\s\n]+attached[\s\n]+to[\s\n]+this[\s\n]+IS\)\,[\s\n]+you[\s\n]+consent[\s\n]+to[\s\n]+the[\s\n]+following[\s\n]+conditions\:(?:[\n]+|(?:\\n)+)\-The[\s\n]+USG[\s\n]+routinely[\s\n]+intercepts[\s\n]+and[\s\n]+monitors[\s\n]+communications[\s\n]+on[\s\n]+this[\s\n]+IS[\s\n]+for[\s\n]+purposes[\s\n]+including\,[\s\n]+but[\s\n]+not[\s\n]+limited[\s\n]+to\,[\s\n]+penetration[\s\n]+testing\,[\s\n]+COMSEC[\s\n]+monitoring\,[\s\n]+network[\s\n]+operations[\s\n]+and[\s\n]+defense\,[\s\n]+personnel[\s\n]+misconduct[\s\n]+\(PM\)\,[\s\n]+law[\s\n]+enforcement[\s\n]+\(LE\)\,[\s\n]+and[\s\n]+counterintelligence[\s\n]+\(CI\)[\s\n]+investigations\.(?:[\n]+|(?:\\n)+)\-At[\s\n]+any[\s\n]+time\,[\s\n]+the[\s\n]+USG[\s\n]+may[\s\n]+inspect[\s\n]+and[\s\n]+seize[\s\n]+data[\s\n]+stored[\s\n]+on[\s\n]+this[\s\n]+IS\.(?:[\n]+|(?:\\n)+)\-Communications[\s\n]+using\,[\s\n]+or[\s\n]+data[\s\n]+stored[\s\n]+on\,[\s\n]+this[\s\n]+IS[\s\n]+are[\s\n]+not[\s\n]+private\,[\s\n]+are[\s\n]+subject[\s\n]+to[\s\n]+routine[\s\n]+monitoring\,[\s\n]+interception\,[\s\n]+and[\s\n]+search\,[\s\n]+and[\s\n]+may[\s\n]+be[\s\n]+disclosed[\s\n]+or[\s\n]+used[\s\n]+for[\s\n]+any[\s\n]+USG\-authorized[\s\n]+purpose\.(?:[\n]+|(?:\\n)+)\-This[\s\n]+IS[\s\n]+includes[\s\n]+security[\s\n]+measures[\s\n]+\(e\.g\.\,[\s\n]+authentication[\s\n]+and[\s\n]+access[\s\n]+controls\)[\s\n]+to[\s\n]+protect[\s\n]+USG[\s\n]+interests\-\-not[\s\n]+for[\s\n]+your[\s\n]+personal[\s\n]+benefit[\s\n]+or[\s\n]+privacy\.(?:[\n]+|(?:\\n)+)\-Notwithstanding[\s\n]+the[\s\n]+above\,[\s\n]+using[\s\n]+this[\s\n]+IS[\s\n]+does[\s\n]+not[\s\n]+constitute[\s\n]+consent[\s\n]+to[\s\n]+PM\,[\s\n]+LE[\s\n]+or[\s\n]+CI[\s\n]+investigative[\s\n]+searching[\s\n]+or[\s\n]+monitoring[\s\n]+of[\s\n]+the[\s\n]+content[\s\n]+of[\s\n]+privileged[\s\n]+communications\,[\s\n]+or[\s\n]+work[\s\n]+product\,[\s\n]+related[\s\n]+to[\s\n]+personal[\s\n]+representation[\s\n]+or[\s\n]+services[\s\n]+by[\s\n]+attorneys\,[\s\n]+psychotherapists\,[\s\n]+or[\s\n]+clergy\,[\s\n]+and[\s\n]+their[\s\n]+assistants\.[\s\n]+Such[\s\n]+communications[\s\n]+and[\s\n]+work[\s\n]+product[\s\n]+are[\s\n]+private[\s\n]+and[\s\n]+confidential\.[\s\n]+See[\s\n]+User[\s\n]+Agreement[\s\n]+for[\s\n]+details\.|I've[\s\n]+read[\s\n]+\&amp;[\s\n]+consent[\s\n]+to[\s\n]+terms[\s\n]+in[\s\n]+IS[\s\n]+user[\s\n]+agreem't\.)$</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_multiple_time_servers">0.pool.ntp.org,1.pool.ntp.org,2.pool.ntp.org,3.pool.ntp.org</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_time_service_set_maxpoll">10</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_tftpd_secure_directory">/var/lib/tftpboot</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_sssd_memcache_timeout">300</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_sssd_ssh_known_hosts_timeout">180</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_sssd_ldap_tls_ca_dir">/etc/openldap/cacerts</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_firewalld_sshd_zone">public</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_sshd_approved_ciphers">aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,aes192-cbc,aes256-cbc,rijndael-cbc@lysator.liu.se</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_sshd_approved_macs">hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_sshd_idle_timeout_value">300</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_sshd_listening_port">22</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_sshd_max_auth_tries_value">4</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_sshd_required">0</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_sshd_max_sessions">10</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_sshd_set_keepalive">0</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_rekey_limit_size">512M</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_rekey_limit_time">1h</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_sshd_disable_compression">no</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_sshd_priv_separation">sandbox</set-value>
    <rule-result idref="xccdf_org.ssgproject.content_rule_prefer_64bit_os" role="full" time="2021-08-16T15:12:02+01:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-prefer_64bit_os:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_rpm_verify_hashes" role="full" time="2021-08-16T15:15:42+01:00" severity="high" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-rpm_verify_hashes:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_rpm_verify_permissions" role="full" time="2021-08-16T15:16:36+01:00" severity="high" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-rpm_verify_permissions:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_package_aide_installed" role="full" time="2021-08-16T15:16:36+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-package_aide_installed:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_aide_build_database" role="full" time="2021-08-16T15:16:36+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-aide_build_database:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_aide_periodic_cron_checking" role="full" time="2021-08-16T15:16:36+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-aide_periodic_cron_checking:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_sysctl_crypto_fips_enabled" role="full" time="2021-08-16T15:16:36+01:00" severity="high" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-sysctl_crypto_fips_enabled:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_enable_fips_mode" role="full" time="2021-08-16T15:16:36+01:00" severity="high" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export export-name="oval:ssg-var_system_crypto_policy:var:1" value-id="xccdf_org.ssgproject.content_value_var_system_crypto_policy"/>
        <check-content-ref name="oval:ssg-enable_fips_mode:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_etc_system_fips_exists" role="full" time="2021-08-16T15:16:36+01:00" severity="high" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-etc_system_fips_exists:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_enable_dracut_fips_module" role="full" time="2021-08-16T15:16:36+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-enable_dracut_fips_module:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_configure_openssl_crypto_policy" role="full" time="2021-08-16T15:16:36+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-configure_openssl_crypto_policy:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_harden_sshd_crypto_policy" role="full" time="2021-08-16T15:16:36+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export export-name="oval:ssg-sshd_required:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_required"/>
        <check-content-ref name="oval:ssg-harden_sshd_crypto_policy:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_configure_libreswan_crypto_policy" role="full" time="2021-08-16T15:16:36+01:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-configure_libreswan_crypto_policy:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_harden_ssh_client_crypto_policy" role="full" time="2021-08-16T15:16:36+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-harden_ssh_client_crypto_policy:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_configure_ssh_crypto_policy" role="full" time="2021-08-16T15:16:36+01:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-configure_ssh_crypto_policy:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_configure_crypto_policy" role="full" time="2021-08-16T15:16:36+01:00" severity="high" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export export-name="oval:ssg-var_system_crypto_policy:var:1" value-id="xccdf_org.ssgproject.content_value_var_system_crypto_policy"/>
        <check-content-ref name="oval:ssg-configure_crypto_policy:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_configure_bind_crypto_policy" role="full" time="2021-08-16T15:16:36+01:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-configure_bind_crypto_policy:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_configure_kerberos_crypto_policy" role="full" time="2021-08-16T15:16:36+01:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-configure_kerberos_crypto_policy:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_install_hids" role="full" time="2021-08-16T15:16:36+01:00" severity="high" weight="1.000000">
      <result>notselected</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_install_antivirus" role="full" time="2021-08-16T15:16:36+01:00" severity="high" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-install_antivirus:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_configure_user_data_backups" role="full" time="2021-08-16T15:16:36+01:00" severity="medium" weight="1.000000">
      <result>notchecked</result>
      <message severity="info">No candidate or applicable check found.</message>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_package_MFEhiplsm_installed" role="full" time="2021-08-16T15:16:36+01:00" severity="medium" weight="1.000000">
      <result>notselected</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_installed_OS_is_vendor_supported" role="full" time="2021-08-16T15:16:36+01:00" severity="high" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-installed_OS_is_vendor_supported:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_installed_OS_is_FIPS_certified" role="full" time="2021-08-16T15:16:36+01:00" severity="high" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-installed_OS_is_FIPS_certified:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_package_binutils_installed" role="full" time="2021-08-16T15:16:36+01:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-package_binutils_installed:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_package_cryptsetup-luks_installed" role="full" time="2021-08-16T15:16:36+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-package_cryptsetup-luks_installed:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_package_gnutls-utils_installed" role="full" time="2021-08-16T15:16:36+01:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-package_gnutls-utils_installed:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_package_libcap-ng-utils_installed" role="full" time="2021-08-16T15:16:36+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-package_libcap-ng-utils_installed:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_package_nss-tools_installed" role="full" time="2021-08-16T15:16:36+01:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-package_nss-tools_installed:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_package_openscap-scanner_installed" role="full" time="2021-08-16T15:16:36+01:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-package_openscap-scanner_installed:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_package_rear_installed" role="full" time="2021-08-16T15:16:36+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-package_rear_installed:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_package_rng-tools_installed" role="full" time="2021-08-16T15:16:36+01:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-package_rng-tools_installed:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_package_scap-security-guide_installed" role="full" time="2021-08-16T15:16:36+01:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-package_scap-security-guide_installed:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_package_tar_installed" role="full" time="2021-08-16T15:16:36+01:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-package_tar_installed:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_package_vim_installed" role="full" time="2021-08-16T15:16:36+01:00" severity="low" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-package_vim_installed:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_package_abrt-addon-ccpp_removed" role="full" time="2021-08-16T15:16:36+01:00" severity="low" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-package_abrt-addon-ccpp_removed:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_package_abrt-addon-kerneloops_removed" role="full" time="2021-08-16T15:16:36+01:00" severity="low" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-package_abrt-addon-kerneloops_removed:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_package_abrt-addon-python_removed" role="full" time="2021-08-16T15:16:36+01:00" severity="low" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-package_abrt-addon-python_removed:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_package_abrt-cli_removed" role="full" time="2021-08-16T15:16:36+01:00" severity="low" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-package_abrt-cli_removed:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_package_abrt-plugin-logger_removed" role="full" time="2021-08-16T15:16:36+01:00" severity="low" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-package_abrt-plugin-logger_removed:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_package_abrt-plugin-rhtsupport_removed" role="full" time="2021-08-16T15:16:36+01:00" severity="low" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-package_abrt-plugin-rhtsupport_removed:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_package_abrt-plugin-sosreport_removed" role="full" time="2021-08-16T15:16:36+01:00" severity="low" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-package_abrt-plugin-sosreport_removed:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_package_geolite2-city_removed" role="full" time="2021-08-16T15:16:36+01:00" severity="low" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-package_geolite2-city_removed:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_package_geolite2-country_removed" role="full" time="2021-08-16T15:16:36+01:00" severity="low" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-package_geolite2-country_removed:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_package_gssproxy_removed" role="full" time="2021-08-16T15:16:36+01:00" severity="low" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-package_gssproxy_removed:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_package_iprutils_removed" role="full" time="2021-08-16T15:16:36+01:00" severity="low" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-package_iprutils_removed:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_package_krb5-workstation_removed" role="full" time="2021-08-16T15:16:36+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-package_krb5-workstation_removed:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_package_tuned_removed" role="full" time="2021-08-16T15:16:36+01:00" severity="low" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-package_tuned_removed:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_package_sudo_installed" role="full" time="2021-08-16T15:16:36+01:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-package_sudo_installed:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_sudoers_explicit_command_args" role="full" time="2021-08-16T15:16:36+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-sudoers_explicit_command_args:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_sudo_remove_no_authenticate" role="full" time="2021-08-16T15:16:36+01:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-sudo_remove_no_authenticate:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_sudo_add_noexec" role="full" time="2021-08-16T15:16:36+01:00" severity="high" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-sudo_add_noexec:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_sudoers_validate_passwd" role="full" time="2021-08-16T15:16:36+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-sudoers_validate_passwd:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_sudoers_no_root_target" role="full" time="2021-08-16T15:16:36+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-sudoers_no_root_target:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_sudo_vdsm_nopasswd" role="full" time="2021-08-16T15:16:36+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-sudo_vdsm_nopasswd:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_sudo_add_use_pty" role="full" time="2021-08-16T15:16:36+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-sudo_add_use_pty:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_sudo_require_authentication" role="full" time="2021-08-16T15:16:36+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-sudo_require_authentication:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_sudo_add_requiretty" role="full" time="2021-08-16T15:16:36+01:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-sudo_add_requiretty:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_sudo_remove_nopasswd" role="full" time="2021-08-16T15:16:36+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-sudo_remove_nopasswd:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_sudoers_no_command_negation" role="full" time="2021-08-16T15:16:36+01:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-sudoers_no_command_negation:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_package_gdm_removed" role="full" time="2021-08-16T15:16:36+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-package_gdm_removed:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_dconf_db_up_to_date" role="full" time="2021-08-16T15:16:36+01:00" severity="high" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-dconf_db_up_to_date:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_enable_dconf_user_profile" role="full" time="2021-08-16T15:16:36+01:00" severity="high" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-enable_dconf_user_profile:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_dconf_gnome_disable_wifi_notification" role="full" time="2021-08-16T15:16:36+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-dconf_gnome_disable_wifi_notification:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_dconf_gnome_disable_wifi_create" role="full" time="2021-08-16T15:16:36+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-dconf_gnome_disable_wifi_create:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_dconf_gnome_remote_access_credential_prompt" role="full" time="2021-08-16T15:16:36+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-dconf_gnome_remote_access_credential_prompt:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_dconf_gnome_remote_access_encryption" role="full" time="2021-08-16T15:16:36+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-dconf_gnome_remote_access_encryption:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_dconf_gnome_disable_automount_open" role="full" time="2021-08-16T15:16:36+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-dconf_gnome_disable_automount_open:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_dconf_gnome_disable_automount" role="full" time="2021-08-16T15:16:36+01:00" severity="unknown" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-dconf_gnome_disable_automount:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_dconf_gnome_disable_thumbnailers" role="full" time="2021-08-16T15:16:36+01:00" severity="unknown" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-dconf_gnome_disable_thumbnailers:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_dconf_gnome_disable_autorun" role="full" time="2021-08-16T15:16:36+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-dconf_gnome_disable_autorun:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_dconf_gnome_disable_power_settings" role="full" time="2021-08-16T15:16:36+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-dconf_gnome_disable_power_settings:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_dconf_gnome_disable_ctrlaltdel_reboot" role="full" time="2021-08-16T15:16:36+01:00" severity="high" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-dconf_gnome_disable_ctrlaltdel_reboot:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_dconf_gnome_disable_user_admin" role="full" time="2021-08-16T15:16:36+01:00" severity="high" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-dconf_gnome_disable_user_admin:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_dconf_gnome_disable_geolocation" role="full" time="2021-08-16T15:16:36+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-dconf_gnome_disable_geolocation:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_dconf_gnome_session_idle_user_locks" role="full" time="2021-08-16T15:16:36+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-dconf_gnome_session_idle_user_locks:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_user_info" role="full" time="2021-08-16T15:16:36+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-dconf_gnome_screensaver_user_info:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_idle_activation_locked" role="full" time="2021-08-16T15:16:36+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-dconf_gnome_screensaver_idle_activation_locked:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_lock_locked" role="full" time="2021-08-16T15:16:36+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-dconf_gnome_screensaver_lock_locked:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_idle_delay" role="full" time="2021-08-16T15:16:36+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export export-name="oval:ssg-inactivity_timeout_value:var:1" value-id="xccdf_org.ssgproject.content_value_inactivity_timeout_value"/>
        <check-content-ref name="oval:ssg-dconf_gnome_screensaver_idle_delay:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_idle_activation_enabled" role="full" time="2021-08-16T15:16:36+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-dconf_gnome_screensaver_idle_activation_enabled:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_lock_enabled" role="full" time="2021-08-16T15:16:36+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-dconf_gnome_screensaver_lock_enabled:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_mode_blank" role="full" time="2021-08-16T15:16:36+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-dconf_gnome_screensaver_mode_blank:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_lock_delay" role="full" time="2021-08-16T15:16:36+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export export-name="oval:ssg-var_screensaver_lock_delay:var:1" value-id="xccdf_org.ssgproject.content_value_var_screensaver_lock_delay"/>
        <check-content-ref name="oval:ssg-dconf_gnome_screensaver_lock_delay:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_user_locks" role="full" time="2021-08-16T15:16:36+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-dconf_gnome_screensaver_user_locks:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_gnome_gdm_disable_automatic_login" role="full" time="2021-08-16T15:16:36+01:00" severity="high" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-gnome_gdm_disable_automatic_login:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_dconf_gnome_login_retries" role="full" time="2021-08-16T15:16:36+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-dconf_gnome_login_retries:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_gnome_gdm_disable_xdmcp" role="full" time="2021-08-16T15:16:36+01:00" severity="high" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-gnome_gdm_disable_xdmcp:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_dconf_gnome_disable_user_list" role="full" time="2021-08-16T15:16:36+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-dconf_gnome_disable_user_list:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_gnome_gdm_disable_guest_login" role="full" time="2021-08-16T15:16:36+01:00" severity="high" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-gnome_gdm_disable_guest_login:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_dconf_gnome_enable_smartcard_auth" role="full" time="2021-08-16T15:16:36+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-dconf_gnome_enable_smartcard_auth:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_dconf_gnome_lock_screen_on_smartcard_removal" role="full" time="2021-08-16T15:16:36+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-dconf_gnome_lock_screen_on_smartcard_removal:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_dconf_gnome_disable_restart_shutdown" role="full" time="2021-08-16T15:16:36+01:00" severity="high" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-dconf_gnome_disable_restart_shutdown:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_partition_for_usr" role="full" time="2021-08-16T15:16:36+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-partition_for_usr:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_partition_for_tmp" role="full" time="2021-08-16T15:16:36+01:00" severity="low" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-partition_for_tmp:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_partition_for_home" role="full" time="2021-08-16T15:16:36+01:00" severity="low" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-partition_for_home:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_partition_for_var" role="full" time="2021-08-16T15:16:36+01:00" severity="low" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-partition_for_var:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_partition_for_var_log" role="full" time="2021-08-16T15:16:36+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-partition_for_var_log:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_partition_for_boot" role="full" time="2021-08-16T15:16:36+01:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-partition_for_boot:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_partition_for_var_log_audit" role="full" time="2021-08-16T15:16:36+01:00" severity="low" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-partition_for_var_log_audit:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_partition_for_opt" role="full" time="2021-08-16T15:16:36+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-partition_for_opt:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_partition_for_srv" role="full" time="2021-08-16T15:16:36+01:00" severity="unknown" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-partition_for_srv:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_package_dnf-automatic_installed" role="full" time="2021-08-16T15:16:36+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-package_dnf-automatic_installed:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_ensure_fedora_gpgkey_installed" role="full" time="2021-08-16T15:16:38+01:00" severity="high" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-ensure_fedora_gpgkey_installed:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_ensure_gpgcheck_never_disabled" role="full" time="2021-08-16T15:16:38+01:00" severity="high" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-ensure_gpgcheck_never_disabled:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_security_patches_up_to_date" role="full" time="2021-08-16T15:16:38+01:00" severity="high" weight="1.000000">
      <result>notchecked</result>
      <message severity="info">No candidate or applicable check found.</message>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_dnf-automatic_security_updates_only" role="full" time="2021-08-16T15:16:38+01:00" severity="low" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-dnf-automatic_security_updates_only:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_dnf-automatic_apply_updates" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-dnf-automatic_apply_updates:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_timer_dnf-automatic_enabled" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-timer_dnf-automatic_enabled:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_ensure_gpgcheck_globally_activated" role="full" time="2021-08-16T15:16:38+01:00" severity="high" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-ensure_gpgcheck_globally_activated:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_ensure_gpgcheck_local_packages" role="full" time="2021-08-16T15:16:38+01:00" severity="high" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-ensure_gpgcheck_local_packages:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_file_owner_etc_issue" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-file_owner_etc_issue:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_file_permissions_etc_motd" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-file_permissions_etc_motd:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_file_permissions_etc_issue" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-file_permissions_etc_issue:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_file_groupowner_etc_issue" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-file_groupowner_etc_issue:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_file_owner_etc_motd" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-file_owner_etc_motd:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_file_groupowner_etc_motd" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-file_groupowner_etc_motd:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_banner_etc_issue" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export export-name="oval:ssg-login_banner_text:var:1" value-id="xccdf_org.ssgproject.content_value_login_banner_text"/>
        <check-content-ref name="oval:ssg-banner_etc_issue:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_banner_etc_motd" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export export-name="oval:ssg-login_banner_text:var:1" value-id="xccdf_org.ssgproject.content_value_login_banner_text"/>
        <check-content-ref name="oval:ssg-banner_etc_motd:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_dconf_gnome_login_banner_text" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export export-name="oval:ssg-login_banner_text:var:1" value-id="xccdf_org.ssgproject.content_value_login_banner_text"/>
        <check-content-ref name="oval:ssg-dconf_gnome_login_banner_text:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_dconf_gnome_banner_enabled" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-dconf_gnome_banner_enabled:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_enable_pam_namespace" role="full" time="2021-08-16T15:16:38+01:00" severity="low" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-enable_pam_namespace:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_display_login_attempts" role="full" time="2021-08-16T15:16:38+01:00" severity="low" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-display_login_attempts:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_deny_root" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-accounts_passwords_pam_faillock_deny_root:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_enforce_local" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-accounts_passwords_pam_faillock_enforce_local:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_interval" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export export-name="oval:ssg-var_accounts_passwords_pam_faillock_fail_interval:var:1" value-id="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_fail_interval"/>
        <check-content-ref name="oval:ssg-accounts_passwords_pam_faillock_interval:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_accounts_password_pam_unix_remember" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export export-name="oval:ssg-var_password_pam_unix_remember:var:1" value-id="xccdf_org.ssgproject.content_value_var_password_pam_unix_remember"/>
        <check-content-ref name="oval:ssg-accounts_password_pam_unix_remember:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_unlock_time" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export export-name="oval:ssg-var_accounts_passwords_pam_faillock_unlock_time:var:1" value-id="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_unlock_time"/>
        <check-content-ref name="oval:ssg-accounts_passwords_pam_faillock_unlock_time:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_deny" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export export-name="oval:ssg-var_accounts_passwords_pam_faillock_deny:var:1" value-id="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_deny"/>
        <check-content-ref name="oval:ssg-accounts_passwords_pam_faillock_deny:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_accounts_password_pam_difok" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export export-name="oval:ssg-var_password_pam_difok:var:1" value-id="xccdf_org.ssgproject.content_value_var_password_pam_difok"/>
        <check-content-ref name="oval:ssg-accounts_password_pam_difok:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_accounts_password_pam_retry" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export export-name="oval:ssg-var_password_pam_retry:var:1" value-id="xccdf_org.ssgproject.content_value_var_password_pam_retry"/>
        <check-content-ref name="oval:ssg-accounts_password_pam_retry:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_accounts_password_pam_minlen" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export export-name="oval:ssg-var_password_pam_minlen:var:1" value-id="xccdf_org.ssgproject.content_value_var_password_pam_minlen"/>
        <check-content-ref name="oval:ssg-accounts_password_pam_minlen:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_accounts_password_pam_maxrepeat" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export export-name="oval:ssg-var_password_pam_maxrepeat:var:1" value-id="xccdf_org.ssgproject.content_value_var_password_pam_maxrepeat"/>
        <check-content-ref name="oval:ssg-accounts_password_pam_maxrepeat:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_accounts_password_pam_ucredit" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export export-name="oval:ssg-var_password_pam_ucredit:var:1" value-id="xccdf_org.ssgproject.content_value_var_password_pam_ucredit"/>
        <check-content-ref name="oval:ssg-accounts_password_pam_ucredit:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_accounts_password_pam_minclass" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export export-name="oval:ssg-var_password_pam_minclass:var:1" value-id="xccdf_org.ssgproject.content_value_var_password_pam_minclass"/>
        <check-content-ref name="oval:ssg-accounts_password_pam_minclass:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_accounts_password_pam_dcredit" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export export-name="oval:ssg-var_password_pam_dcredit:var:1" value-id="xccdf_org.ssgproject.content_value_var_password_pam_dcredit"/>
        <check-content-ref name="oval:ssg-accounts_password_pam_dcredit:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_accounts_password_pam_maxclassrepeat" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export export-name="oval:ssg-var_password_pam_maxclassrepeat:var:1" value-id="xccdf_org.ssgproject.content_value_var_password_pam_maxclassrepeat"/>
        <check-content-ref name="oval:ssg-accounts_password_pam_maxclassrepeat:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_accounts_password_pam_ocredit" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export export-name="oval:ssg-var_password_pam_ocredit:var:1" value-id="xccdf_org.ssgproject.content_value_var_password_pam_ocredit"/>
        <check-content-ref name="oval:ssg-accounts_password_pam_ocredit:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_accounts_password_pam_enforce_root" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-accounts_password_pam_enforce_root:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_accounts_password_pam_enforce_local" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-accounts_password_pam_enforce_local:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_accounts_password_pam_lcredit" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export export-name="oval:ssg-var_password_pam_lcredit:var:1" value-id="xccdf_org.ssgproject.content_value_var_password_pam_lcredit"/>
        <check-content-ref name="oval:ssg-accounts_password_pam_lcredit:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_set_password_hashing_algorithm_logindefs" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export export-name="oval:ssg-var_password_hashing_algorithm:var:1" value-id="xccdf_org.ssgproject.content_value_var_password_hashing_algorithm"/>
        <check-content-ref name="oval:ssg-set_password_hashing_algorithm_logindefs:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_set_password_hashing_algorithm_systemauth" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-set_password_hashing_algorithm_systemauth:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_set_password_hashing_algorithm_libuserconf" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-set_password_hashing_algorithm_libuserconf:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_service_debug-shell_disabled" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-service_debug-shell_disabled:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_require_emergency_target_auth" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-require_emergency_target_auth:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_disable_ctrlaltdel_reboot" role="full" time="2021-08-16T15:16:38+01:00" severity="high" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-disable_ctrlaltdel_reboot:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_require_singleuser_auth" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-require_singleuser_auth:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_grub2_disable_interactive_boot" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-grub2_disable_interactive_boot:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_package_opensc_installed" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-package_opensc_installed:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_package_pcsc-lite_installed" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-package_pcsc-lite_installed:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_service_pcscd_enabled" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-service_pcscd_enabled:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_install_smartcard_packages" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-install_smartcard_packages:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_smartcard_auth" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-smartcard_auth:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_force_opensc_card_drivers" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export export-name="oval:ssg-var_smartcard_drivers:var:1" value-id="xccdf_org.ssgproject.content_value_var_smartcard_drivers"/>
        <check-content-ref name="oval:ssg-force_opensc_card_drivers:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_configure_opensc_nss_db" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-configure_opensc_nss_db:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_configure_opensc_card_drivers" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export export-name="oval:ssg-var_smartcard_drivers:var:1" value-id="xccdf_org.ssgproject.content_value_var_smartcard_drivers"/>
        <check-content-ref name="oval:ssg-configure_opensc_card_drivers:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_package_screen_installed" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-package_screen_installed:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_package_tmux_installed" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-package_tmux_installed:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_no_tmux_in_shells" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-no_tmux_in_shells:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_configure_tmux_lock_command" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-configure_tmux_lock_command:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_configure_tmux_lock_after_time" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-configure_tmux_lock_after_time:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_configure_bashrc_exec_tmux" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-configure_bashrc_exec_tmux:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_accounts_password_warn_age_login_defs" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export export-name="oval:ssg-var_accounts_password_warn_age_login_defs:var:1" value-id="xccdf_org.ssgproject.content_value_var_accounts_password_warn_age_login_defs"/>
        <check-content-ref name="oval:ssg-accounts_password_warn_age_login_defs:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_accounts_minimum_age_login_defs" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export export-name="oval:ssg-var_accounts_minimum_age_login_defs:var:1" value-id="xccdf_org.ssgproject.content_value_var_accounts_minimum_age_login_defs"/>
        <check-content-ref name="oval:ssg-accounts_minimum_age_login_defs:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_accounts_maximum_age_login_defs" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export export-name="oval:ssg-var_accounts_maximum_age_login_defs:var:1" value-id="xccdf_org.ssgproject.content_value_var_accounts_maximum_age_login_defs"/>
        <check-content-ref name="oval:ssg-accounts_maximum_age_login_defs:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_accounts_password_minlen_login_defs" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export export-name="oval:ssg-var_accounts_password_minlen_login_defs:var:1" value-id="xccdf_org.ssgproject.content_value_var_accounts_password_minlen_login_defs"/>
        <check-content-ref name="oval:ssg-accounts_password_minlen_login_defs:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_use_pam_wheel_for_su" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-use_pam_wheel_for_su:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_securetty_root_login_console_only" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-securetty_root_login_console_only:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_restrict_serial_port_logins" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-restrict_serial_port_logins:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_no_shelllogin_for_systemaccounts" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-no_shelllogin_for_systemaccounts:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_no_direct_root_logins" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-no_direct_root_logins:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_accounts_no_uid_except_zero" role="full" time="2021-08-16T15:16:38+01:00" severity="high" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-accounts_no_uid_except_zero:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_no_root_webbrowsing" role="full" time="2021-08-16T15:16:38+01:00" severity="unknown" weight="1.000000">
      <result>notchecked</result>
      <message severity="info">No candidate or applicable check found.</message>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_no_password_auth_for_systemaccounts" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>notchecked</result>
      <message severity="info">No candidate or applicable check found.</message>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_root_path_default" role="full" time="2021-08-16T15:16:38+01:00" severity="unknown" weight="1.000000">
      <result>notchecked</result>
      <message severity="info">No candidate or applicable check found.</message>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_gid_passwd_group_same" role="full" time="2021-08-16T15:16:38+01:00" severity="low" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-gid_passwd_group_same:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_no_legacy_plus_entries_etc_shadow" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-no_legacy_plus_entries_etc_shadow:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_no_netrc_files" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-no_netrc_files:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_accounts_password_all_shadowed" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-accounts_password_all_shadowed:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_no_empty_passwords" role="full" time="2021-08-16T15:16:38+01:00" severity="high" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-no_empty_passwords:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_accounts_password_pam_unix_rounds_password_auth" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export export-name="oval:ssg-var_password_pam_unix_rounds:var:1" value-id="xccdf_org.ssgproject.content_value_var_password_pam_unix_rounds"/>
        <check-content-ref name="oval:ssg-accounts_password_pam_unix_rounds_password_auth:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_no_legacy_plus_entries_etc_passwd" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-no_legacy_plus_entries_etc_passwd:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_accounts_password_pam_unix_rounds_system_auth" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export export-name="oval:ssg-var_password_pam_unix_rounds:var:1" value-id="xccdf_org.ssgproject.content_value_var_password_pam_unix_rounds"/>
        <check-content-ref name="oval:ssg-accounts_password_pam_unix_rounds_system_auth:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_no_legacy_plus_entries_etc_group" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-no_legacy_plus_entries_etc_group:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_account_temp_expire_date" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>notchecked</result>
      <message severity="info">No candidate or applicable check found.</message>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_account_use_centralized_automated_auth" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>notchecked</result>
      <message severity="info">No candidate or applicable check found.</message>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_account_disable_post_pw_expiration" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export export-name="oval:ssg-var_account_disable_post_pw_expiration:var:1" value-id="xccdf_org.ssgproject.content_value_var_account_disable_post_pw_expiration"/>
        <check-content-ref name="oval:ssg-account_disable_post_pw_expiration:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_account_unique_name" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-account_unique_name:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_accounts_polyinstantiated_tmp" role="full" time="2021-08-16T15:16:38+01:00" severity="low" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-accounts_polyinstantiated_tmp:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_accounts_logon_fail_delay" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export export-name="oval:ssg-var_accounts_fail_delay:var:1" value-id="xccdf_org.ssgproject.content_value_var_accounts_fail_delay"/>
        <check-content-ref name="oval:ssg-accounts_logon_fail_delay:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_accounts_max_concurrent_login_sessions" role="full" time="2021-08-16T15:16:38+01:00" severity="low" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export export-name="oval:ssg-var_accounts_max_concurrent_login_sessions:var:1" value-id="xccdf_org.ssgproject.content_value_var_accounts_max_concurrent_login_sessions"/>
        <check-content-ref name="oval:ssg-accounts_max_concurrent_login_sessions:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_file_permissions_home_dirs" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-file_permissions_home_dirs:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_accounts_have_homedir_login_defs" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-accounts_have_homedir_login_defs:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_accounts_polyinstantiated_var_tmp" role="full" time="2021-08-16T15:16:38+01:00" severity="low" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-accounts_polyinstantiated_var_tmp:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_accounts_tmout" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export export-name="oval:ssg-var_accounts_tmout:var:1" value-id="xccdf_org.ssgproject.content_value_var_accounts_tmout"/>
        <check-content-ref name="oval:ssg-accounts_tmout:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_root_path_no_dot" role="full" time="2021-08-16T15:16:38+01:00" severity="unknown" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-root_path_no_dot:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_accounts_root_path_dirs_no_write" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-accounts_root_path_dirs_no_write:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_accounts_umask_etc_login_defs" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export export-name="oval:ssg-var_accounts_user_umask:var:1" value-id="xccdf_org.ssgproject.content_value_var_accounts_user_umask"/>
        <check-content-ref name="oval:ssg-accounts_umask_etc_login_defs:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_accounts_umask_etc_profile" role="full" time="2021-08-16T15:16:38+01:00" severity="unknown" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export export-name="oval:ssg-var_accounts_user_umask:var:1" value-id="xccdf_org.ssgproject.content_value_var_accounts_user_umask"/>
        <check-content-ref name="oval:ssg-accounts_umask_etc_profile:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_package_audispd-plugins_installed" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-package_audispd-plugins_installed:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_package_audit-audispd-plugins_installed" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-package_audit-audispd-plugins_installed:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_package_audit_installed" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-package_audit_installed:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_service_auditd_enabled" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-service_auditd_enabled:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_grub2_audit_backlog_limit_argument" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-grub2_audit_backlog_limit_argument:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_grub2_audit_argument" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-grub2_audit_argument:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_etc_shadow_openat" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-audit_rules_etc_shadow_openat:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_etc_shadow_open" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-audit_rules_etc_shadow_open:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_sysadmin_actions" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-audit_rules_sysadmin_actions:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_etc_passwd_openat" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-audit_rules_etc_passwd_openat:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification_shadow" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-audit_rules_usergroup_modification_shadow:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_directory_access_var_log_audit" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-directory_access_var_log_audit:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification_group" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-audit_rules_usergroup_modification_group:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_file_ownership_var_log_audit" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-file_ownership_var_log_audit:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_networkconfig_modification" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-audit_rules_networkconfig_modification:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_etc_gshadow_open" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-audit_rules_etc_gshadow_open:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_etc_passwd_open" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-audit_rules_etc_passwd_open:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_media_export" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-audit_rules_media_export:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification_opasswd" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-audit_rules_usergroup_modification_opasswd:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_session_events" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-audit_rules_session_events:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_directory_permissions_var_log_audit" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-directory_permissions_var_log_audit:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification_passwd" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-audit_rules_usergroup_modification_passwd:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-audit_rules_usergroup_modification:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_etc_group_open" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-audit_rules_etc_group_open:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification_gshadow" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-audit_rules_usergroup_modification_gshadow:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_file_permissions_var_log_audit" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-file_permissions_var_log_audit:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_etc_gshadow_open_by_handle_at" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-audit_rules_etc_gshadow_open_by_handle_at:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_etc_group_openat" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-audit_rules_etc_group_openat:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_etc_gshadow_openat" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-audit_rules_etc_gshadow_openat:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_etc_passwd_open_by_handle_at" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-audit_rules_etc_passwd_open_by_handle_at:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_etc_group_open_by_handle_at" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-audit_rules_etc_group_open_by_handle_at:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_etc_shadow_open_by_handle_at" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-audit_rules_etc_shadow_open_by_handle_at:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_immutable" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-audit_rules_immutable:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_mac_modification" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-audit_rules_mac_modification:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_successful_file_modification_ftruncate" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>notchecked</result>
      <message severity="info">No candidate or applicable check found.</message>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_successful_file_modification_lsetxattr" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>notchecked</result>
      <message severity="info">No candidate or applicable check found.</message>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_successful_file_modification_openat" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>notchecked</result>
      <message severity="info">No candidate or applicable check found.</message>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_lsetxattr" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-audit_rules_unsuccessful_file_modification_lsetxattr:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_truncate" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-audit_rules_unsuccessful_file_modification_truncate:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_successful_file_modification_fchmod" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>notchecked</result>
      <message severity="info">No candidate or applicable check found.</message>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_successful_file_modification_creat" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>notchecked</result>
      <message severity="info">No candidate or applicable check found.</message>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_successful_file_modification_open_by_handle_at_o_creat" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>notchecked</result>
      <message severity="info">No candidate or applicable check found.</message>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_successful_file_modification_fremovexattr" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>notchecked</result>
      <message severity="info">No candidate or applicable check found.</message>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_setxattr" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-audit_rules_unsuccessful_file_modification_setxattr:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_successful_file_modification_open_by_handle_at_o_trunc_write" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>notchecked</result>
      <message severity="info">No candidate or applicable check found.</message>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_write" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_write:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_open_o_trunc_write" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-audit_rules_unsuccessful_file_modification_open_o_trunc_write:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_openat_o_trunc_write" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-audit_rules_unsuccessful_file_modification_openat_o_trunc_write:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_successful_file_modification_chown" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>notchecked</result>
      <message severity="info">No candidate or applicable check found.</message>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creat" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creat:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_fchownat" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-audit_rules_unsuccessful_file_modification_fchownat:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_chmod" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-audit_rules_unsuccessful_file_modification_chmod:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_successful_file_modification_open" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>notchecked</result>
      <message severity="info">No candidate or applicable check found.</message>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_unlink" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-audit_rules_unsuccessful_file_modification_unlink:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_successful_file_modification_rename" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>notchecked</result>
      <message severity="info">No candidate or applicable check found.</message>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_chown" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-audit_rules_unsuccessful_file_modification_chown:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_successful_file_modification_unlinkat" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>notchecked</result>
      <message severity="info">No candidate or applicable check found.</message>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_successful_file_modification_openat_o_creat" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>notchecked</result>
      <message severity="info">No candidate or applicable check found.</message>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_successful_file_modification_openat_o_trunc_write" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>notchecked</result>
      <message severity="info">No candidate or applicable check found.</message>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_successful_file_modification_setxattr" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>notchecked</result>
      <message severity="info">No candidate or applicable check found.</message>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_successful_file_modification_lchown" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>notchecked</result>
      <message severity="info">No candidate or applicable check found.</message>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_open" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-audit_rules_unsuccessful_file_modification_open:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_openat_rule_order" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-audit_rules_unsuccessful_file_modification_openat_rule_order:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_ftruncate" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-audit_rules_unsuccessful_file_modification_ftruncate:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_removexattr" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-audit_rules_unsuccessful_file_modification_removexattr:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_successful_file_modification_truncate" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>notchecked</result>
      <message severity="info">No candidate or applicable check found.</message>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_successful_file_modification_open_o_trunc_write" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>notchecked</result>
      <message severity="info">No candidate or applicable check found.</message>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_fchmod" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-audit_rules_unsuccessful_file_modification_fchmod:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_successful_file_modification_unlink" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>notchecked</result>
      <message severity="info">No candidate or applicable check found.</message>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_lchown" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-audit_rules_unsuccessful_file_modification_lchown:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_openat_o_creat" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-audit_rules_unsuccessful_file_modification_openat_o_creat:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_successful_file_modification_fchmodat" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>notchecked</result>
      <message severity="info">No candidate or applicable check found.</message>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_successful_file_modification_fsetxattr" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>notchecked</result>
      <message severity="info">No candidate or applicable check found.</message>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_successful_file_modification_open_by_handle_at" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>notchecked</result>
      <message severity="info">No candidate or applicable check found.</message>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_renameat" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-audit_rules_unsuccessful_file_modification_renameat:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_open_rule_order" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-audit_rules_unsuccessful_file_modification_open_rule_order:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_openat" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-audit_rules_unsuccessful_file_modification_openat:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_open_o_creat" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-audit_rules_unsuccessful_file_modification_open_o_creat:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_successful_file_modification_fchownat" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>notchecked</result>
      <message severity="info">No candidate or applicable check found.</message>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_successful_file_modification_open_o_creat" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>notchecked</result>
      <message severity="info">No candidate or applicable check found.</message>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_successful_file_modification_renameat" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>notchecked</result>
      <message severity="info">No candidate or applicable check found.</message>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_fremovexattr" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-audit_rules_unsuccessful_file_modification_fremovexattr:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_fchown" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-audit_rules_unsuccessful_file_modification_fchown:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_order" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_order:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_open_by_handle_at" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-audit_rules_unsuccessful_file_modification_open_by_handle_at:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_lremovexattr" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-audit_rules_unsuccessful_file_modification_lremovexattr:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_successful_file_modification_chmod" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>notchecked</result>
      <message severity="info">No candidate or applicable check found.</message>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_successful_file_modification_removexattr" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>notchecked</result>
      <message severity="info">No candidate or applicable check found.</message>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_fsetxattr" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-audit_rules_unsuccessful_file_modification_fsetxattr:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_creat" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-audit_rules_unsuccessful_file_modification_creat:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_successful_file_modification_fchown" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>notchecked</result>
      <message severity="info">No candidate or applicable check found.</message>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_fchmodat" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-audit_rules_unsuccessful_file_modification_fchmodat:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-audit_rules_unsuccessful_file_modification:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_successful_file_modification_lremovexattr" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>notchecked</result>
      <message severity="info">No candidate or applicable check found.</message>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_rename" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-audit_rules_unsuccessful_file_modification_rename:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_unlinkat" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-audit_rules_unsuccessful_file_modification_unlinkat:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_file_deletion_events" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-audit_rules_file_deletion_events:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_file_deletion_events_rmdir" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-audit_rules_file_deletion_events_rmdir:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_file_deletion_events_unlink" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-audit_rules_file_deletion_events_unlink:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_file_deletion_events_renameat" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-audit_rules_file_deletion_events_renameat:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_file_deletion_events_rename" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-audit_rules_file_deletion_events_rename:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_file_deletion_events_unlinkat" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-audit_rules_file_deletion_events_unlinkat:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_login_events_faillock" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-audit_rules_login_events_faillock:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_login_events" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-audit_rules_login_events:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_login_events_tallylog" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-audit_rules_login_events_tallylog:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_login_events_lastlog" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-audit_rules_login_events_lastlog:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_time_stime" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-audit_rules_time_stime:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_time_clock_settime" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-audit_rules_time_clock_settime:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_time_watch_localtime" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-audit_rules_time_watch_localtime:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_time_adjtimex" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-audit_rules_time_adjtimex:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_time_settimeofday" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-audit_rules_time_settimeofday:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_sudoedit" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-audit_rules_privileged_commands_sudoedit:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_crontab" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-audit_rules_privileged_commands_crontab:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_newgidmap" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-audit_rules_privileged_commands_newgidmap:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_ssh_keysign" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-audit_rules_privileged_commands_ssh_keysign:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_umount" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-audit_rules_privileged_commands_umount:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_newgrp" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-audit_rules_privileged_commands_newgrp:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_chage" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-audit_rules_privileged_commands_chage:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_gpasswd" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-audit_rules_privileged_commands_gpasswd:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_chsh" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-audit_rules_privileged_commands_chsh:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_pt_chown" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-audit_rules_privileged_commands_pt_chown:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_newuidmap" role="full" time="2021-08-16T15:16:38+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-audit_rules_privileged_commands_newuidmap:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands" role="full" time="2021-08-16T15:17:35+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-audit_rules_privileged_commands:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_sudo" role="full" time="2021-08-16T15:17:35+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-audit_rules_privileged_commands_sudo:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_at" role="full" time="2021-08-16T15:17:35+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-audit_rules_privileged_commands_at:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_userhelper" role="full" time="2021-08-16T15:17:35+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-audit_rules_privileged_commands_userhelper:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_passwd" role="full" time="2021-08-16T15:17:35+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-audit_rules_privileged_commands_passwd:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_unix_chkpwd" role="full" time="2021-08-16T15:17:35+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-audit_rules_privileged_commands_unix_chkpwd:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_su" role="full" time="2021-08-16T15:17:35+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-audit_rules_privileged_commands_su:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_usernetctl" role="full" time="2021-08-16T15:17:35+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-audit_rules_privileged_commands_usernetctl:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_mount" role="full" time="2021-08-16T15:17:35+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-audit_rules_privileged_commands_mount:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_kernel_module_loading" role="full" time="2021-08-16T15:17:35+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-audit_rules_kernel_module_loading:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_kernel_module_loading_delete" role="full" time="2021-08-16T15:17:35+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-audit_rules_kernel_module_loading_delete:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_kernel_module_loading_init" role="full" time="2021-08-16T15:17:35+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-audit_rules_kernel_module_loading_init:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_kernel_module_loading_finit" role="full" time="2021-08-16T15:17:35+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-audit_rules_kernel_module_loading_finit:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_execution_setsebool" role="full" time="2021-08-16T15:17:35+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-audit_rules_execution_setsebool:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_execution_chcon" role="full" time="2021-08-16T15:17:35+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-audit_rules_execution_chcon:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_execution_semanage" role="full" time="2021-08-16T15:17:35+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-audit_rules_execution_semanage:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_execution_restorecon" role="full" time="2021-08-16T15:17:35+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-audit_rules_execution_restorecon:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_execution_seunshare" role="full" time="2021-08-16T15:17:35+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-audit_rules_execution_seunshare:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_setxattr" role="full" time="2021-08-16T15:17:35+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-audit_rules_dac_modification_setxattr:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fsetxattr" role="full" time="2021-08-16T15:17:35+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-audit_rules_dac_modification_fsetxattr:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_umount2" role="full" time="2021-08-16T15:17:35+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-audit_rules_dac_modification_umount2:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_removexattr" role="full" time="2021-08-16T15:17:35+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-audit_rules_dac_modification_removexattr:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fchmodat" role="full" time="2021-08-16T15:17:35+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-audit_rules_dac_modification_fchmodat:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_lsetxattr" role="full" time="2021-08-16T15:17:35+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-audit_rules_dac_modification_lsetxattr:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fchownat" role="full" time="2021-08-16T15:17:35+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-audit_rules_dac_modification_fchownat:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fremovexattr" role="full" time="2021-08-16T15:17:35+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-audit_rules_dac_modification_fremovexattr:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_chmod" role="full" time="2021-08-16T15:17:35+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-audit_rules_dac_modification_chmod:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_umount" role="full" time="2021-08-16T15:17:35+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-audit_rules_dac_modification_umount:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_lremovexattr" role="full" time="2021-08-16T15:17:35+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-audit_rules_dac_modification_lremovexattr:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_lchown" role="full" time="2021-08-16T15:17:35+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-audit_rules_dac_modification_lchown:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_chown" role="full" time="2021-08-16T15:17:35+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-audit_rules_dac_modification_chown:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fchmod" role="full" time="2021-08-16T15:17:35+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-audit_rules_dac_modification_fchmod:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fchown" role="full" time="2021-08-16T15:17:35+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-audit_rules_dac_modification_fchown:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_auditd_audispd_configure_remote_server" role="full" time="2021-08-16T15:17:35+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export export-name="oval:ssg-var_audispd_remote_server:var:1" value-id="xccdf_org.ssgproject.content_value_var_audispd_remote_server"/>
        <check-content-ref name="oval:ssg-auditd_audispd_configure_remote_server:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_auditd_audispd_encrypt_sent_records" role="full" time="2021-08-16T15:17:35+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-auditd_audispd_encrypt_sent_records:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_auditd_data_retention_action_mail_acct" role="full" time="2021-08-16T15:17:35+01:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export export-name="oval:ssg-var_auditd_action_mail_acct:var:1" value-id="xccdf_org.ssgproject.content_value_var_auditd_action_mail_acct"/>
        <check-content-ref name="oval:ssg-auditd_data_retention_action_mail_acct:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_auditd_freq" role="full" time="2021-08-16T15:17:35+01:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-auditd_freq:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_auditd_data_retention_max_log_file" role="full" time="2021-08-16T15:17:35+01:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export export-name="oval:ssg-var_auditd_max_log_file:var:1" value-id="xccdf_org.ssgproject.content_value_var_auditd_max_log_file"/>
        <check-content-ref name="oval:ssg-auditd_data_retention_max_log_file:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_auditd_data_disk_full_action" role="full" time="2021-08-16T15:17:35+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export export-name="oval:ssg-var_auditd_disk_full_action:var:1" value-id="xccdf_org.ssgproject.content_value_var_auditd_disk_full_action"/>
        <check-content-ref name="oval:ssg-auditd_data_disk_full_action:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_auditd_data_retention_flush" role="full" time="2021-08-16T15:17:35+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export export-name="oval:ssg-var_auditd_flush:var:1" value-id="xccdf_org.ssgproject.content_value_var_auditd_flush"/>
        <check-content-ref name="oval:ssg-auditd_data_retention_flush:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_auditd_data_retention_max_log_file_action" role="full" time="2021-08-16T15:17:35+01:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export export-name="oval:ssg-var_auditd_max_log_file_action:var:1" value-id="xccdf_org.ssgproject.content_value_var_auditd_max_log_file_action"/>
        <check-content-ref name="oval:ssg-auditd_data_retention_max_log_file_action:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_auditd_name_format" role="full" time="2021-08-16T15:17:35+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-auditd_name_format:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_auditd_log_format" role="full" time="2021-08-16T15:17:35+01:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-auditd_log_format:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_auditd_data_retention_space_left_action" role="full" time="2021-08-16T15:17:35+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export export-name="oval:ssg-var_auditd_space_left_action:var:1" value-id="xccdf_org.ssgproject.content_value_var_auditd_space_left_action"/>
        <check-content-ref name="oval:ssg-auditd_data_retention_space_left_action:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_auditd_data_disk_error_action" role="full" time="2021-08-16T15:17:35+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export export-name="oval:ssg-var_auditd_disk_error_action:var:1" value-id="xccdf_org.ssgproject.content_value_var_auditd_disk_error_action"/>
        <check-content-ref name="oval:ssg-auditd_data_disk_error_action:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_auditd_data_retention_num_logs" role="full" time="2021-08-16T15:17:35+01:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export export-name="oval:ssg-var_auditd_num_logs:var:1" value-id="xccdf_org.ssgproject.content_value_var_auditd_num_logs"/>
        <check-content-ref name="oval:ssg-auditd_data_retention_num_logs:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_auditd_audispd_syslog_plugin_activated" role="full" time="2021-08-16T15:17:35+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-auditd_audispd_syslog_plugin_activated:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_auditd_write_logs" role="full" time="2021-08-16T15:17:35+01:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-auditd_write_logs:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_auditd_data_retention_admin_space_left_action" role="full" time="2021-08-16T15:17:35+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export export-name="oval:ssg-var_auditd_admin_space_left_action:var:1" value-id="xccdf_org.ssgproject.content_value_var_auditd_admin_space_left_action"/>
        <check-content-ref name="oval:ssg-auditd_data_retention_admin_space_left_action:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_auditd_local_events" role="full" time="2021-08-16T15:17:35+01:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-auditd_local_events:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_service_autofs_disabled" role="full" time="2021-08-16T15:17:35+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-service_autofs_disabled:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_grub2_nousb_argument" role="full" time="2021-08-16T15:17:35+01:00" severity="unknown" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-grub2_nousb_argument:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_kernel_module_udf_disabled" role="full" time="2021-08-16T15:17:35+01:00" severity="low" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-kernel_module_udf_disabled:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_kernel_module_vfat_disabled" role="full" time="2021-08-16T15:17:35+01:00" severity="low" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-kernel_module_vfat_disabled:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_kernel_module_hfsplus_disabled" role="full" time="2021-08-16T15:17:35+01:00" severity="low" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-kernel_module_hfsplus_disabled:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_kernel_module_jffs2_disabled" role="full" time="2021-08-16T15:17:35+01:00" severity="low" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-kernel_module_jffs2_disabled:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_kernel_module_usb-storage_disabled" role="full" time="2021-08-16T15:17:35+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-kernel_module_usb-storage_disabled:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_kernel_module_squashfs_disabled" role="full" time="2021-08-16T15:17:35+01:00" severity="low" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-kernel_module_squashfs_disabled:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_bios_assign_password" role="full" time="2021-08-16T15:17:35+01:00" severity="unknown" weight="1.000000">
      <result>notchecked</result>
      <message severity="info">No candidate or applicable check found.</message>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_kernel_module_hfs_disabled" role="full" time="2021-08-16T15:17:35+01:00" severity="low" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-kernel_module_hfs_disabled:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_kernel_module_freevxfs_disabled" role="full" time="2021-08-16T15:17:35+01:00" severity="low" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-kernel_module_freevxfs_disabled:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_bios_disable_usb_boot" role="full" time="2021-08-16T15:17:35+01:00" severity="unknown" weight="1.000000">
      <result>notchecked</result>
      <message severity="info">No candidate or applicable check found.</message>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_kernel_module_cramfs_disabled" role="full" time="2021-08-16T15:17:35+01:00" severity="low" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-kernel_module_cramfs_disabled:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_sysctl_kernel_core_pattern" role="full" time="2021-08-16T15:17:35+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-sysctl_kernel_core_pattern:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_sysctl_kernel_perf_event_paranoid" role="full" time="2021-08-16T15:17:35+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-sysctl_kernel_perf_event_paranoid:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_sysctl_kernel_modules_disabled" role="full" time="2021-08-16T15:17:35+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-sysctl_kernel_modules_disabled:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_sysctl_kernel_kexec_load_disabled" role="full" time="2021-08-16T15:17:35+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-sysctl_kernel_kexec_load_disabled:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_sysctl_kernel_yama_ptrace_scope" role="full" time="2021-08-16T15:17:35+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-sysctl_kernel_yama_ptrace_scope:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_sysctl_vm_mmap_min_addr" role="full" time="2021-08-16T15:17:35+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-sysctl_vm_mmap_min_addr:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_sysctl_net_core_bpf_jit_harden" role="full" time="2021-08-16T15:17:35+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-sysctl_net_core_bpf_jit_harden:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_sysctl_user_max_user_namespaces" role="full" time="2021-08-16T15:17:35+01:00" severity="low" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-sysctl_user_max_user_namespaces:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_sysctl_kernel_pid_max" role="full" time="2021-08-16T15:17:35+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-sysctl_kernel_pid_max:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_sysctl_kernel_dmesg_restrict" role="full" time="2021-08-16T15:17:35+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-sysctl_kernel_dmesg_restrict:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_sysctl_kernel_unprivileged_bpf_disabled" role="full" time="2021-08-16T15:17:35+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-sysctl_kernel_unprivileged_bpf_disabled:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_sysctl_kernel_perf_event_max_sample_rate" role="full" time="2021-08-16T15:17:35+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-sysctl_kernel_perf_event_max_sample_rate:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_sysctl_kernel_perf_cpu_time_max_percent" role="full" time="2021-08-16T15:17:35+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-sysctl_kernel_perf_cpu_time_max_percent:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_sysctl_kernel_sysrq" role="full" time="2021-08-16T15:17:35+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-sysctl_kernel_sysrq:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_grub2_page_poison_argument" role="full" time="2021-08-16T15:17:35+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-grub2_page_poison_argument:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_grub2_slub_debug_argument" role="full" time="2021-08-16T15:17:35+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-grub2_slub_debug_argument:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_install_PAE_kernel_on_x86-32" role="full" time="2021-08-16T15:17:35+01:00" severity="unknown" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-install_PAE_kernel_on_x86-32:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_bios_enable_execution_restrictions" role="full" time="2021-08-16T15:17:35+01:00" severity="unknown" weight="1.000000">
      <result>notchecked</result>
      <message severity="info">No candidate or applicable check found.</message>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_service_systemd-coredump_disabled" role="full" time="2021-08-16T15:17:35+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-service_systemd-coredump_disabled:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_coredump_disable_storage" role="full" time="2021-08-16T15:17:35+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-coredump_disable_storage:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_disable_users_coredumps" role="full" time="2021-08-16T15:17:35+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-disable_users_coredumps:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_coredump_disable_backtraces" role="full" time="2021-08-16T15:17:35+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-coredump_disable_backtraces:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_sysctl_fs_suid_dumpable" role="full" time="2021-08-16T15:17:35+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-sysctl_fs_suid_dumpable:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_sysctl_kernel_kptr_restrict" role="full" time="2021-08-16T15:17:35+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-sysctl_kernel_kptr_restrict:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_sysctl_kernel_exec_shield" role="full" time="2021-08-16T15:17:35+01:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-sysctl_kernel_exec_shield:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_sysctl_kernel_randomize_va_space" role="full" time="2021-08-16T15:17:35+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-sysctl_kernel_randomize_va_space:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_umask_for_daemons" role="full" time="2021-08-16T15:17:35+01:00" severity="unknown" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export export-name="oval:ssg-var_umask_for_daemons:var:1" value-id="xccdf_org.ssgproject.content_value_var_umask_for_daemons"/>
        <check-content-ref name="oval:ssg-umask_for_daemons:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_file_permissions_systemmap" role="full" time="2021-08-16T15:17:35+01:00" severity="unknown" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-file_permissions_systemmap:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_dir_perms_world_writable_system_owned" role="full" time="2021-08-16T15:17:43+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-dir_perms_world_writable_system_owned:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_dir_perms_world_writable_system_owned_group" role="full" time="2021-08-16T15:17:50+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-dir_perms_world_writable_system_owned_group:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_file_permissions_unauthorized_world_writable" role="full" time="2021-08-16T15:18:37+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-file_permissions_unauthorized_world_writable:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_no_files_unowned_by_user" role="full" time="2021-08-16T15:19:28+01:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-no_files_unowned_by_user:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_sysctl_fs_protected_hardlinks" role="full" time="2021-08-16T15:19:28+01:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-sysctl_fs_protected_hardlinks:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_sysctl_fs_protected_symlinks" role="full" time="2021-08-16T15:19:28+01:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-sysctl_fs_protected_symlinks:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_file_permissions_unauthorized_sgid" role="full" time="2021-08-16T15:20:48+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-file_permissions_unauthorized_sgid:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_file_permissions_ungroupowned" role="full" time="2021-08-16T15:21:46+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-file_permissions_ungroupowned:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_dir_perms_world_writable_root_owned" role="full" time="2021-08-16T15:21:54+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-dir_perms_world_writable_root_owned:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_file_permissions_unauthorized_suid" role="full" time="2021-08-16T15:23:19+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-file_permissions_unauthorized_suid:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_dir_perms_world_writable_sticky_bits" role="full" time="2021-08-16T15:23:27+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-dir_perms_world_writable_sticky_bits:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_dir_permissions_library_dirs" role="full" time="2021-08-16T15:23:32+01:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-dir_permissions_library_dirs:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_file_permissions_binary_dirs" role="full" time="2021-08-16T15:23:32+01:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-file_permissions_binary_dirs:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_file_permissions_library_dirs" role="full" time="2021-08-16T15:24:07+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-file_permissions_library_dirs:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_file_ownership_binary_dirs" role="full" time="2021-08-16T15:24:07+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-file_ownership_binary_dirs:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_file_ownership_library_dirs" role="full" time="2021-08-16T15:24:07+01:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-file_ownership_library_dirs:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_file_groupowner_var_log" role="full" time="2021-08-16T15:24:07+01:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-file_groupowner_var_log:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_file_owner_var_log" role="full" time="2021-08-16T15:24:07+01:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-file_owner_var_log:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_file_groupowner_var_log_messages" role="full" time="2021-08-16T15:24:07+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-file_groupowner_var_log_messages:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_file_permissions_var_log_messages" role="full" time="2021-08-16T15:24:07+01:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-file_permissions_var_log_messages:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_file_permissions_var_log" role="full" time="2021-08-16T15:24:07+01:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-file_permissions_var_log:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_file_owner_var_log_messages" role="full" time="2021-08-16T15:24:07+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-file_owner_var_log_messages:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_file_owner_backup_etc_group" role="full" time="2021-08-16T15:24:07+01:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-file_owner_backup_etc_group:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_file_groupowner_backup_etc_gshadow" role="full" time="2021-08-16T15:24:07+01:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-file_groupowner_backup_etc_gshadow:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_file_groupowner_etc_passwd" role="full" time="2021-08-16T15:24:07+01:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-file_groupowner_etc_passwd:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_file_groupowner_etc_gshadow" role="full" time="2021-08-16T15:24:07+01:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-file_groupowner_etc_gshadow:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_file_permissions_etc_passwd" role="full" time="2021-08-16T15:24:07+01:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-file_permissions_etc_passwd:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_file_permissions_etc_shadow" role="full" time="2021-08-16T15:24:07+01:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-file_permissions_etc_shadow:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_file_groupowner_etc_group" role="full" time="2021-08-16T15:24:07+01:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-file_groupowner_etc_group:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_file_owner_etc_group" role="full" time="2021-08-16T15:24:07+01:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-file_owner_etc_group:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_file_permissions_backup_etc_shadow" role="full" time="2021-08-16T15:24:07+01:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-file_permissions_backup_etc_shadow:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_file_permissions_etc_group" role="full" time="2021-08-16T15:24:07+01:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-file_permissions_etc_group:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_file_groupowner_backup_etc_group" role="full" time="2021-08-16T15:24:07+01:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-file_groupowner_backup_etc_group:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_file_owner_backup_etc_shadow" role="full" time="2021-08-16T15:24:07+01:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-file_owner_backup_etc_shadow:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_file_owner_etc_passwd" role="full" time="2021-08-16T15:24:07+01:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-file_owner_etc_passwd:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_file_groupowner_backup_etc_shadow" role="full" time="2021-08-16T15:24:07+01:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-file_groupowner_backup_etc_shadow:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_file_permissions_backup_etc_passwd" role="full" time="2021-08-16T15:24:07+01:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-file_permissions_backup_etc_passwd:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_file_owner_backup_etc_gshadow" role="full" time="2021-08-16T15:24:07+01:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-file_owner_backup_etc_gshadow:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_file_owner_etc_gshadow" role="full" time="2021-08-16T15:24:07+01:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-file_owner_etc_gshadow:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_file_permissions_backup_etc_group" role="full" time="2021-08-16T15:24:07+01:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-file_permissions_backup_etc_group:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_file_permissions_etc_gshadow" role="full" time="2021-08-16T15:24:07+01:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-file_permissions_etc_gshadow:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_file_groupowner_etc_shadow" role="full" time="2021-08-16T15:24:07+01:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-file_groupowner_etc_shadow:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_file_owner_backup_etc_passwd" role="full" time="2021-08-16T15:24:07+01:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-file_owner_backup_etc_passwd:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_file_groupowner_backup_etc_passwd" role="full" time="2021-08-16T15:24:07+01:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-file_groupowner_backup_etc_passwd:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_file_permissions_backup_etc_gshadow" role="full" time="2021-08-16T15:24:07+01:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-file_permissions_backup_etc_gshadow:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_file_owner_etc_shadow" role="full" time="2021-08-16T15:24:07+01:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-file_owner_etc_shadow:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_mount_option_dev_shm_nodev" role="full" time="2021-08-16T15:24:07+01:00" severity="low" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-mount_option_dev_shm_nodev:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_mount_option_nosuid_removable_partitions" role="full" time="2021-08-16T15:24:07+01:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export export-name="oval:ssg-var_removable_partition:var:1" value-id="xccdf_org.ssgproject.content_value_var_removable_partition"/>
        <check-content-ref name="oval:ssg-mount_option_nosuid_removable_partitions:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_mount_option_noexec_removable_partitions" role="full" time="2021-08-16T15:24:07+01:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export export-name="oval:ssg-var_removable_partition:var:1" value-id="xccdf_org.ssgproject.content_value_var_removable_partition"/>
        <check-content-ref name="oval:ssg-mount_option_noexec_removable_partitions:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_mount_option_var_log_noexec" role="full" time="2021-08-16T15:24:07+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-mount_option_var_log_noexec:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_mount_option_tmp_nodev" role="full" time="2021-08-16T15:24:07+01:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-mount_option_tmp_nodev:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_mount_option_nodev_nonroot_local_partitions" role="full" time="2021-08-16T15:24:07+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-mount_option_nodev_nonroot_local_partitions:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_mount_option_var_log_audit_nodev" role="full" time="2021-08-16T15:24:07+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-mount_option_var_log_audit_nodev:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_mount_option_boot_noauto" role="full" time="2021-08-16T15:24:07+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-mount_option_boot_noauto:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_mount_option_opt_nosuid" role="full" time="2021-08-16T15:24:07+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-mount_option_opt_nosuid:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_mount_option_boot_nosuid" role="full" time="2021-08-16T15:24:07+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-mount_option_boot_nosuid:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_mount_option_tmp_nosuid" role="full" time="2021-08-16T15:24:07+01:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-mount_option_tmp_nosuid:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_mount_option_var_log_audit_noexec" role="full" time="2021-08-16T15:24:07+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-mount_option_var_log_audit_noexec:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_mount_option_dev_shm_nosuid" role="full" time="2021-08-16T15:24:07+01:00" severity="low" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-mount_option_dev_shm_nosuid:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_mount_option_tmp_noexec" role="full" time="2021-08-16T15:24:07+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-mount_option_tmp_noexec:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_mount_option_nodev_removable_partitions" role="full" time="2021-08-16T15:24:07+01:00" severity="low" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export export-name="oval:ssg-var_removable_partition:var:1" value-id="xccdf_org.ssgproject.content_value_var_removable_partition"/>
        <check-content-ref name="oval:ssg-mount_option_nodev_removable_partitions:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_mount_option_var_nosuid" role="full" time="2021-08-16T15:24:07+01:00" severity="unknown" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-mount_option_var_nosuid:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_mount_option_var_log_nodev" role="full" time="2021-08-16T15:24:07+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-mount_option_var_log_nodev:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_mount_option_var_nodev" role="full" time="2021-08-16T15:24:07+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-mount_option_var_nodev:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_mount_option_boot_noexec" role="full" time="2021-08-16T15:24:07+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-mount_option_boot_noexec:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_mount_option_home_noexec" role="full" time="2021-08-16T15:24:07+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-mount_option_home_noexec:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_mount_option_var_noexec" role="full" time="2021-08-16T15:24:07+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-mount_option_var_noexec:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_mount_option_boot_nodev" role="full" time="2021-08-16T15:24:07+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-mount_option_boot_nodev:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_mount_option_srv_nosuid" role="full" time="2021-08-16T15:24:07+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-mount_option_srv_nosuid:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_mount_option_dev_shm_noexec" role="full" time="2021-08-16T15:24:07+01:00" severity="low" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-mount_option_dev_shm_noexec:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_mount_option_var_log_nosuid" role="full" time="2021-08-16T15:24:07+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-mount_option_var_log_nosuid:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_mount_option_var_log_audit_nosuid" role="full" time="2021-08-16T15:24:07+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-mount_option_var_log_audit_nosuid:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_mount_option_var_tmp_bind" role="full" time="2021-08-16T15:24:07+01:00" severity="unknown" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-mount_option_var_tmp_bind:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_package_rsyslog-gnutls_installed" role="full" time="2021-08-16T15:24:07+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-package_rsyslog-gnutls_installed:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_package_rsyslog_installed" role="full" time="2021-08-16T15:24:07+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-package_rsyslog_installed:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_service_rsyslog_enabled" role="full" time="2021-08-16T15:24:07+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-service_rsyslog_enabled:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_disable_logwatch_for_logserver" role="full" time="2021-08-16T15:24:07+01:00" severity="unknown" weight="1.000000">
      <result>notchecked</result>
      <message severity="info">No candidate or applicable check found.</message>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_package_syslogng_installed" role="full" time="2021-08-16T15:24:07+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-package_syslogng_installed:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_service_syslogng_enabled" role="full" time="2021-08-16T15:24:07+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-service_syslogng_enabled:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_rsyslog_accept_remote_messages_tcp" role="full" time="2021-08-16T15:24:07+01:00" severity="unknown" weight="1.000000">
      <result>notchecked</result>
      <message severity="info">No candidate or applicable check found.</message>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_rsyslog_accept_remote_messages_udp" role="full" time="2021-08-16T15:24:07+01:00" severity="unknown" weight="1.000000">
      <result>notchecked</result>
      <message severity="info">No candidate or applicable check found.</message>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_rsyslog_nolisten" role="full" time="2021-08-16T15:24:07+01:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-rsyslog_nolisten:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_ensure_logrotate_activated" role="full" time="2021-08-16T15:24:07+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-ensure_logrotate_activated:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_rsyslog_remote_tls" role="full" time="2021-08-16T15:24:07+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-rsyslog_remote_tls:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_rsyslog_remote_loghost" role="full" time="2021-08-16T15:24:07+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-rsyslog_remote_loghost:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_rsyslog_remote_tls_cacert" role="full" time="2021-08-16T15:24:07+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-rsyslog_remote_tls_cacert:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_rsyslog_files_ownership" role="full" time="2021-08-16T15:24:07+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-rsyslog_files_ownership:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_rsyslog_cron_logging" role="full" time="2021-08-16T15:24:07+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-rsyslog_cron_logging:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_rsyslog_files_groupownership" role="full" time="2021-08-16T15:24:07+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-rsyslog_files_groupownership:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_rsyslog_files_permissions" role="full" time="2021-08-16T15:24:07+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-rsyslog_files_permissions:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_logwatch_configured_splithosts" role="full" time="2021-08-16T15:24:07+01:00" severity="unknown" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-logwatch_configured_splithosts:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_logwatch_configured_hostlimit" role="full" time="2021-08-16T15:24:07+01:00" severity="unknown" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-logwatch_configured_hostlimit:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_network_sniffer_disabled" role="full" time="2021-08-16T15:24:07+01:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-network_sniffer_disabled:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_network_disable_zeroconf" role="full" time="2021-08-16T15:24:07+01:00" severity="unknown" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-network_disable_zeroconf:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_network_nmcli_permissions" role="full" time="2021-08-16T15:24:07+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-network_nmcli_permissions:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_kernel_module_rds_disabled" role="full" time="2021-08-16T15:24:07+01:00" severity="low" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-kernel_module_rds_disabled:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_kernel_module_firewire-core_disabled" role="full" time="2021-08-16T15:24:07+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-kernel_module_firewire-core_disabled:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_kernel_module_tipc_disabled" role="full" time="2021-08-16T15:24:07+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-kernel_module_tipc_disabled:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_kernel_module_dccp_disabled" role="full" time="2021-08-16T15:24:07+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-kernel_module_dccp_disabled:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_kernel_module_atm_disabled" role="full" time="2021-08-16T15:24:07+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-kernel_module_atm_disabled:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_kernel_module_can_disabled" role="full" time="2021-08-16T15:24:07+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-kernel_module_can_disabled:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_service_bluetooth_disabled" role="full" time="2021-08-16T15:24:07+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-service_bluetooth_disabled:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_kernel_module_bluetooth_disabled" role="full" time="2021-08-16T15:24:07+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-kernel_module_bluetooth_disabled:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_wireless_disable_interfaces" role="full" time="2021-08-16T15:24:07+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-wireless_disable_interfaces:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_wireless_disable_in_bios" role="full" time="2021-08-16T15:24:07+01:00" severity="unknown" weight="1.000000">
      <result>notchecked</result>
      <message severity="info">No candidate or applicable check found.</message>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_package_iptables_installed" role="full" time="2021-08-16T15:24:07+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-package_iptables_installed:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_set_iptables_default_rule" role="full" time="2021-08-16T15:24:07+01:00" severity="medium" weight="1.000000">
      <result>notchecked</result>
      <message severity="info">No candidate or applicable check found.</message>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_set_iptables_default_rule_forward" role="full" time="2021-08-16T15:24:07+01:00" severity="medium" weight="1.000000">
      <result>notchecked</result>
      <message severity="info">No candidate or applicable check found.</message>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_service_ip6tables_enabled" role="full" time="2021-08-16T15:24:07+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-service_ip6tables_enabled:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_service_iptables_enabled" role="full" time="2021-08-16T15:24:07+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-service_iptables_enabled:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_set_ip6tables_default_rule" role="full" time="2021-08-16T15:24:07+01:00" severity="medium" weight="1.000000">
      <result>notchecked</result>
      <message severity="info">No candidate or applicable check found.</message>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_package_libreswan_installed" role="full" time="2021-08-16T15:24:07+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-package_libreswan_installed:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_libreswan_approved_tunnels" role="full" time="2021-08-16T15:24:07+01:00" severity="medium" weight="1.000000">
      <result>notchecked</result>
      <message severity="info">No candidate or applicable check found.</message>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_service_firewalld_enabled" role="full" time="2021-08-16T15:24:08+01:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-service_firewalld_enabled:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_set_firewalld_default_zone" role="full" time="2021-08-16T15:24:08+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-set_firewalld_default_zone:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_ip_forward" role="full" time="2021-08-16T15:24:08+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-sysctl_net_ipv4_ip_forward:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_send_redirects" role="full" time="2021-08-16T15:24:08+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-sysctl_net_ipv4_conf_all_send_redirects:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_send_redirects" role="full" time="2021-08-16T15:24:08+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-sysctl_net_ipv4_conf_default_send_redirects:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_accept_source_route" role="full" time="2021-08-16T15:24:08+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export export-name="oval:ssg-sysctl_net_ipv4_conf_all_accept_source_route_value:var:1" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_accept_source_route_value"/>
        <check-content-ref name="oval:ssg-sysctl_net_ipv4_conf_all_accept_source_route:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_icmp_ignore_bogus_error_responses" role="full" time="2021-08-16T15:24:08+01:00" severity="unknown" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export export-name="oval:ssg-sysctl_net_ipv4_icmp_ignore_bogus_error_responses_value:var:1" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_icmp_ignore_bogus_error_responses_value"/>
        <check-content-ref name="oval:ssg-sysctl_net_ipv4_icmp_ignore_bogus_error_responses:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_rp_filter" role="full" time="2021-08-16T15:24:08+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export export-name="oval:ssg-sysctl_net_ipv4_conf_default_rp_filter_value:var:1" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_default_rp_filter_value"/>
        <check-content-ref name="oval:ssg-sysctl_net_ipv4_conf_default_rp_filter:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_log_martians" role="full" time="2021-08-16T15:24:08+01:00" severity="unknown" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export export-name="oval:ssg-sysctl_net_ipv4_conf_all_log_martians_value:var:1" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_log_martians_value"/>
        <check-content-ref name="oval:ssg-sysctl_net_ipv4_conf_all_log_martians:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_log_martians" role="full" time="2021-08-16T15:24:08+01:00" severity="unknown" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export export-name="oval:ssg-sysctl_net_ipv4_conf_default_log_martians_value:var:1" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_default_log_martians_value"/>
        <check-content-ref name="oval:ssg-sysctl_net_ipv4_conf_default_log_martians:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_accept_source_route" role="full" time="2021-08-16T15:24:08+01:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export export-name="oval:ssg-sysctl_net_ipv4_conf_default_accept_source_route_value:var:1" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_default_accept_source_route_value"/>
        <check-content-ref name="oval:ssg-sysctl_net_ipv4_conf_default_accept_source_route:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_accept_redirects" role="full" time="2021-08-16T15:24:08+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export export-name="oval:ssg-sysctl_net_ipv4_conf_all_accept_redirects_value:var:1" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_accept_redirects_value"/>
        <check-content-ref name="oval:ssg-sysctl_net_ipv4_conf_all_accept_redirects:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_accept_redirects" role="full" time="2021-08-16T15:24:08+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export export-name="oval:ssg-sysctl_net_ipv4_conf_default_accept_redirects_value:var:1" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_default_accept_redirects_value"/>
        <check-content-ref name="oval:ssg-sysctl_net_ipv4_conf_default_accept_redirects:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_ip_local_port_range" role="full" time="2021-08-16T15:24:08+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-sysctl_net_ipv4_ip_local_port_range:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_secure_redirects" role="full" time="2021-08-16T15:24:08+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export export-name="oval:ssg-sysctl_net_ipv4_conf_default_secure_redirects_value:var:1" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_default_secure_redirects_value"/>
        <check-content-ref name="oval:ssg-sysctl_net_ipv4_conf_default_secure_redirects:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_icmp_echo_ignore_broadcasts" role="full" time="2021-08-16T15:24:08+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export export-name="oval:ssg-sysctl_net_ipv4_icmp_echo_ignore_broadcasts_value:var:1" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_icmp_echo_ignore_broadcasts_value"/>
        <check-content-ref name="oval:ssg-sysctl_net_ipv4_icmp_echo_ignore_broadcasts:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_tcp_syncookies" role="full" time="2021-08-16T15:24:08+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export export-name="oval:ssg-sysctl_net_ipv4_tcp_syncookies_value:var:1" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_tcp_syncookies_value"/>
        <check-content-ref name="oval:ssg-sysctl_net_ipv4_tcp_syncookies:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_rp_filter" role="full" time="2021-08-16T15:24:08+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export export-name="oval:ssg-sysctl_net_ipv4_conf_all_rp_filter_value:var:1" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_rp_filter_value"/>
        <check-content-ref name="oval:ssg-sysctl_net_ipv4_conf_all_rp_filter:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_secure_redirects" role="full" time="2021-08-16T15:24:08+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export export-name="oval:ssg-sysctl_net_ipv4_conf_all_secure_redirects_value:var:1" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_secure_redirects_value"/>
        <check-content-ref name="oval:ssg-sysctl_net_ipv4_conf_all_secure_redirects:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_network_ipv6_disable_interfaces" role="full" time="2021-08-16T15:24:08+01:00" severity="unknown" weight="1.000000">
      <result>notchecked</result>
      <message severity="info">No candidate or applicable check found.</message>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_kernel_module_ipv6_option_disabled" role="full" time="2021-08-16T15:24:08+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-kernel_module_ipv6_option_disabled:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_all_disable_ipv6" role="full" time="2021-08-16T15:24:08+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-sysctl_net_ipv6_conf_all_disable_ipv6:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_network_ipv6_disable_rpc" role="full" time="2021-08-16T15:24:08+01:00" severity="unknown" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-network_ipv6_disable_rpc:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_grub2_ipv6_disable_argument" role="full" time="2021-08-16T15:24:08+01:00" severity="low" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-grub2_ipv6_disable_argument:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_all_max_addresses" role="full" time="2021-08-16T15:24:08+01:00" severity="unknown" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export export-name="oval:ssg-sysctl_net_ipv6_conf_all_max_addresses_value:var:1" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_max_addresses_value"/>
        <check-content-ref name="oval:ssg-sysctl_net_ipv6_conf_all_max_addresses:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_all_accept_ra_rtr_pref" role="full" time="2021-08-16T15:24:08+01:00" severity="unknown" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export export-name="oval:ssg-sysctl_net_ipv6_conf_all_accept_ra_rtr_pref_value:var:1" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_accept_ra_rtr_pref_value"/>
        <check-content-ref name="oval:ssg-sysctl_net_ipv6_conf_all_accept_ra_rtr_pref:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_default_accept_ra_pinfo" role="full" time="2021-08-16T15:24:08+01:00" severity="unknown" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export export-name="oval:ssg-sysctl_net_ipv6_conf_default_accept_ra_pinfo_value:var:1" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_accept_ra_pinfo_value"/>
        <check-content-ref name="oval:ssg-sysctl_net_ipv6_conf_default_accept_ra_pinfo:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_network_ipv6_default_gateway" role="full" time="2021-08-16T15:24:08+01:00" severity="unknown" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-network_ipv6_default_gateway:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_default_accept_ra" role="full" time="2021-08-16T15:24:08+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export export-name="oval:ssg-sysctl_net_ipv6_conf_default_accept_ra_value:var:1" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_accept_ra_value"/>
        <check-content-ref name="oval:ssg-sysctl_net_ipv6_conf_default_accept_ra:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_network_ipv6_static_address" role="full" time="2021-08-16T15:24:08+01:00" severity="unknown" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-network_ipv6_static_address:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_default_router_solicitations" role="full" time="2021-08-16T15:24:08+01:00" severity="unknown" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export export-name="oval:ssg-sysctl_net_ipv6_conf_default_router_solicitations_value:var:1" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_router_solicitations_value"/>
        <check-content-ref name="oval:ssg-sysctl_net_ipv6_conf_default_router_solicitations:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_all_autoconf" role="full" time="2021-08-16T15:24:08+01:00" severity="unknown" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export export-name="oval:ssg-sysctl_net_ipv6_conf_all_autoconf_value:var:1" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_autoconf_value"/>
        <check-content-ref name="oval:ssg-sysctl_net_ipv6_conf_all_autoconf:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_all_router_solicitations" role="full" time="2021-08-16T15:24:08+01:00" severity="unknown" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export export-name="oval:ssg-sysctl_net_ipv6_conf_all_router_solicitations_value:var:1" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_router_solicitations_value"/>
        <check-content-ref name="oval:ssg-sysctl_net_ipv6_conf_all_router_solicitations:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_network_ipv6_privacy_extensions" role="full" time="2021-08-16T15:24:08+01:00" severity="unknown" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-network_ipv6_privacy_extensions:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_default_accept_ra_defrtr" role="full" time="2021-08-16T15:24:08+01:00" severity="unknown" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export export-name="oval:ssg-sysctl_net_ipv6_conf_default_accept_ra_defrtr_value:var:1" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_accept_ra_defrtr_value"/>
        <check-content-ref name="oval:ssg-sysctl_net_ipv6_conf_default_accept_ra_defrtr:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_all_accept_ra_defrtr" role="full" time="2021-08-16T15:24:08+01:00" severity="unknown" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export export-name="oval:ssg-sysctl_net_ipv6_conf_all_accept_ra_defrtr_value:var:1" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_accept_ra_defrtr_value"/>
        <check-content-ref name="oval:ssg-sysctl_net_ipv6_conf_all_accept_ra_defrtr:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_default_autoconf" role="full" time="2021-08-16T15:24:08+01:00" severity="unknown" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export export-name="oval:ssg-sysctl_net_ipv6_conf_default_autoconf_value:var:1" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_autoconf_value"/>
        <check-content-ref name="oval:ssg-sysctl_net_ipv6_conf_default_autoconf:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_default_accept_ra_rtr_pref" role="full" time="2021-08-16T15:24:08+01:00" severity="unknown" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export export-name="oval:ssg-sysctl_net_ipv6_conf_default_accept_ra_rtr_pref_value:var:1" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_accept_ra_rtr_pref_value"/>
        <check-content-ref name="oval:ssg-sysctl_net_ipv6_conf_default_accept_ra_rtr_pref:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_all_accept_ra_pinfo" role="full" time="2021-08-16T15:24:08+01:00" severity="unknown" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export export-name="oval:ssg-sysctl_net_ipv6_conf_all_accept_ra_pinfo_value:var:1" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_accept_ra_pinfo_value"/>
        <check-content-ref name="oval:ssg-sysctl_net_ipv6_conf_all_accept_ra_pinfo:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_default_max_addresses" role="full" time="2021-08-16T15:24:08+01:00" severity="unknown" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export export-name="oval:ssg-sysctl_net_ipv6_conf_default_max_addresses_value:var:1" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_max_addresses_value"/>
        <check-content-ref name="oval:ssg-sysctl_net_ipv6_conf_default_max_addresses:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_default_accept_redirects" role="full" time="2021-08-16T15:24:08+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export export-name="oval:ssg-sysctl_net_ipv6_conf_default_accept_redirects_value:var:1" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_accept_redirects_value"/>
        <check-content-ref name="oval:ssg-sysctl_net_ipv6_conf_default_accept_redirects:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_package_libselinux_installed" role="full" time="2021-08-16T15:24:08+01:00" severity="high" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-package_libselinux_installed:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_package_policycoreutils_installed" role="full" time="2021-08-16T15:24:08+01:00" severity="high" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-package_policycoreutils_installed:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_package_mcstrans_removed" role="full" time="2021-08-16T15:24:08+01:00" severity="low" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-package_mcstrans_removed:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_package_setroubleshoot-plugins_removed" role="full" time="2021-08-16T15:24:08+01:00" severity="low" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-package_setroubleshoot-plugins_removed:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_package_setroubleshoot-server_removed" role="full" time="2021-08-16T15:24:08+01:00" severity="low" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-package_setroubleshoot-server_removed:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_package_setroubleshoot_removed" role="full" time="2021-08-16T15:24:08+01:00" severity="low" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-package_setroubleshoot_removed:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_grub2_enable_selinux" role="full" time="2021-08-16T15:24:08+01:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-grub2_enable_selinux:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_selinux_state" role="full" time="2021-08-16T15:24:08+01:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export export-name="oval:ssg-var_selinux_state:var:1" value-id="xccdf_org.ssgproject.content_value_var_selinux_state"/>
        <check-content-ref name="oval:ssg-selinux_state:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_coreos_enable_selinux_kernel_argument" role="full" time="2021-08-16T15:24:08+01:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-coreos_enable_selinux_kernel_argument:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_selinux_confinement_of_daemons" role="full" time="2021-08-16T15:24:08+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-selinux_confinement_of_daemons:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_selinux_policytype" role="full" time="2021-08-16T15:24:08+01:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export export-name="oval:ssg-var_selinux_policy_name:var:1" value-id="xccdf_org.ssgproject.content_value_var_selinux_policy_name"/>
        <check-content-ref name="oval:ssg-selinux_policytype:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_selinux_all_devicefiles_labeled" role="full" time="2021-08-16T15:24:08+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-selinux_all_devicefiles_labeled:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_kernel_disable_entropy_contribution_for_solid_state_drives" role="full" time="2021-08-16T15:24:08+01:00" severity="medium" weight="1.000000">
      <result>notchecked</result>
      <message severity="info">No candidate or applicable check found.</message>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_grub2_enable_iommu_force" role="full" time="2021-08-16T15:24:08+01:00" severity="unknown" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-grub2_enable_iommu_force:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_grub2_vsyscall_argument" role="full" time="2021-08-16T15:24:08+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-grub2_vsyscall_argument:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_grub2_pti_argument" role="full" time="2021-08-16T15:24:08+01:00" severity="high" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-grub2_pti_argument:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_file_permissions_efi_grub2_cfg" role="full" time="2021-08-16T15:24:08+01:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-file_permissions_efi_grub2_cfg:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_grub2_uefi_password" role="full" time="2021-08-16T15:24:08+01:00" severity="high" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-grub2_uefi_password:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_file_owner_efi_grub2_cfg" role="full" time="2021-08-16T15:24:08+01:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-file_owner_efi_grub2_cfg:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_grub2_uefi_admin_username" role="full" time="2021-08-16T15:24:08+01:00" severity="low" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-grub2_uefi_admin_username:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_file_groupowner_efi_grub2_cfg" role="full" time="2021-08-16T15:24:08+01:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-file_groupowner_efi_grub2_cfg:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_grub2_password" role="full" time="2021-08-16T15:24:08+01:00" severity="high" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_file_groupowner_grub2_cfg" role="full" time="2021-08-16T15:24:08+01:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_file_owner_grub2_cfg" role="full" time="2021-08-16T15:24:08+01:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_file_permissions_grub2_cfg" role="full" time="2021-08-16T15:24:08+01:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_grub2_admin_username" role="full" time="2021-08-16T15:24:08+01:00" severity="low" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_package_cron_installed" role="full" time="2021-08-16T15:24:08+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-package_cron_installed:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_service_cron_enabled" role="full" time="2021-08-16T15:24:08+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-service_cron_enabled:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_service_crond_enabled" role="full" time="2021-08-16T15:24:09+01:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-service_crond_enabled:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_service_atd_disabled" role="full" time="2021-08-16T15:24:09+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-service_atd_disabled:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_disable_anacron" role="full" time="2021-08-16T15:24:09+01:00" severity="unknown" weight="1.000000">
      <result>notchecked</result>
      <message severity="info">No candidate or applicable check found.</message>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_package_sendmail_removed" role="full" time="2021-08-16T15:24:09+01:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-package_sendmail_removed:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_postfix_client_configure_mail_alias" role="full" time="2021-08-16T15:24:09+01:00" severity="low" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export export-name="oval:ssg-var_postfix_root_mail_alias:var:1" value-id="xccdf_org.ssgproject.content_value_var_postfix_root_mail_alias"/>
        <check-content-ref name="oval:ssg-postfix_client_configure_mail_alias:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_postfix_client_configure_relayhost" role="full" time="2021-08-16T15:24:09+01:00" severity="medium" weight="1.000000">
      <result>notchecked</result>
      <message severity="info">No candidate or applicable check found.</message>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_package_net-snmp_removed" role="full" time="2021-08-16T15:24:09+01:00" severity="unknown" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-package_net-snmp_removed:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_snmpd_no_rwusers" role="full" time="2021-08-16T15:24:09+01:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_snmpd_not_default_password" role="full" time="2021-08-16T15:24:09+01:00" severity="high" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_snmpd_use_newer_protocol" role="full" time="2021-08-16T15:24:09+01:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_package_inetutils-telnetd_removed" role="full" time="2021-08-16T15:24:09+01:00" severity="high" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-package_inetutils-telnetd_removed:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_package_nis_removed" role="full" time="2021-08-16T15:24:09+01:00" severity="low" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-package_nis_removed:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_package_ntpdate_removed" role="full" time="2021-08-16T15:24:09+01:00" severity="low" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-package_ntpdate_removed:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_package_telnetd-ssl_removed" role="full" time="2021-08-16T15:24:09+01:00" severity="high" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-package_telnetd-ssl_removed:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_package_telnetd_removed" role="full" time="2021-08-16T15:24:09+01:00" severity="high" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-package_telnetd_removed:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_package_fapolicyd_installed" role="full" time="2021-08-16T15:24:09+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-package_fapolicyd_installed:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_package_nfs-utils_removed" role="full" time="2021-08-16T15:24:09+01:00" severity="low" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-package_nfs-utils_removed:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_nfs_fixed_lockd_tcp_port" role="full" time="2021-08-16T15:24:09+01:00" severity="unknown" weight="1.000000">
      <result>notchecked</result>
      <message severity="info">No candidate or applicable check found.</message>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_nfs_fixed_statd_port" role="full" time="2021-08-16T15:24:09+01:00" severity="unknown" weight="1.000000">
      <result>notchecked</result>
      <message severity="info">No candidate or applicable check found.</message>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_nfs_fixed_lockd_udp_port" role="full" time="2021-08-16T15:24:09+01:00" severity="unknown" weight="1.000000">
      <result>notchecked</result>
      <message severity="info">No candidate or applicable check found.</message>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_nfs_fixed_mountd_port" role="full" time="2021-08-16T15:24:09+01:00" severity="unknown" weight="1.000000">
      <result>notchecked</result>
      <message severity="info">No candidate or applicable check found.</message>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_service_nfs_disabled" role="full" time="2021-08-16T15:24:09+01:00" severity="unknown" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-service_nfs_disabled:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_service_rpcsvcgssd_disabled" role="full" time="2021-08-16T15:24:09+01:00" severity="unknown" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-service_rpcsvcgssd_disabled:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_nfs_no_anonymous" role="full" time="2021-08-16T15:24:09+01:00" severity="unknown" weight="1.000000">
      <result>notchecked</result>
      <message severity="info">No candidate or applicable check found.</message>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_no_insecure_locks_exports" role="full" time="2021-08-16T15:24:09+01:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-no_insecure_locks_exports:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_restrict_nfs_clients_to_privileged_ports" role="full" time="2021-08-16T15:24:09+01:00" severity="unknown" weight="1.000000">
      <result>notchecked</result>
      <message severity="info">No candidate or applicable check found.</message>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_use_root_squashing_all_exports" role="full" time="2021-08-16T15:24:09+01:00" severity="unknown" weight="1.000000">
      <result>notchecked</result>
      <message severity="info">No candidate or applicable check found.</message>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_no_all_squash_exports" role="full" time="2021-08-16T15:24:09+01:00" severity="low" weight="1.000000">
      <result>notchecked</result>
      <message severity="info">No candidate or applicable check found.</message>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_service_nfslock_disabled" role="full" time="2021-08-16T15:24:09+01:00" severity="unknown" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-service_nfslock_disabled:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_service_rpcgssd_disabled" role="full" time="2021-08-16T15:24:09+01:00" severity="unknown" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-service_rpcgssd_disabled:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_service_rpcidmapd_disabled" role="full" time="2021-08-16T15:24:09+01:00" severity="unknown" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-service_rpcidmapd_disabled:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_service_netfs_disabled" role="full" time="2021-08-16T15:24:09+01:00" severity="unknown" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-service_netfs_disabled:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_package_xorg-x11-server-common_removed" role="full" time="2021-08-16T15:24:09+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-package_xorg-x11-server-common_removed:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_xwindows_runlevel_target" role="full" time="2021-08-16T15:24:09+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-xwindows_runlevel_target:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_kerberos_disable_no_keytab" role="full" time="2021-08-16T15:24:09+01:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-kerberos_disable_no_keytab:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_package_vsftpd_removed" role="full" time="2021-08-16T15:24:09+01:00" severity="high" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-package_vsftpd_removed:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_ftp_present_banner" role="full" time="2021-08-16T15:24:09+01:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-ftp_present_banner:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_ftp_disable_uploads" role="full" time="2021-08-16T15:24:09+01:00" severity="unknown" weight="1.000000">
      <result>notchecked</result>
      <message severity="info">No candidate or applicable check found.</message>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_ftp_home_partition" role="full" time="2021-08-16T15:24:09+01:00" severity="unknown" weight="1.000000">
      <result>notchecked</result>
      <message severity="info">No candidate or applicable check found.</message>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_ftp_log_transactions" role="full" time="2021-08-16T15:24:09+01:00" severity="unknown" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-ftp_log_transactions:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_ftp_configure_firewall" role="full" time="2021-08-16T15:24:09+01:00" severity="unknown" weight="1.000000">
      <result>notchecked</result>
      <message severity="info">No candidate or applicable check found.</message>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_ftp_limit_users" role="full" time="2021-08-16T15:24:09+01:00" severity="unknown" weight="1.000000">
      <result>notchecked</result>
      <message severity="info">No candidate or applicable check found.</message>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_ftp_restrict_to_anon" role="full" time="2021-08-16T15:24:09+01:00" severity="medium" weight="1.000000">
      <result>notchecked</result>
      <message severity="info">No candidate or applicable check found.</message>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_package_vsftpd_installed" role="full" time="2021-08-16T15:24:09+01:00" severity="low" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-package_vsftpd_installed:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_package_chrony_installed" role="full" time="2021-08-16T15:24:09+01:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-package_chrony_installed:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_package_ntp_installed" role="full" time="2021-08-16T15:24:09+01:00" severity="high" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-package_ntp_installed:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_service_chronyd_enabled" role="full" time="2021-08-16T15:24:09+01:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-service_chronyd_enabled:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_service_chronyd_or_ntpd_enabled" role="full" time="2021-08-16T15:24:09+01:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-service_chronyd_or_ntpd_enabled:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_service_ntp_enabled" role="full" time="2021-08-16T15:24:09+01:00" severity="high" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-service_ntp_enabled:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_service_ntpd_enabled" role="full" time="2021-08-16T15:24:09+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-service_ntpd_enabled:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_chronyd_or_ntpd_set_maxpoll" role="full" time="2021-08-16T15:24:09+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export export-name="oval:ssg-var_time_service_set_maxpoll:var:1" value-id="xccdf_org.ssgproject.content_value_var_time_service_set_maxpoll"/>
        <check-content-ref name="oval:ssg-chronyd_or_ntpd_set_maxpoll:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_chronyd_run_as_chrony_user" role="full" time="2021-08-16T15:24:09+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-chronyd_run_as_chrony_user:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_ntpd_specify_multiple_servers" role="full" time="2021-08-16T15:24:09+01:00" severity="unknown" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-ntpd_specify_multiple_servers:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_chronyd_or_ntpd_specify_remote_server" role="full" time="2021-08-16T15:24:09+01:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-chronyd_or_ntpd_specify_remote_server:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_chronyd_or_ntpd_specify_multiple_servers" role="full" time="2021-08-16T15:24:09+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-chronyd_or_ntpd_specify_multiple_servers:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_ntpd_configure_restrictions" role="full" time="2021-08-16T15:24:09+01:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_ntpd_run_as_ntp_user" role="full" time="2021-08-16T15:24:09+01:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_chronyd_no_chronyc_network" role="full" time="2021-08-16T15:24:09+01:00" severity="low" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-chronyd_no_chronyc_network:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_ntpd_specify_remote_server" role="full" time="2021-08-16T15:24:09+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-ntpd_specify_remote_server:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_chronyd_client_only" role="full" time="2021-08-16T15:24:09+01:00" severity="low" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-chronyd_client_only:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_chronyd_specify_remote_server" role="full" time="2021-08-16T15:24:09+01:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-chronyd_specify_remote_server:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_avahi_disable_publishing" role="full" time="2021-08-16T15:24:09+01:00" severity="low" weight="1.000000">
      <result>notchecked</result>
      <message severity="info">No candidate or applicable check found.</message>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_package_openldap-clients_removed" role="full" time="2021-08-16T15:24:09+01:00" severity="low" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-package_openldap-clients_removed:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_dhcp_client_restrict_options" role="full" time="2021-08-16T15:24:09+01:00" severity="unknown" weight="1.000000">
      <result>notchecked</result>
      <message severity="info">No candidate or applicable check found.</message>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_dhcp_server_minimize_served_info" role="full" time="2021-08-16T15:24:09+01:00" severity="unknown" weight="1.000000">
      <result>notchecked</result>
      <message severity="info">No candidate or applicable check found.</message>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_service_rsyncd_disabled" role="full" time="2021-08-16T15:24:09+01:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-service_rsyncd_disabled:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_no_rsh_trust_files" role="full" time="2021-08-16T15:24:09+01:00" severity="high" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-no_rsh_trust_files:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_package_bind_removed" role="full" time="2021-08-16T15:24:09+01:00" severity="low" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-package_bind_removed:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_service_rngd_enabled" role="full" time="2021-08-16T15:24:09+01:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-service_rngd_enabled:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_package_sssd-ipa_installed" role="full" time="2021-08-16T15:24:09+01:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-package_sssd-ipa_installed:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_sssd_memcache_timeout" role="full" time="2021-08-16T15:24:09+01:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export export-name="oval:ssg-var_sssd_memcache_timeout:var:1" value-id="xccdf_org.ssgproject.content_value_var_sssd_memcache_timeout"/>
        <check-content-ref name="oval:ssg-sssd_memcache_timeout:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_sssd_ssh_known_hosts_timeout" role="full" time="2021-08-16T15:24:09+01:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export export-name="oval:ssg-var_sssd_ssh_known_hosts_timeout:var:1" value-id="xccdf_org.ssgproject.content_value_var_sssd_ssh_known_hosts_timeout"/>
        <check-content-ref name="oval:ssg-sssd_ssh_known_hosts_timeout:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_sssd_run_as_sssd_user" role="full" time="2021-08-16T15:24:09+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-sssd_run_as_sssd_user:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_sssd_enable_smartcards" role="full" time="2021-08-16T15:24:09+01:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-sssd_enable_smartcards:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_sssd_offline_cred_expiration" role="full" time="2021-08-16T15:24:09+01:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-sssd_offline_cred_expiration:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_package_usbguard_installed" role="full" time="2021-08-16T15:24:09+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-package_usbguard_installed:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_service_usbguard_enabled" role="full" time="2021-08-16T15:24:09+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-service_usbguard_enabled:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_configure_usbguard_auditbackend" role="full" time="2021-08-16T15:24:09+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-configure_usbguard_auditbackend:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_usbguard_allow_hid_and_hub" role="full" time="2021-08-16T15:24:09+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-usbguard_allow_hid_and_hub:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_usbguard_allow_hid" role="full" time="2021-08-16T15:24:09+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-usbguard_allow_hid:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_usbguard_allow_hub" role="full" time="2021-08-16T15:24:09+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-usbguard_allow_hub:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_package_openssh-server_installed" role="full" time="2021-08-16T15:24:09+01:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-package_openssh-server_installed:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_package_openssh-server_removed" role="full" time="2021-08-16T15:24:09+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-package_openssh-server_removed:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_service_sshd_disabled" role="full" time="2021-08-16T15:24:09+01:00" severity="unknown" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-service_sshd_disabled:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_file_permissions_sshd_pub_key" role="full" time="2021-08-16T15:24:09+01:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-file_permissions_sshd_pub_key:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_iptables_sshd_disabled" role="full" time="2021-08-16T15:24:09+01:00" severity="unknown" weight="1.000000">
      <result>notchecked</result>
      <message severity="info">No candidate or applicable check found.</message>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_file_permissions_sshd_private_key" role="full" time="2021-08-16T15:24:09+01:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-file_permissions_sshd_private_key:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_sshd_rekey_limit" role="full" time="2021-08-16T15:24:09+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export export-name="oval:ssg-sshd_required:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_required"/>
        <check-export export-name="oval:ssg-var_rekey_limit_time:var:1" value-id="xccdf_org.ssgproject.content_value_var_rekey_limit_time"/>
        <check-export export-name="oval:ssg-var_rekey_limit_size:var:1" value-id="xccdf_org.ssgproject.content_value_var_rekey_limit_size"/>
        <check-content-ref name="oval:ssg-sshd_rekey_limit:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_sshd_disable_gssapi_auth" role="full" time="2021-08-16T15:24:09+01:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export export-name="oval:ssg-sshd_required:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_required"/>
        <check-content-ref name="oval:ssg-sshd_disable_gssapi_auth:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_sshd_print_last_log" role="full" time="2021-08-16T15:24:09+01:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export export-name="oval:ssg-sshd_required:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_required"/>
        <check-content-ref name="oval:ssg-sshd_print_last_log:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_sshd_set_idle_timeout" role="full" time="2021-08-16T15:24:09+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export export-name="oval:ssg-sshd_required:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_required"/>
        <check-export export-name="oval:ssg-var_sshd_set_keepalive:var:1" value-id="xccdf_org.ssgproject.content_value_var_sshd_set_keepalive"/>
        <check-export export-name="oval:ssg-sshd_idle_timeout_value:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_idle_timeout_value"/>
        <check-content-ref name="oval:ssg-sshd_set_idle_timeout:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_sshd_set_loglevel_verbose" role="full" time="2021-08-16T15:24:09+01:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export export-name="oval:ssg-sshd_required:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_required"/>
        <check-content-ref name="oval:ssg-sshd_set_loglevel_verbose:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_sshd_enable_gssapi_auth" role="full" time="2021-08-16T15:24:09+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export export-name="oval:ssg-sshd_required:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_required"/>
        <check-content-ref name="oval:ssg-sshd_enable_gssapi_auth:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_sshd_set_max_auth_tries" role="full" time="2021-08-16T15:24:09+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export export-name="oval:ssg-sshd_max_auth_tries_value:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_max_auth_tries_value"/>
        <check-content-ref name="oval:ssg-sshd_set_max_auth_tries:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_sshd_set_loglevel_info" role="full" time="2021-08-16T15:24:09+01:00" severity="low" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export export-name="oval:ssg-sshd_required:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_required"/>
        <check-content-ref name="oval:ssg-sshd_set_loglevel_info:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_sshd_disable_x11_forwarding" role="full" time="2021-08-16T15:24:09+01:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export export-name="oval:ssg-sshd_required:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_required"/>
        <check-content-ref name="oval:ssg-sshd_disable_x11_forwarding:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_sshd_disable_root_password_login" role="full" time="2021-08-16T15:24:09+01:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export export-name="oval:ssg-sshd_required:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_required"/>
        <check-content-ref name="oval:ssg-sshd_disable_root_password_login:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_sshd_disable_root_login" role="full" time="2021-08-16T15:24:09+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export export-name="oval:ssg-sshd_required:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_required"/>
        <check-content-ref name="oval:ssg-sshd_disable_root_login:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_sshd_limit_user_access" role="full" time="2021-08-16T15:24:09+01:00" severity="unknown" weight="1.000000">
      <result>notchecked</result>
      <message severity="info">No candidate or applicable check found.</message>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_sshd_disable_tcp_forwarding" role="full" time="2021-08-16T15:24:09+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export export-name="oval:ssg-sshd_required:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_required"/>
        <check-content-ref name="oval:ssg-sshd_disable_tcp_forwarding:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_disable_host_auth" role="full" time="2021-08-16T15:24:09+01:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export export-name="oval:ssg-sshd_required:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_required"/>
        <check-content-ref name="oval:ssg-disable_host_auth:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_sshd_allow_only_protocol2" role="full" time="2021-08-16T15:24:09+01:00" severity="high" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export export-name="oval:ssg-sshd_required:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_required"/>
        <check-content-ref name="oval:ssg-sshd_allow_only_protocol2:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_sshd_enable_warning_banner" role="full" time="2021-08-16T15:24:09+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export export-name="oval:ssg-sshd_required:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_required"/>
        <check-content-ref name="oval:ssg-sshd_enable_warning_banner:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_sshd_disable_compression" role="full" time="2021-08-16T15:24:09+01:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export export-name="oval:ssg-sshd_required:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_required"/>
        <check-export export-name="oval:ssg-var_sshd_disable_compression:var:1" value-id="xccdf_org.ssgproject.content_value_var_sshd_disable_compression"/>
        <check-content-ref name="oval:ssg-sshd_disable_compression:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_sshd_x11_use_localhost" role="full" time="2021-08-16T15:24:09+01:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export export-name="oval:ssg-sshd_required:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_required"/>
        <check-content-ref name="oval:ssg-sshd_x11_use_localhost:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_sshd_enable_strictmodes" role="full" time="2021-08-16T15:24:09+01:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export export-name="oval:ssg-sshd_required:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_required"/>
        <check-content-ref name="oval:ssg-sshd_enable_strictmodes:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_sshd_disable_empty_passwords" role="full" time="2021-08-16T15:24:09+01:00" severity="high" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export export-name="oval:ssg-sshd_required:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_required"/>
        <check-content-ref name="oval:ssg-sshd_disable_empty_passwords:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_sshd_disable_kerb_auth" role="full" time="2021-08-16T15:24:09+01:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export export-name="oval:ssg-sshd_required:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_required"/>
        <check-content-ref name="oval:ssg-sshd_disable_kerb_auth:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_sshd_use_priv_separation" role="full" time="2021-08-16T15:24:09+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export export-name="oval:ssg-sshd_required:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_required"/>
        <check-export export-name="oval:ssg-var_sshd_priv_separation:var:1" value-id="xccdf_org.ssgproject.content_value_var_sshd_priv_separation"/>
        <check-content-ref name="oval:ssg-sshd_use_priv_separation:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_sshd_disable_rhosts_rsa" role="full" time="2021-08-16T15:24:09+01:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export export-name="oval:ssg-sshd_required:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_required"/>
        <check-content-ref name="oval:ssg-sshd_disable_rhosts_rsa:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_sshd_do_not_permit_user_env" role="full" time="2021-08-16T15:24:09+01:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export export-name="oval:ssg-sshd_required:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_required"/>
        <check-content-ref name="oval:ssg-sshd_do_not_permit_user_env:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_sshd_disable_rhosts" role="full" time="2021-08-16T15:24:09+01:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export export-name="oval:ssg-sshd_required:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_required"/>
        <check-content-ref name="oval:ssg-sshd_disable_rhosts:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_sshd_set_keepalive" role="full" time="2021-08-16T15:24:09+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export export-name="oval:ssg-sshd_required:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_required"/>
        <check-export export-name="oval:ssg-var_sshd_set_keepalive:var:1" value-id="xccdf_org.ssgproject.content_value_var_sshd_set_keepalive"/>
        <check-content-ref name="oval:ssg-sshd_set_keepalive:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_sshd_set_keepalive_0" role="full" time="2021-08-16T15:24:09+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export export-name="oval:ssg-sshd_required:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_required"/>
        <check-content-ref name="oval:ssg-sshd_set_keepalive_0:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_sshd_enable_x11_forwarding" role="full" time="2021-08-16T15:24:09+01:00" severity="high" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export export-name="oval:ssg-sshd_required:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_required"/>
        <check-content-ref name="oval:ssg-sshd_enable_x11_forwarding:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_sshd_disable_pubkey_auth" role="full" time="2021-08-16T15:24:09+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export export-name="oval:ssg-sshd_required:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_required"/>
        <check-content-ref name="oval:ssg-sshd_disable_pubkey_auth:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_sshd_disable_user_known_hosts" role="full" time="2021-08-16T15:24:09+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export export-name="oval:ssg-sshd_required:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_required"/>
        <check-content-ref name="oval:ssg-sshd_disable_user_known_hosts:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_sshd_set_max_sessions" role="full" time="2021-08-16T15:24:09+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export export-name="oval:ssg-var_sshd_max_sessions:var:1" value-id="xccdf_org.ssgproject.content_value_var_sshd_max_sessions"/>
        <check-export export-name="oval:ssg-sshd_required:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_required"/>
        <check-content-ref name="oval:ssg-sshd_set_max_sessions:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_package_abrt_removed" role="full" time="2021-08-16T15:24:09+01:00" severity="medium" weight="1.000000">
      <result>fail</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-package_abrt_removed:def:1" href="ssg-fedora-oval.xml"/>
      </check>
    </rule-result>
    <score system="urn:xccdf:scoring:default" maximum="100.000000">43.542599</score>
  </TestResult>
</Benchmark>
